DeepSeek Harness: The Open-Source Agent Layer Nobody Owns Yet

The model you run is becoming the easy part. The harness around it, the thing that decides how it reads files, calls tools, keeps a session and survives an eight-hour job, is where the next two years of lock-in gets decided. On August 13, 2026, DeepSeek shipped a reference implementation of that layer under MIT and invited everyone to take it apart. DeepSeek Harness (dsh) drives DeepSeek, Anthropic, OpenAI, Bedrock, Vertex and Azure models, plus any OpenAI-compatible endpoint, which includes the Ollama or vLLM server already running on your own box.

A harness, for anyone who has only ever used one without naming it, is everything that is not the model: the tool definitions, the file editor, the shell, the session log, the sandbox, the loop that decides what to send next. Here is what actually shipped, what the adoption numbers really say once you query them yourself, and the pricing move it arrived alongside.

TL;DR

• Everything is a plugin, including the agent loop. Model adapters, tool registries, skills, sessions, sandboxes, storage, schedulers and the web UI are all independent extensions on a micro-kernel. You swap any of them from configuration without forking the source.
• It is model-agnostic on purpose, and that is the strategic move. DeepSeek stopped competing only on model quality and token price, and planted a flag in the layer that decides how any model uses tools. That is the layer Claude Code turned into a business.
• Every circulating adoption number is already wrong. We queried the GitHub and npm APIs ourselves on August 20. Stars, plugin counts and version strings all differ from what the aggregators printed, in some cases by an order of magnitude.
• The free harness is the funnel, the API is the meter. Three days after the harness landed, DeepSeek moved V4 to peak and off-peak pricing. V4-Pro output went from a flat $0.87 per million tokens to $3.96 at peak.

How we got here: two years of the harness layer

For most of 2024 and 2025, open-source agent work meant open weights plus a pile of glue. You picked a model, then wrote your own tool loop, or adopted a framework that made a hundred decisions for you and hid them behind class hierarchies. When Manus arrived and the community answered with OpenManus in about three hours, the lesson was not that the agent was easy. It was that the harness was the actual product and it had been hiding in plain sight.

Then two things happened. Anthropic shipped Claude Code and demonstrated that a well-built harness is worth paying for independently of the model inside it. And Google shut down Gemini CLI for consumer users, which pushed a large chunk of the terminal-agent population onto OpenCode, an MIT-licensed agent that talks to 75-plus providers. Model-agnostic stopped being a nice-to-have and became the default expectation.

The open side kept assembling stacks by hand. Our own open agent stack walkthrough wired Nemotron 3 Ultra to LangChain Deep Agents and NVIDIA OpenShell to get a fully open model, harness and runtime. It worked, and it took a tutorial to explain. DeepSeek Harness is the first time a frontier lab has shipped that whole middle layer as one MIT-licensed artifact and said the quiet part out loud: model plus harness equals agent, and only one of those two is ours.

What dsh actually is

The architecture is a micro-kernel, meaning the core does almost nothing except load and wire extensions. It sits on Cordis, a plugin and event-bus meta-framework whose design is described in a paper called A Programming Paradigm for Spatiotemporal Composability. The name is heavier than the idea. Spatial composability means components declare their dependencies on each other and those dependencies are managed reactively. Temporal composability means a component can be removed at runtime and fully revert its side effects, so loading and unloading a plugin mid-session leaves no residue.

That matters more than it sounds for agents specifically. If a skill, a tool registry or a whole sandbox backend can be attached and detached cleanly while a session is live, then presets, hot-swapped models and per-task tool sets stop being special cases and become ordinary configuration.

The codebase is not a toy. It runs to roughly 453,000 lines of TypeScript across about 219 workspace packages. Notably, DeepSeek did not simply depend on Cordis: they vendored a fork, pinning cordis 4.0.0-rc.7 with 18 local patches rescoped under @deepseek-ai. Read that how you like. It gives them full control of their foundation, and it means the paper's reference implementation and the shipping product can drift apart.

Two design decisions stand out because they are enforced rather than merely documented. Every message the model sees is reconstructable from an append-only session log, and at dispatch time the agent loop byte-matches the outgoing request against what the log says it should be. If they diverge, that is an error, not a warning. Second, the test suite records real sessions as .jsonl files and replays them as deterministic mock models, so the tests run with no API keys at all and behavioural drift shows up as a log diff.

The four presets

A preset is just a bundle of plugin configuration. Four ship in the box, and the names DeepSeek uses on its own site differ from the ones circulating in coverage, so these are the official ones.

PTC stands for Programmatic Tool Calling, and it is the one worth understanding. In a normal harness, every tool call is a separate conversational round trip: the model asks, the harness answers, the model asks again. PTC generates a TypeScript SDK from the tool registry and lets the model write a program against it instead. A sequence that would have burned five round trips becomes one call containing a loop, a conditional and error handling. Fewer round trips means fewer tokens and less opportunity for the model to lose the thread halfway through.

Minimal is the one that tells you the most about DeepSeek's motives. Two tools is what fair model evaluation looks like: if you are benchmarking a model's agentic ability, every extra convenience the harness provides is a confound. DeepSeek built this to measure their own models, and shipping it means anyone can now run the same stripped environment against Qwen, GLM or Kimi and get a comparison that is actually about the models.

The numbers, audited

This is where coverage of the launch has been worst. Star counts have been recycled between aggregators for a week and presented as adoption, and the plugin ecosystem figure changes depending on who is counting what. So we queried the public APIs directly instead of quoting anybody.

Run it yourself, it takes about ten seconds:

curl -s https://api.github.com/repos/deepseek-ai/deepseek-harness \
  | jq '{stars: .stargazers_count, forks: .forks_count, issues_enabled: .has_issues}'

curl -s "https://api.github.com/search/repositories?q=topic:dsh-plugin&per_page=1" \
  | jq '.total_count'

curl -s https://registry.npmjs.org/@deepseek-ai/dsh | jq '."dist-tags"'

Three things follow. The star curve is real and steep, and it is also the least informative metric available: a star costs nothing and 172,000 of them do not tell you how many people got past the quickstart. The "fastest launch in GitHub history" line doing the rounds is not verified by GitHub or any primary source, because GitHub does not publish that leaderboard. And the plugin count is a self-assigned topic tag, so 9,055 is a measure of how many people typed dsh-plugin into a repo's settings, not how many working plugins exist.

The version history is the genuinely useful signal. Eight npm releases in nine days, with 0.1.0-rc.5 never published at all, is exactly what a developer preview iterating in public looks like. Believe that over the stars.

How it sits next to what you already run

The sub-agent column is the interesting one. dsh ships hook bridges that resolve the claude-code and codex binaries from your PATH and dispatch subtasks to them. You supply the install and the login; DeepSeek supplies the orchestration. That positions the harness above the incumbents rather than purely against them, which is a more durable place to stand than a straight replacement would be.

One limitation to note in the same breath: MCP support is client-only. dsh consumes MCP servers happily, but it does not expose itself as one, so you cannot mount it inside another agent the way it mounts them.

Point it at your own model

The whole thing runs from npm, and the web UI comes up on 127.0.0.1:3080:

npx @deepseek-ai/dsh web

# server only, no browser launch (useful over SSH)
npx @deepseek-ai/dsh web --no-open

The part that matters for this audience is the custom provider. Anything that speaks the OpenAI completions protocol can be registered, which covers Ollama, vLLM and OpenRouter without any DeepSeek-specific plumbing. The configuration shape comes straight from DeepSeek's provider documentation:

llm-pi-ai:
  providers:
    local-ollama:
      apiKeyEnv: OLLAMA_API_KEY
      api: openai-completions
      baseURL: http://127.0.0.1:11434/v1
      models:
        - id: qwen3.5-coder:32b

If you are still deciding what should sit behind that baseURL, our local inference server comparison covers the throughput and memory tradeoffs between Ollama, llama.cpp and vLLM. Ollama's own agent mode is the lower-effort alternative if you would rather not run a harness at all.

Before you let any of it touch a real repository, learn the three sandbox policies, which are set per tool call: read-only, workspace-write and danger-full-access. On Linux, confinement uses bubblewrap plus Landlock through a purpose-built launcher; macOS uses Seatbelt; Windows uses write-restricted tokens. The failure mode is the right one: if confinement is unavailable, execution is refused rather than quietly downgraded. The Windows backend documents its own gap, though, and it is worth reading before you trust it, because reads, network access and process visibility all stay unrestricted there.

Risks and open questions

DeepSeek's own README shouts the first one in capitals: this is a developer preview and there will be compatibility-breaking changes. Eight releases in nine days is the evidence, not the exception. Anything you build against the plugin API this month is a bet that the API survives the month.

GitHub Issues are disabled, so there is no public bug trail and no searchable record of what is broken. Feedback routes through Discussions and Discord, which is fine for chatter and poor for the "has anyone else hit this" search that developers actually perform. The repository history is a single squashed commit with no review trail, so you cannot read the reasoning behind any decision in the code.

BENCHMARK.md is a three-line stub. There is no methodology, no scores, no eval harness. You can read that as admirable restraint from a lab that could easily have shipped a self-favouring chart, or as a notable gap for a runtime whose Minimal preset exists specifically to make benchmarking honest. Probably both. Either way, nobody has published a credible independent comparison yet, so treat any performance claim you see about dsh as unsupported.

Finally, the Cordis paper is a preprint hosted on GitHub rather than arXiv, dated the same day as the launch and marked as under active revision. The ideas in it are legible and worth reading. It has not been through review.

The kicker: a free harness and a metered API

The harness landed on August 13 alongside V4-Pro-0813 going generally available. Three days later, at 16:00 UTC on August 16, DeepSeek changed how the API bills. This is the part almost nobody covered, and it is the part that explains the giveaway.

Peak windows are 01:00 to 04:00 UTC and 06:00 to 10:00 UTC. Everything else is off-peak, and off-peak is exactly half of peak. Input prices were restructured at the same time, so the pre-change flat input rates are not directly comparable; the output column is the clean read. V4-Pro output at peak is roughly 4.5 times what it cost the week before.

Put the two moves side by side. The harness is free, MIT and model-agnostic. The models it was built to showcase, deepseek-v4-pro and deepseek-v4-flash, now cost considerably more per token during the hours when a lot of the world is working. Agent workloads are the most token-hungry pattern in production use, and a harness that makes long autonomous runs easier is a harness that increases token burn. Free tooling that raises metered consumption is a familiar business model, and it is not a criticism, just the thing to be clear-eyed about.

The escape hatch is in the same repository. The custom provider block above is not a workaround, it is documented behaviour, and it points dsh at a model you host yourself where peak hours do not exist. That is a genuinely unusual thing for a lab to ship, and it is the strongest argument that the harness is a land grab for the layer rather than a funnel for the API. Both readings can be true at once.

What to watch in the next 90 days

• Whether Issues reopen. It is the single clearest signal of whether this is a community project or a published artifact with a comment box.
• Whether the plugin API stabilises. Watch for the release cadence to slow and a 0.2 to appear with a migration note. Until then, treat plugin development as prototyping.
• Whether anyone else adopts the Cordis plugin protocol. If a competing harness can load a dsh plugin, the layer starts to standardise and DeepSeek's bet pays off. If not, this is one lab's very good internal tool with an MIT license attached.
• Whether independent benchmarks appear using Minimal mode. That is the preset that makes cross-model comparison meaningful, and the first credible open leaderboard built on it will matter more than any vendor chart.
• Whether the pricing split holds. If off-peak scheduling catches on, expect other providers to copy the structure.

Who should use it today

If you build agent infrastructure and have ever been blocked by a harness decision you could not override, spend an afternoon with this one; the plugin boundaries are the point and they are unusually well drawn. If you evaluate models, Minimal mode is worth adopting on its own merits regardless of what you think of the rest. If you just want a working coding agent today, OpenCode or Claude Code will annoy you less, and you can revisit dsh at 0.2.

The ten-minute move: run npx @deepseek-ai/dsh web --no-open, add your local Ollama endpoint as a custom provider using the YAML above, load Minimal mode, and give it one small refactor to do inside a throwaway git worktree with the sandbox on workspace-write. You will learn more about where the harness layer is heading than any launch post can tell you, including this one.

Sources and further reading

• OpenCode: the open-source AI coding agent everyone switched to after Gemini CLI
• Run a fully open agent stack: OpenShell, LangChain Deep Agents and Nemotron
• DeepSeek-V4-Flash: the small V4 variant, out of preview
• DeepSeek V4: the architecture breakdown
• Ollama vs llama.cpp vs vLLM: picking a local inference server
• OpenManus: the open-source answer to Manus AI
• deepseek-ai/deepseek-harness on GitHub (MIT)
• DeepSeek Harness product page and preset descriptions
• DeepSeek Harness developer documentation
• A Programming Paradigm for Spatiotemporal Composability (preprint)
• The dsh-plugin topic on GitHub
• DeepSeek API platform and current pricing

Tested on: not independently tested. Architecture, preset and sandbox details are taken from DeepSeek's published documentation and repository. The GitHub, npm and plugin-topic figures were queried directly from the public APIs on the date below and will have moved since; the commands to re-check them are in the article. Pricing figures are from DeepSeek's own announcement.
Date checked: 2026-08-20