DeepSeek

For teams using DeepSeek, Sentinel checks prompts, agents, tool calls, and RAG flows independently of the provider.

Current models

According to the official DeepSeek API documentation, the current V4 model IDs are deepseek-v4-flash and deepseek-v4-pro. The DeepSeek changelog says legacy compatibility names are scheduled for discontinuation on July 24, 2026, so new examples should use the V4 model IDs.

Architecture notes

DeepSeek API can be used through an OpenAI Chat Completions compatible interface and an Anthropic interface. Sentinel does not make provider details the center of the security model; the focus is prompts, tool calls, RAG context, system instructions, and output validation.

DeepSeek V4 thinking-mode security

DeepSeek V4 thinking mode can return a reasoning field separate from the final answer. Because that field may be passed back to the API in tool-call loops, it creates a separate security surface across prompts, tool output, RAG context, and logging.

• System instruction exposure — The model may restate system prompt instructions in reasoning fields. If this field is logged raw or returned to the user, it exposes confidential business logic (OWASP LLM02:2025).
• Indirect injection vector — Adversarial text in RAG documents or tool results can be interpreted while the model reasons, opening a prompt-hijacking path at the reasoning stage (OWASP LLM01:2025, MITRE ATLAS AML.T0051.001).
• Sensitive context leakage — PII or confidential data from conversation history or RAG context can appear in the reasoning field. Avoid returning raw reasoning content to end-users; log it internally only in redacted form.
• Sentinel coverage — Sentinel Prompt Firewall scans reasoning content under the secret-leakage and prompt-injection rule categories. Enable the <code>scan_reasoning_content: true</code> parameter in configuration.

Typical risks in DeepSeek integrations

• System instructions leaking into user responses or logs. OWASP LLM02:2025
• User input escaping the JSON schema or action boundary in tool calls. OWASP LLM01:2025
• Sensitive customer, financial, or operational data leaking from RAG documents. OWASP LLM02:2025
• Guardrail assumptions silently breaking during provider changes. OWASP LLM09:2025
• System instructions or PII restated inside reasoning content. OWASP LLM02:2025
• DeepSeek API key embedded in CI environment variables or prompt files. OWASP LLM09:2025

These are not provider-specific magic flaws. Even when the LLM provider changes, the same prompt, tool-use, retrieval, and secret boundaries remain. That is why Sentinel docs focus on evidence, rule IDs, output formats, and closure commands more than the provider name.

Compliance: data handling and residency

DeepSeek API endpoints operate from China-based infrastructure. Evaluate which infrastructure prompt and completion data transits and is processed on. For environments subject to GDPR, KVKK, HIPAA, or PCI-DSS data-residency requirements, review the alternatives below.

• Local deployment (Ollama / llama.cpp) — Open-weight DeepSeek-family models can be run on local hardware or a private cloud. Data does not leave to third-party infrastructure, providing the highest compliance assurance.
• DeepSeek via Azure AI Foundry / AWS Bedrock — Microsoft Azure and AWS offer DeepSeek models on their own regional infrastructure. Data processing occurs within the chosen cloud region's BAA and DPA scope.
• Direct DeepSeek API — Appropriate for low-to-medium risk use cases without data-residency constraints and without processing sensitive personal data.

What to scan

Sentinel automatically scans the following seven security surfaces in your DeepSeek integration. Every check is reported by rule ID; findings can be fed into CI/CD pipelines via SARIF or JSON output.

• System and developer prompt leakage — Checks whether confidential instructions in the system layer leak into user responses or API response bodies. Rule: <code>prompt-firewall/system-prompt-leakage</code>
• Tool-call argument injection — Detects whether user input escapes the tool-argument boundary and whether server-side validation is bypassed. Rule: <code>tool-argument-injection</code>
• Sensitive data leakage in RAG context — Audits whether PII, financial data, or confidential business content from retrieval documents leaks into model responses. Rule: <code>rag-data-leakage</code>
• Reasoning content leakage — Scans DeepSeek V4 thinking-mode output for system instructions or PII. Rule: <code>reasoning-token-leakage</code>
• MCP tool poisoning — Verifies signatures and schemas of tool definitions received from MCP servers; flags tampered definitions. Rule: <code>mcp-tool-poisoning</code>
• API key and secrets detection — Scans source code, prompt files, and environment variables for exposed <code>DEEPSEEK_API_KEY</code> and other API key patterns. Rule: <code>secrets/deepseek-api-key</code>
• OWASP LLM compliance check — Evaluates your integration against the OWASP LLM Top 10 2025 framework and reports which categories have findings.

sentinel scan ./app/ --provider deepseek
sentinel scan ./app/ --rule reasoning-token-leakage
sentinel secrets-scan ./app/ --rule secrets/deepseek-api-key
sentinel compliance check . --framework owasp-llm

Example configurations

The examples below show three sentinel.yaml templates: basic integration, V4 thinking-mode auditing, and a full DeepSeek configuration.

Basic integration

provider:
  name: deepseek
  model: deepseek-v4-flash

checks:
  - prompt-injection
  - tool-argument-injection
  - rag-data-leakage
  - secrets/deepseek-api-key

With V4 thinking-mode auditing

provider:
  name: deepseek
  model: deepseek-v4-pro
  thinking:
    type: enabled

checks:
  - prompt-injection
  - reasoning-token-leakage
  - rag-data-leakage

reasoning:
  scan_reasoning_content: true
  redact_before_logs: true
  strip_before_response: true

Full configuration with MCP bridge

provider:
  name: deepseek
  model: deepseek-v4-pro
  base_url: https://api.deepseek.com/v1

checks:
  - prompt-injection
  - tool-argument-injection
  - rag-data-leakage
  - reasoning-token-leakage
  - mcp-tool-poisoning
  - secrets/deepseek-api-key

mcp:
  server: ./mcp-server.json
  verify_tool_signatures: true

compliance:
  framework: owasp-llm
  fail_on: CRITICAL

output:
  format: sarif
  path: ./sentinel-results.sarif

CI/CD

For DeepSeek-backed agents or RAG apps, prompt changes, tool schema changes, and retrieval settings should be tested in pull requests. Sentinel findings keep the same rule IDs; the pipeline does not need to be rewritten when the model provider changes.

Basic shell commands

# Scan and output SARIF for GitHub Security tab
sentinel scan ./app/ -f sarif -o sentinel.sarif

# Check OWASP LLM compliance
sentinel compliance check . --framework owasp-llm

# Detect exposed API keys and secrets
sentinel secrets-scan ./app/

# DeepSeek V4 thinking-mode scan
sentinel scan ./app/ --rule reasoning-token-leakage

# Exit non-zero on CRITICAL/HIGH findings (blocks merge)
sentinel scan ./app/ --fail-on CRITICAL,HIGH

GitHub Actions workflow (full example)

name: Sentinel AI Security

on: [push, pull_request]

jobs:
  sentinel:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Sentinel
        run: pip install eresus-sentinel

      - name: Scan for AI security issues
        run: |
          sentinel scan ./app/ -f sarif -o sentinel.sarif
          sentinel secrets-scan ./app/
          sentinel compliance check . --framework owasp-llm
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sentinel.sarif
        if: always()

MCP integration security

When DeepSeek models are used alongside Model Context Protocol (MCP) servers, the agent security surface spans MCP tool signatures, resource permissions, and call chains. DeepSeek’s OpenAI-compatible interface works with existing MCP bridge implementations, but this flexibility introduces additional risk points.

• Tool poisoning — Forged or modified MCP tool descriptions can cause the model to misdirect agent actions. Sentinel MCP Agent Security module detects tool signature changes.
• Excessive agent authority — If DeepSeek prompt injection succeeds, every tool accessible via MCP becomes a potential abuse target. Define a permission boundary (allowlist) in tool schemas.
• Call chain audit logging — Log the MCP call chain. Tracking which model called which tool with which arguments and when is essential for forensics and compliance.
• Model boundary validation — When configuring requests via the DeepSeek MCP bridge, specify the model ID explicitly; ambiguous alias usage can break security model assumptions.

sentinel scan ./mcp-config/ --rule mcp-tool-poisoning
sentinel scan ./mcp-config/ --rule tool-argument-injection
sentinel mcp audit ./mcp-server.json

Pre-production checklist