What Is DeepSeek Harness (DSH)?

DeepSeek Harness is DeepSeek AI's open-source agent runtime, released under MIT on 13 August 2026, in which the model adapter, the tool registry, the session log and the agent loop are all replaceable plugins. It runs as a local web app on port 3080 rather than in your terminal, and it is explicitly a developer preview that promises to break.

Key Takeaways:

• dsh is a harness, not a model: the layer that assembles prompts, exposes tools and records what the model did
• It has no interactive CLI. A TUI package existed and was deleted the week before launch
• "Everything is a plugin" is literal, and it comes from Cordis, a framework four years older than the harness
• Two model adapters ship today, so it is less DeepSeek-locked in theory than in practice
• Zero tags, zero releases, 0.1.0-rc.5: fine to explore, wrong to depend on

The star count is the part everyone quotes and the part that tells you least. It went from 60,481 to 62,770 during the ninety minutes I spent checking the rest of these facts, and the repository carries 12,293 commits with directories last touched two months ago, so DeepSeek built this behind a closed door and then flipped the switch. The project is a day old; the code isn't.

What is DeepSeek Harness (DSH)?

A harness is the layer between a model and everything outside it: it assembles the prompt, exposes the tools, records what happened, and decides what the model may touch. DeepSeek Harness, which the project shortens to dsh, is DeepSeek AI's own implementation of that layer, and the repository puts a four-word pitch in its description: "Everything is a Plugin."

That claim is unusually literal. The architecture documentation says the model adapter, the tool registry, the session log and the agent loop itself are all plugins, and states flatly that there is no privileged core to patch. You extend dsh by mounting a plugin beside the others instead of forking a centre.

Underneath sits Cordis, a plugin framework predating the harness by four years: created May 2022, MIT licensed, around 2,100 stars, and billed by its authors as a meta-framework of spatiotemporal composability. Cordis hands plugins a shared context into which they contribute services, typed events and reversible effects, and when a plugin unloads its registrations unwind. The theory went public the same day as the harness, as A Programming Paradigm for Spatiotemporal Composability. Reading it isn't a prerequisite for running dsh; it does explain the shape.

The harness that ships without a terminal

Most of the launch coverage buried the decision that actually distinguishes this project. Claude Code, Codex and the rest of that generation are terminal programs. DeepSeek Harness is not one. The only run command in the README is:

npx @deepseek-ai/dsh web

That starts a web application served at http://127.0.0.1:3080 by default. There's no interactive terminal interface at all, and the absence is deliberate rather than unfinished: a commit merged the week before the public launch reads "cleanup: remove TUI package and legacy dsh entrypoints". They had one, and they took it out.

A headless profile does ship, but it's a one-shot runner with no server, built for scripted single invocations rather than a session you sit inside and talk to. If your muscle memory is a split terminal pane, dsh will feel wrong for the first evening.

The other consequence is quieter. What you're starting is a server bound to loopback on the machine in front of you, which is fine right up until the machine stops being in front of you.

What "everything is a plugin" actually buys you

Plugin architectures are a common promise and a rarer delivery, so what does the design pay for here? Mostly the session log.

core/session owns an append-only SessionEvent log, and everything the model saw goes into it: system prompts, reasoning blocks, tool calls and their results, subagent scheduling, every context injection. Durable events such as turn/*, step/* and tool/* survive a reload. Alongside them run live extension points, agent/pre-step and llm/stream among others, which let a plugin watch or intercept work while it's still moving; an agent/pre-step hook can reject a step outright, or rewrite the messages going into it.

The vocabulary is precise in a way that suggests the maintainers argued about it: a step is one model request plus the tools that request calls, and a turn is zero or more steps, opening before its first input is claimed and closing once nothing is owed. Debugging an agent that did something expensive at step 40 is a different job when you have a replayable event log instead of terminal scrollback.

Events sort by domain, which is the first decision in most changes you'd make. Session events are durable facts; agent events carry a live agent with its inbox, status and continuation; capability events attach policy and adapters to a seam such as fs/* or tools/* without importing the loop at all.

Profiles, bundles and patches

A running dsh isn't a binary with a config file. It's a plugin tree composed at boot from ordered layers, and the vocabulary takes twenty minutes to absorb.

A profile is a named composition stored in the Harness home; it lists the bundles it stacks, holds any out-of-tree plugins it installs, and keeps your own cordis.patch.yml. Two ship as templates, web and headless. A bundle is the distribution format for Cordis config rows and the code those rows mount, so whatever a bundle inserts stays patchable from above.

dsh-base is the first layer of every profile, and its contents map what a harness has to own: model adapters, tools, persistence, sandbox and approval policy, settings, credentials, telemetry. dsh-web-app stacks the browser application on top; dsh-headless stacks the one-shot runner instead.

To see what your machine actually boots, dsh --profile web --dump-config prints the tree, and any row it prints can be replaced by a patch of your own.

Look at what dsh-base puts in the same layer as the model adapter: sandbox and approval policy. Those are there because the default deployment hands an agent your filesystem, your credentials and a shell, on the same laptop that has your email open in another window. An approval prompt is a mitigation, not a boundary, and it stops helping the moment you start clicking through it at speed. MoClaw answers that differently by putting the agent on a hosted cloud machine of its own, so a plugin that misreads a path takes out something that was never your desktop.

DeepSeek Harness versus a general agent harness

The generic version of this concept, and the tradeoffs any implementation of it faces, we covered separately in what an agent harness is. DeepSeek Harness is one opinionated point in that space, and the interesting question is how tied to DeepSeek it really is.

Architecturally, less than the name implies. packages/llm holds a documented adapter contract that every adapter must implement, plus a message and streaming vocabulary shared by all of them. Assistant messages record an AssistantProvenance naming the provider and model that produced them, with adapter-private replay state, and the runtime exposes that state to a target adapter only when the same adapter instance owns both the historical provider and the target. That is machinery built by people who expected histories to move between providers.

Practically, two adapters exist today: llm-deepseek and llm-pi-ai, next to llm-retry and a token-meter. Two is a seam, not a marketplace, and both ship inside DeepSeek's repository on DeepSeek's cadence. Reaching a model nobody has written an adapter for means writing one or waiting for one. MoClaw works a level up from that argument: a hosted machine where reaching more than one model isn't a property of any single vendor's plugin tree. DeepSeek's own models are worth the attention regardless, and DeepSeek V4-Pro changed the arithmetic for agents when it arrived.

The plugin ecosystem, one day in

The dsh-plugin GitHub topic carried 890 public repositories on 14 August 2026, one day after launch, and it gained twenty-one of those during the ninety minutes I spent reading the docs. Read the number carefully, though. The README asks plugin authors to add the topic for discoverability, so what it counts is self-declarations, and a topic tag costs nothing to apply.

The second-largest repository in the topic makes the point. titanwings/colleague-skill sits at 21,375 stars and was created on 30 March 2026, four and a half months before DeepSeek Harness existed publicly. It didn't appear for this ecosystem; it relabelled itself into it. Below those two the counts fall into the hundreds, where the genuinely new arrivals live: a web UI skin collection, a TUI filling the gap DeepSeek deliberately left, a sidebar add-on.

Which raises a question about trust that nobody wants to be first to ask. A plugin in this system isn't a sandboxed extension; it mounts into the same Cordis context as the tool registry and the credential store, and the architecture's own selling point is that no core is privileged. Installing a stranger's four-day-old plugin means giving it the same reach the harness has. Running that experiment somewhere disposable is the obvious precaution, and MoClaw is one way to get a machine you're willing to be careless with, separate from the one holding your actual work.

Is DeepSeek Harness ready for production?

No, and DeepSeek says so in capital letters. The README's second section is headed Developer preview and reads: "THERE WILL BE COMPATIBILITY-BREAKING CHANGES." The official site carries the same framing.

The repository backs that up. On 14 August 2026 it had one branch, zero tags, and zero published GitHub releases, with version commits still labelled 0.1.0-rc.5. Nineteen contributors, 5,240 forks, 238 watchers. There's no documented upgrade path because there is nothing yet to upgrade from.

So the honest read: worth a serious afternoon if you build on harnesses, worth nothing this quarter if you need something stable underneath a team. A plugin API guaranteed to break is a fine thing to explore and a bad thing to depend on, which argues for keeping your exploration and your working setup in different places. MoClaw is built to sit alongside what you already run rather than in place of it, which is what makes it easy to walk away from a preview that broke overnight without losing the rest of your week. The free trial runs three days on 1,000 credits, and a $20 subscription carries 1,000 credits a month.

The wider point survives the version number. DeepSeek shipping a harness at all means it now competes on the layer deciding how models use tools, hold sessions and run long jobs, not only on the weights.

FAQ

Is DeepSeek Harness free and open source?

Yes. The LICENSE file in the repository is a standard MIT licence, copyright 2026 DeepSeek, which permits commercial use. Third-party dependency licences are listed separately in THIRD_PARTY_NOTICES.md.

Does DeepSeek Harness only work with DeepSeek models?

Not by design, but nearly so in practice today. The adapter contract in packages/llm is documented and open to new implementations, and message provenance is tracked per provider so histories can move. As of 14 August 2026 the shipped adapters are llm-deepseek and llm-pi-ai, so anything else needs an adapter written for it.

What is a plugin in DSH?

A unit that mounts into the shared Cordis context and contributes services, typed events and reversible effects to it. Because there is no privileged core, the model adapter, tool registry, session log and agent loop are themselves plugins, and any of them can be replaced from configuration rather than by forking.

Does DeepSeek Harness have a CLI?

Not an interactive one. npx @deepseek-ai/dsh web launches a web UI on port 3080, and the headless profile provides a one-shot runner for scripts. A TUI package existed and was removed the week before launch; a community plugin has since filled that gap.

How do I run DeepSeek Harness?

Install Node.js and run npx @deepseek-ai/dsh web, then open http://127.0.0.1:3080. From a checkout it's pnpm install, pnpm run build, then pnpm dsh web. Both routes run the harness on your own machine.

Repository facts, star counts, licence text and package contents in this article were checked against the source on 14 August 2026. DeepSeek Harness is in developer preview and changing daily, so verify anything load-bearing before you build on it.