DeepSeek Harness: The "Everything Is a Plugin" Agent Runtime, Reviewed

DeepSeek Harness crossed 33,000 GitHub stars within hours of its August 2026 announcement, per The New Stack — before most teams had finished reading the README. The lab that spent two years setting the floor price of agentic tokens now ships the other half of the stack: an MIT-licensed, Node.js agent runtime in which the model adapter, the tool registry, the session log, and the agent loop itself are all replaceable plugins.

That last clause is the whole story. Every other serious harness — Claude Code, Codex CLI, the open-source field — is a monolith with extension points at the edges. DeepSeek Harness has no privileged core to extend. It is the most radical architecture the harness category has shipped, from the vendor with the strongest incentive to commoditize everyone else’s.

This review takes the architecture seriously instead of quoting the launch post: what “everything is a plugin” actually buys and costs, the four modes and who each is for, why the append-only session log is the most consequential design decision in it, how the sandboxing and compat stories stack against peers, what the no-external-PRs governance model means, and a try-now-or-wait verdict by persona.

Why the DeepSeek Harness launch matters

DeepSeek’s position in the 2026 stack was already singular before this launch. DeepSeek V4 Flash prices at $0.14 per million input tokens and $0.28 output — the credible price floor for agentic coding — with V4 Pro holding roughly 80.6% on SWE-bench Verified by vendor count, both MIT, both with 1M-token context. The company also deprecated V3 and R1 on July 24 with about as much sentiment as a garbage collector, which tells you how it operates: aggressive pricing, aggressive pruning, weights on the table.

What DeepSeek had never shipped was the wrapper. The loop that turns a model into a coworker — the harness — belonged to Anthropic, OpenAI, and the open-source field, and agent economics are the product of two numbers: the per-token price and the tokens the harness decides to burn. Until August, DeepSeek controlled only the first. Now it ships both halves, and the second half is free, MIT-licensed, and runs against everyone’s models, not just its own.

The timing is not subtle either. The launch lands two months after the great harness die-off — Gemini CLI’s June 18 shutdown broke CI pipelines and taught the field that a harness can vanish mid-sprint. Into that trust vacuum, DeepSeek ships the exact counter-profile: open source, MIT, model-agnostic, and forkable if the vendor ever loses interest. The harness wars had been a features race. DeepSeek just made them an architecture argument.

What is DeepSeek Harness?

DeepSeek Harness is an open-source, MIT-licensed agent runtime from DeepSeek, announced in August 2026. Built on Node.js and the Cordis composition framework, it treats every component — model adapter, tool registry, session log, even the agent loop — as a replaceable plugin, and ships four operating modes across seven model-provider families.

If you have been searching for a first-party DeepSeek CLI, this is that, and deliberately more: the official docs frame it as a runtime that happens to include a terminal coding agent, not a terminal agent that happens to be configurable. Developers Digest’s first look — which already shortens the name to DSH — reads it the same way. The repo lives on GitHub .

Spec	DeepSeek Harness, at launch
License / runtime	MIT · Node.js
Architecture	“Everything is a plugin” on the Cordis composition framework; no privileged core
Modes	Standard · Minimal · Code · Creator
Model providers	Anthropic, OpenAI, AWS Bedrock, Azure, Google Gemini Enterprise, DeepSeek, any OpenAI-compatible gateway
Subagents	Built-in Claude Code and Codex providers, disabled by default
Session store	Append-only event log → resume, fork, replay, transcripts, telemetry, web UI
Sandboxing	Linux Landlock · macOS Seatbelt · Windows restricted-token runner
Interop	Claude/OpenAI hooks.json bridges · MCP client · markdown configs
Governance	No external PRs; GitHub Discussions + community plugins with “equal weight”

“Everything is a plugin,” examined seriously

Claims like this are usually marketing for “we have a config file.” Here it appears to be literal. DeepSeek Harness is built on Cordis, a composition meta-framework from Peking University and DeepSeek researchers, and the runtime’s job is wiring, not behavior: the model adapter is a plugin, the tool registry is a plugin, the session log is a plugin, and — the part with no precedent among the majors — the agent loop is a plugin. The thing that decides what the model sees, when tools fire, and how turns compose is code you can swap without forking.

Monoliths let you configure the organs. DeepSeek Harness lets you transplant them.

Contrast the incumbents. Claude Code and Codex CLI are extensible at the edges — MCP servers, hooks, skills, instruction files — but the loop is the vendor’s, and the 2026 field map is a map of monoliths differentiated by whose loop you trust. The open-source harnesses let you read the loop and fork it, which is better, but a fork is a maintenance mortgage. DSH’s proposition splits the difference: the loop stays upstream, your replacement of it is a plugin, and the four shipped modes appear to be presets composed from the same plugin surface the community gets .

Whether that proposition holds is the honest open question, because plugin-everything architectures have a track record in both directions. The failure mode is incoherence: N plugins, N² interactions, and a runtime where nothing is anyone’s fault. The success mode is Emacs — the last “everything is replaceable” runtime to win big, still running forty-odd years later precisely because the core stayed small and the ecosystem carried the rest. Which way DSH goes depends on discipline at the composition boundary, and that is unreviewable in week one.

What is reviewable is the fit with where the craft was already heading. Harness engineering — now a named discipline with its own curated literature — has been the practice of tuning context assembly, tool design, permissions, and memory around sealed loops. DeepSeek Harness is the first major runtime where that discipline gets a first-class API instead of a workaround culture. If you have ever maintained a patched fork of a harness just to change one dispatch behavior, you are the target market, and you know it.

The four modes of DeepSeek Harness

Modes are where the architecture cashes out for daily use: same runtime, same session log, four different tool surfaces.

One runtime, four surfaces. Pick by task shape, not by loyalty.

Standard: the daily driver

The full coding agent — filesystem, shell, web search, subagents, planning. This is the mode that competes head-on with Claude Code and Codex CLI, and it is the right default for interactive feature work where you want the agent exploring, planning, and delegating. Nothing radical here by design; Standard exists so the radical parts elsewhere don’t cost you a usable tool on day one.

Minimal: bash and a string-replace editor, full stop

Two tools, nothing else. This reads as austerity and is actually a thesis: the small-surface school holds that a strong model with a shell outperforms a mid model with forty bespoke tools, because every tool schema you register is context spent before work begins, and every bespoke tool is a behavior the model wasn’t trained on — bash, it was trained on. Minimal is the right mode for CI jobs, scripted batch runs, and evals, where you want the model’s contribution isolated from harness features. It is also the cheapest mode per task by construction: lean system surface, lean prompts, fewer places for context to bloat.

Code: the token-burn argument

Code mode generates TypeScript SDKs from your tool surface so that multi-step tool use collapses into single API calls, and it deserves more analysis than the launch coverage gave it.

The classic tool loop bills you for its own choreography. Every step — call, result, next call — round-trips through the model, and every intermediate result lands in the context window, where you pay for it again as input on every subsequent turn. A ten-step chain with chunky outputs (test logs, file reads, diffs) can spend more tokens re-reading its own scaffolding than reasoning about the task; that compounding re-read is one of the quiet line items behind what heavy operators actually pay. Code mode inverts the shape: the model writes one program against a typed SDK, the runtime executes it, and only what the program returns re-enters the window.

// Classic loop: run tests -> model -> read trace -> model -> edit -> model -> rerun -> model
// Ten round trips; every intermediate result re-billed as context on every turn.

// Code mode: one generated-SDK program, executed by the runtime
const failing = await sdk.tests.run({ filter: 'auth' });
const source = await sdk.files.read(failing[0].trace.file);
await sdk.files.strReplace(source.path, brokenHunk, fixedHunk);
return sdk.tests.run({ filter: 'auth' }); // only this result returns to the model

The exact SDK surface is DSH’s to define — this is the shape, not the literal API . But the shape is the point: intermediate data stays out of the context window, N round trips become one, and latency drops with them. The trade is real too — a program is a commitment, and a model that would have self-corrected at step three now discovers the mistake at the end. Code mode fits long, well-understood chains (migrations, bulk refactors, data plumbing); Standard still wins exploratory work where each observation should steer the next step.

Creator: the mode for building modes

Preset authoring and runtime inspection — a workshop for the plugin surface itself. Platform teams get a sanctioned way to ship an org-standard agent (approved tools, permission posture, house loop) as a preset rather than a wiki page, and harness engineers get inspection into what the runtime actually assembled and dispatched. Most users will never open Creator. The people who do are the reason the plugin thesis will succeed or fail.

Model-agnosticism as strategy: a harness that orchestrates its rivals

At launch, DeepSeek Harness speaks to Anthropic, OpenAI, AWS Bedrock, Azure, Google Gemini Enterprise, DeepSeek’s own API, and any OpenAI-compatible gateway — a clause that, in practice, reaches local servers and routers too, since everything from vLLM to Ollama exposes that dialect. Read that list twice: three of the seven families are enterprise clouds. Day-one Bedrock, Azure, and Gemini Enterprise support is not a hobbyist checklist; it is an announcement about who this runtime intends to be procured by.

Then there is the detail that made the field grin: built-in subagent providers for Claude Code and Codex, shipped in the box, disabled by default. Flip them on and a DeepSeek Harness session can delegate work to its two biggest rivals as subagents — fleet patterns with DSH at the top of the org chart, dispatching a Claude Code worker here and a Codex worker there. It is a capability demonstration and a positioning statement in one: the incumbents’ agents, recast as this runtime’s labor. Before wiring it into anything real, check the terms question yourself — orchestrating a subscription-backed CLI from another vendor’s runtime sits in exactly the kind of terms-of-service gray zone that gets clarified retroactively .

The strategy underneath is coherent. DeepSeek sells the cheapest capable tokens on the market; every ounce of harness lock-in that keeps a team welded to a vendor’s loop is friction protecting pricier models. A genuinely neutral, free, MIT runtime dissolves that friction — and in a frictionless market, the price floor wins more routing decisions. Model-agnosticism isn’t altruism here. It is the cheapest model’s optimal opening move.

The session log is the point

Strip the launch-week noise and the most consequential design decision in DeepSeek Harness is the least demoable one: the session store is an append-only event log, and everything else is a consumer of it.

Every prompt, model response, tool call, tool result, and permission decision is an event in an ordered stream. State is derived, never stored: resume is replaying the log to its tip; fork is branching a new session from any event; replay re-runs a trajectory for debugging; transcripts, telemetry, and the web UI are all projections over the same stream. Engineers will recognize the pattern — event sourcing, ported from transactional systems to agent sessions — and recognize what it buys: time-travel debugging, cheap branching, and an audit trail that is the system of record rather than a lossy export of it.

{"seq":481,"type":"tool.call","name":"shell.exec","args":{"cmd":"pnpm test"}}
{"seq":482,"type":"tool.result","ref":481,"exit":1,"bytes":83211}
{"seq":483,"type":"model.message","role":"assistant","tokens_out":612}
{"seq":484,"type":"permission.grant","scope":"fs.write:src/auth"}

The shape of an append-only session stream — schematic, not DSH’s literal schema.

Here is the reviewer’s-notebook insight this launch crystallizes: the industry is converging on session data as the foundation layer of the agent stack. Every major harness already keeps some session record — that is what makes resume work, and it is what the die-off’s exit checklists told you to export first when tools started dying. Configs are portable-ish. Models are swappable quarterly. The record of what your agents actually did — what they tried, what they touched, what it cost — is the asset that appreciates: it is your context corpus, your private benchmark, your audit trail, and increasingly your training data. DeepSeek Harness is the first major runtime to make that record the literal architectural center instead of a byproduct, and we would bet on others following.

Product note: The corollary of sessions-as-foundation is that your session history shouldn’t live and die with any single harness. Automater Lite archives sessions across harnesses — Claude Code, Codex, Qwen Code, OpenCode, and any CLI that writes transcripts, new launches included — into one local, searchable library with per-provider token metering. Trialing DeepSeek Harness adds history instead of fragmenting it. Free, on automater.ai.

Sandboxing: Landlock, Seatbelt, and an actual Windows story

Per the official documentation, DeepSeek Harness ships OS-native sandboxing on all three desktop platforms: Landlock (the unprivileged Linux security module) for filesystem scoping, Seatbelt profiles on macOS, and a restricted-token runner on Windows.

Against peers, the notable word is Windows. The category norm in 2026 is permission prompts plus “run it in a container if you’re serious,” with kernel-level scoping on Unix platforms in the better harnesses and Windows users pointed at WSL2 . A first-class restricted-token runner treats native Windows as a real deployment target, which the Windows-heavy half of the industry will notice even if Hacker News doesn’t.

Keep the limits in frame, though, because a sandbox answers one threat class. Landlock and Seatbelt scope what a compromised or confused agent can touch; they do nothing about what it can be talked into within scope. Prompt injection, exfiltration through allowed egress, and credential misuse survive OS sandboxing entirely — a perfectly sandboxed agent holding your API keys can still spend your money with them. Grade the sandboxing story a genuine best-in-class-at-launch showing , and keep your network and secrets posture exactly as paranoid as before.

The compat play: switching costs engineered toward zero

The interop sheet reads like a checklist of everything that makes a daily driver sticky, with a bridge built to each: hooks.json compatibility bridges for both the Claude and OpenAI hook formats, an MCP client for your existing servers, and markdown-file configuration in the CLAUDE.md/AGENTS.md style the category standardized on .

Decode the intent: your hooks run here, your MCP servers attach here, your instruction files mean something here. The three artifacts a power user accumulates around an incumbent harness — the moat of invested config — all have an import lane. This is the challenger’s classic move executed cleanly: when the incumbent’s advantage is accumulated setup, you don’t out-feature it, you drain the moat. Two diligence notes before you lean on it. First, bridges are best-effort by nature — hook semantics differ between harnesses in exactly the edge cases you rely on, so test yours rather than trusting the adjective “compatible.” Second, MCP is mid-migration to the stateless 2026-07-28 spec, so confirm which revision the client tracks against your servers .

And run the die-off-era entrance exam on DSH itself, the same one you would run on any newcomer: where do sessions live, in what format, and can you get them out without the vendor’s help? The append-only event log is a promising answer on paper — events are readable, projections are exportable. Confirm it on disk before this becomes your daily driver.

The governance wrinkle: no external PRs

Now the strangest line in the announcement: DeepSeek Harness accepts no external pull requests. Community input flows through GitHub Discussions, and community contribution ships as plugins — which the project says carry “equal weight” with DeepSeek’s own.

That is an inversion of the usual open-source social contract, where the core accepts patches and extensions are second-class citizens. Here the core is sealed and the extension surface is constitutionally first-class — and the two decisions are really one decision, because “equal weight” is only a credible promise when everything genuinely is a plugin. You cannot meaningfully contribute a better agent loop to Claude Code. To DSH, per its own architecture, you can — you just publish it instead of merging it.

There is precedent for sealed-core projects thriving: SQLite has run this way for decades — open code, closed contribution, ubiquitous deployment. The model buys DeepSeek a small review surface, a coherent architecture with no design-by-committee drift, and — for a Chinese lab shipping a runtime that Western enterprises will run with shell access — a materially smaller supply-chain and contributor-vetting story to defend. The costs are equally real: the bus factor concentrates in one team, roadmap disputes have no escalation path but forking, and the standard health metrics you would check on any dependency — contributor count, merged-PR cadence — read as flatlines here by design. Judge this project by plugin-ecosystem velocity and Discussions responsiveness instead, and remember the MIT license is the ultimate safety valve: if the sealed core stagnates, the community can fork the whole thing, plugins and all.

Try it now or wait: verdict by persona

• Harness engineers and loop tinkerers: now. This is the first major runtime where your discipline has a supported API instead of a fork-and-patch culture. Creator mode plus a replaceable loop is the sandbox you have been improvising for a year.
• Cost-floor operators already on DeepSeek V4: now. First-party pairing with the $0.14 Flash floor , with Minimal and Code modes purpose-built for cheap, high-volume grind work.
• Happy Claude Code or Codex daily drivers: trial, don’t migrate. The compat bridges make a two-week sandbox trial nearly free, and that is exactly what they are for. Your incumbent’s loop is battle-tested; DSH’s is weeks old. Watch two releases, then re-decide.
• Platform and enterprise teams: engage, but slowly. Day-one Bedrock, Azure, and Gemini Enterprise support says this is aimed at you, and presets could replace your wiki-page agent standards. Run provenance review, check the telemetry surface and what if anything leaves the machine , and let the governance model bake for a quarter first.
• Windows-first developers: closer look than usual. A native restricted-token sandbox story, without WSL2 as a prerequisite, is rarer than it should be in this category.
• Everyone else: if you don’t recognize yourself above, the boring advice holds — your current harness is not the bottleneck, and week-one adopters are doing your QA for free.

How DeepSeek Harness reshapes the field map

The 2026 field had already been resorted once by subtraction — the die-off cleared the shelf — and once by addition, with a new wave of single-organ specialists filling it. Note for readers of that piece: whether the “DeepSeek-TUI” entry on the mid-2026 community map was a precursor of this launch or an unrelated community project remains unverified ; the first-party question, at least, now has an answer.

DeepSeek Harness is a different kind of entrant from either cohort. The Chinese CLI wave competed on plan economics; the new wave competes on single subsystems; DSH competes on substrate — it is not another CLI so much as a runtime the next dozen CLIs could be presets on. Three predictions follow, clearly labeled as ours. First, preset marketplaces: Creator mode plus equal-weight plugins is a distribution mechanism waiting for a storefront. Second, incumbent response: expect “plugin API” and “open loop” language from monolithic harnesses within two quarters, the way MCP support became table stakes in a single year. Third, session-log convergence: as more runtimes treat the event stream as the foundation layer, cross-harness session portability stops being a power-user hack and starts being an expectation.

That last one is the operator’s takeaway. You already run a fleet, not a favorite — the average serious setup crosses two or three harnesses before lunch — and DeepSeek Harness makes the fleet question sharper, not simpler: one more runtime, four more modes, rival subagents in the box. The architecture is the real thing, the session log is the right center, and the open questions — loop maturity, governance-by-Discussions, plugin-ecosystem quality — are all empirically checkable within a quarter. Verdict: the most interesting harness launch of 2026, and the first one since Claude Code that competitors will have to answer architecturally rather than with a features sprint.

FAQ: DeepSeek Harness

What is DeepSeek Harness?

DeepSeek Harness is an open-source, MIT-licensed agent runtime from DeepSeek, announced in August 2026. Built on Node.js and the Cordis composition framework, it treats every component — model adapter, tool registry, session log, even the agent loop — as a replaceable plugin, with four modes and an append-only session log at its center.

Is DeepSeek Harness free and open source?

Yes — the code is MIT-licensed and free to run; you pay only for the model tokens you use through your chosen provider. One wrinkle: the project accepts no external pull requests. Community contribution happens through GitHub Discussions and community plugins, which DeepSeek says carry “equal weight” with its own.

What models does DeepSeek Harness support?

At launch it supports Anthropic, OpenAI, AWS Bedrock, Azure, Google Gemini Enterprise, and DeepSeek models, plus any OpenAI-compatible gateway — which in practice covers local servers like vLLM and Ollama and most routers. It is deliberately model-agnostic rather than tied to DeepSeek’s own V4 line.

What are the four modes in DeepSeek Harness?

Standard is the full coding agent — filesystem, shell, web search, subagents, planning. Minimal strips to bash plus a string-replace editor for lean, cheap runs. Code generates TypeScript SDKs so multi-step tool chains collapse into single API calls. Creator is for authoring presets and inspecting the runtime itself.

Can DeepSeek Harness run Claude Code or Codex as subagents?

Yes — built-in subagent providers for Claude Code and Codex ship in the box, disabled by default. Enabled, a DeepSeek Harness session can delegate tasks to either rival agent as workers. Check each vendor’s current terms before wiring rival subagents into production workflows; the compliance posture is yours to verify.

Sources

• DeepSeek Harness: open source, and everything is a plugin (The New Stack)
• DeepSeek Harness — official documentation (deepseek.com)
• DeepSeek Harness (DSH): first look (Developers Digest)
• DeepSeek Harness repository (GitHub)
• Best open-source coding models 2026 — DeepSeek V4 pricing (morphllm.com)
• The 2026-07-28 MCP specification (blog.modelcontextprotocol.io)
• awesome-harness-engineering (GitHub)