DeepSeek Harness: Open-Source Agent Runtime Explained

On 13 August, DeepSeek posted the full source for an agent harness on GitHub under the MIT licence, named the command dsh, and let anyone clone it. Four days later the repository sat at 135,042 stars and 13,592 forks. That is an enormous amount of attention for a piece of plumbing most people cannot name, so it is worth explaining what a harness is before the star count goes to anyone’s head.

A model on its own does nothing useful. It needs the layer around it: the tools, the files, the sandbox it runs commands in, and the loop that keeps it working through a multi-step job. That layer is the harness, and DeepSeek sums the whole thing up as Agent = Model + Harness. Most harnesses bolt that layer down. The agent loop, the tool list and the session store are fixed, and you can only extend them at whatever hooks the authors bothered to expose. DeepSeek Harness takes the opposite line, printed in the first line of its README: everything is a plugin.

Table of Contents

Everything really does mean everything

Models, tools, skills, sessions, sandboxes, storage, loops, scheduling and even the UI all sit behind plugin boundaries built on a kernel called Cordis. The kernel handles mounting, unmounting and dependencies between plugins, and the capabilities live in the plugins rather than a privileged core. In plain terms, you can rip out the default agent loop or the storage backend and drop in your own without touching the framework’s source. That makes Harness a kit for assembling agent runtimes, not a single fixed assistant you take or leave.

Four ways to run it

v0.1 loads a different default plugin set depending on the mode:

Standard: the full coding agent, with file editing, shell access, file and web search, planning, goals, subagents and workflows.
Code: the same tools exposed through a TypeScript SDK, so the model can chain several operations in one program instead of one tool call at a time.
Minimal: two tools only, a persistent bash and a string-replace editor, for benchmarking a raw model with nothing to lean on.
Creator: runtime inspection and in-memory plugin experiments, for people authoring presets.

Every run leaves a paper trail

The part worth stealing even if you never touch Harness: everything the model sees goes into an append-only session log. System prompts, reasoning, tool calls and results, subagent scheduling and every context injection all land in one event stream. A Trajectory view lets you inspect the records by source, and resume, fork, search and replay all read from the same log. Plenty of frameworks log tool calls. Recording every context injection, so you can see exactly what was pushed into the model and when, is the sharper habit.

It is not tied to DeepSeek’s models

Despite the branding, the model is a plugin too. Drop in a DeepSeek API key and it takes effect on the next request without a restart. The installed catalogue adds Anthropic and OpenAI by key, with Bedrock, Vertex, Azure and Codex reachable through native credentials, and any OpenAI-compatible endpoint accepted as a custom provider. Keys are write-only and stored locally. You can start the web UI with a single npx @deepseek-ai/dsh web and reach it on localhost.

The bits the star count hides

This is a developer preview, and DeepSeek says so plainly. It is infrastructure for teams who already run internal tooling, not a polished product for a marketing manager who wants an agent by Friday. Cordis is an obscure meta-framework with a small community, so betting your stack on it means learning a paradigm almost nobody else uses. And the flexibility cuts both ways: a harness that can mount any tool, reach any provider and run shell commands is exactly the sort of thing that has been reaching real systems during safety evaluations this summer. The traceability helps, but an append-only log tells you what went wrong after it has gone wrong. Treat v0.1 as a workshop, wire in least-privilege access from the first commit, and keep a human on the approval button before it touches anything you cannot undo.

A vote of 135,000 stars in four days is curiosity, not a verdict on reliability. The idea underneath, that the harness matters as much as the model, is the right one to be arguing about.

Did you know: GitHub stars measure bookmarks, not usage, so a repo can rack up six figures of them without a single line running in production.

Sources

The free stack. One email a week: the AI tools and moves that actually matter, hype filtered out. Subscribe free →