DeepSeek Harness: an agent harness you assemble yourself

DeepSeek Harness is an open-source agent harness that DeepSeek published on 13 August 2026 under the MIT license. Its core holds no model, no tool and no fixed interface: everything is a plugin, the agent loop included, and your configuration wires the rest together. Anyone who wants an assistant that just works will give up within ten minutes. Anyone who wants a say in what happens between the prompt and the file on disk will find few projects this open.

The repository showed 257,620 stars and 31,089 forks on 22 October 2026, two months after it was created, figures read from the GitHub API. I have been running DSH as a coding agent while writing this piece, which helps separate what holds up in a real session from what only reads well in a README.

Everything is a plugin, the loop too

A running dsh is not a monolith with extension points drilled into it. It is a tree of Cordis plugins composed at boot, layer over layer: the bundles of a profile, your own patch file, then overlays passed on the command line. The model adapter, the tool registry, the session log and the agent loop are all plugins. The architecture docs are blunt about the consequence: there is no privileged core to patch, you mount a plugin next to the others. Cordis has an academic paper behind it, submitted on 26 August 2026, where every context transformation carries an inverse the runtime keeps, and every plugin declares what it reacts to. Unloading a plugin unwinds its registrations, so swapping the loop mid-session doesn’t leave ghost tools hanging in the context.

A profile is a name plus a stack of bundles: web for the browser UI, headless for a single task with no server, sdk for a programmatic client. dsh --profile web --dump-config prints the whole tree, and any row in it can be replaced by a YAML patch.

Subagents run through the same machinery. A provider decides what a child actually is: a fresh agent, a forked session that carries your context, or a turn delegated to another product. One contract, different executors.

Four modes, one deliberately bare

Mode	What it gives you	What it’s for
Standard	The full tool set	Everyday work on a repo
Code (PTC)	The model writes code that chains tool calls	Long, many-step tasks
Minimal	A shell and a text editor, nothing else	Evaluating a model with no scaffolding
Creator	Inspect the environment, test a plugin in memory	Building a mode of your own

Minimal is the one I’d keep for model evaluation. An agent that fails with a shell and an editor won’t do better with twelve more tools.

The session log is the memory

Everything the model sees is appended to a log. The messages sent to the model don’t exist as an object of their own; they’re derived from that log. One rule sums up the whole design: what is model-visible must be logged.

So a session is a compressed JSONL file you can resume, fork at a turn boundary, or read event by event in the Trajectory view. When an answer looks wrong, you go back to what the model actually had in front of it instead of guessing from the UI.

Run it, then decide whether to expose it

npx @deepseek-ai/dsh web

The UI comes up on http://127.0.0.1:3080. Two steps remain: paste an API key in settings, then pick a working directory. The key lands in .credentials.yaml under the DSH home and the UI only ever gets a redacted descriptor. A custom provider accepts any base URL speaking one of three protocols (OpenAI Chat Completions, OpenAI Responses, Anthropic Messages), and a gateway serving two of them is declared twice. Whatever the models page writes ends up in cordis.patch.yml, editable by hand and re-read without a restart.

Exposing it is possible: the listener answers on loopback by default, and behind a reverse proxy you need --public-url plus --trusted-host, with a proxy that preserves the Host header and passes WebSocket upgrades through. The URL printed at startup carries a launch token, so don’t paste it in a public channel.

What a million tokens costs

Model	Input, cache miss (off-peak / peak)	Input, cache hit	Output (off-peak / peak)
deepseek-flash	$0.15 / $0.30	$0.003 / $0.006	$0.60 / $1.20
deepseek-v4-pro	$0.66 / $1.32	$0.022 / $0.044	$1.98 / $3.96

Both models claim a one-million-token context and a maximum output of 384,000 tokens. Off-peak is half the peak rate, and peak hours run 01:00-04:00 and 06:00-10:00 UTC on weekdays.

Here’s a worked example, which is arithmetic on published prices and not a measurement. A refactor that burns two million input tokens and produces a hundred thousand output tokens costs $0.36 on Flash and $1.52 on V4 Pro, off-peak and with no cache. Caching moves more than the model choice does: a re-read input token costs fifty times less.

What breaks, and what the sandbox won’t save you from

The README warns in capitals that there will be breaking changes. The package published on 22 October 2026 is 0.2.1-rc.2, two months after a first 0.1, and plugin contracts still move. Pin the version and expect to re-glue your plugins.

SAFETY.md is more candid than most projects of this kind. The software has not undergone a security audit and must not be treated as secure. Sandboxing, approval prompts and permission controls reduce risk without guaranteeing isolation. Two advisories published in September and October 2026 back that up: a sandbox escape in Code mode rated 6.3, and a flaw when spawning a profile rated 5.3. Current versions postdate both, which promises nothing about the next one.

Three rules follow, all of them in that file. Run the agent in a VM or a container. Don’t expose the listener on a network you don’t control. Read a plugin before installing it, because a plugin market is third-party content: DSH validates the index format, not the author’s claims.

Against the agents you already have

Claude Code and Codex are products built around their vendor’s models, designed for the terminal, with strong opinions baked in. OpenClaw is an open-source personal assistant extended through skills. DSH sits in a different category: it ships the engine. Out of the box it is therefore worse, with few defaults and modes you have to understand first. In exchange, when you need a pipeline nobody sells, no one else decides for you. On 22 October 2026, 21,639 GitHub repositories carried the dsh-plugin topic.

FAQ

Is DeepSeek Harness free?

The software is MIT-licensed, so free to use and modify. The API is billed per token. With a local model, you’re down to the cost of the hardware.

Can I plug in another vendor’s model?

Yes. The installed catalog lists Anthropic, OpenAI, Moonshot and Z.ai among others, and a custom provider takes any endpoint speaking one of the three protocols.

The question is no longer which model answers best. It’s which harness you’ll be able to change the day it gets in your way. My suggestion for a Saturday morning: same task, same model, one session in Standard and one in Minimal. The mode that breaks tells you where the work actually is, and it’s not always where you expected.