DeepSeek Harness, Explained: The Agent Runtime Behind "Model + Harness = Agent"

Deep​Seek Harness — dsh for short — is not a model. It is the open-source agent runtime Deep​Seek released under the MIT license on August 13, 2026, and it is the fastest thing Deep​Seek has ever shipped by adoption: press coverage reports roughly 50,000 GitHub stars in its first 12 hours, and the repository stood at 125,922 stars with 12,523 forks when we read the GitHub API today. Its job is the engineering layer between a language model and a finished task: file editing, terminal execution, web search, context management, task planning, and calling other agents. The formula Deep​Seek's own team uses is Model + Harness = Agent — the model reasons, the harness does everything else.

That distinction is the point of this article. People searching "deepseek harness" are usually expecting a model review and landing on launch coverage instead. So here is the answer up front: DSH is not a model you call through an API. It is a program you install and run — the npm package is @deepseek-ai/dsh, currently 0.1.0-rc.6 — and it connects whatever model you give it (DeepSeek V4 Flash by default) to your filesystem, your terminal, the web, and other agents. It is MIT-licensed, built on a plugin framework called Cordis, and it is explicitly a developer preview that warns of breaking changes. Below is what it actually does, how to run it today, and where it falls short.

What a harness actually does (and why the term is confusing)

A harness is the scaffolding that lets a raw model do work in the real world. A model alone can only produce text. Give it a harness and it can read and write files, run commands in your shell, search the web, keep a plan, call tools, react to errors, and judge when a task is finished. Deep​Seek's public formula — repeated in launch coverage and its own job postings — is "Model + Harness = Agent": the model supplies reasoning, the harness supplies everything else.

This is why the release matters beyond one product. Deep​Seek reported its own agentic benchmark scores for its last two models from inside this harness: the DeepSeek V4 Flash API documentation states its Terminal-Bench 2.1 result of 82.7 was produced on "Deep​Seek Harness minimal mode." The harness is the reference environment those numbers came from, and it is now public for anyone to reproduce — or contradict.

Everything is a plugin: the Cordis architecture

DSH's core design, stated in its own README, is that everything is a plugin. The agent loop, model adapters, tools, skills, session storage, sandbox, scheduling, and even the web UI are all Cordis plugins. There is no privileged core to patch: you extend the harness by mounting a plugin next to the others, and every registration is an effect that unwinds when the plugin unloads. The plugin engine is Cordis, a meta-framework whose design is described in the Peking University–Deep​Seek paper "A Programming Paradigm for Spatiotemporal Composability."

The practical consequence is a sharp separation of concerns: plugins add capabilities; presets decide which capabilities a given agent can see. The monorepo ships 49 packages under packages/ — core, llm, mcp, sandbox, context, plan, goal, and more — and launch coverage counts more than 100 first-party plugins, with a plugin store already reserved and 288 community plugin repositories collected on GitHub within 24 hours of the release, discoverable under the dsh-plugin topic tag.

The four presets — and when to use which

DSH ships with four agent presets, each loading a different plugin set. From the Web UI's own preset menu:

• Standard — a full coding agent: file editing, shell, file and web search, skills, planning, goals, subagents, and workflows. The right default for most work.

• Code — called PTC, "programmatic tool calling," in Chinese press coverage — everything in Standard, plus a Code Mode SDK that lets the model write TypeScript programs to compose multi-step tool calls in one program. More powerful, and it can multiply side effects and tool calls.

• Minimal — just persistent bash plus str_replace_editor. Built for reproducing benchmark runs; this is the preset Deep​Seek used for the V4 Flash Terminal-Bench 82.7 figure. Minimal is not harmless — shell access is still shell access.

• Creator — the fourth preset directory is literally named cordis — Standard plus runtime inspection, in-memory Cordis plugin experiments, and preset authoring. The agent can install, replace, or destroy plugins mid-conversation. An engineering environment, not a production approval layer.

Which one should you pick? If you are reproducing a benchmark, Minimal. If you want the agent to write its own multi-step orchestration, Code. If you are building or testing a plugin, Creator. For everything else, start with Standard — broad authority means you also want a tight workspace and permission policy.

Trajectory: the feature reviewers call "DevTools for agents"

The most-praised feature in hands-on reviews is Trajectory. Every run writes to an append-only session log — zstd-compressed JSONL with a uniform event envelope of type, sequence, time, and data — recording everything the model saw: system prompts, reasoning, tool calls and results, subagent scheduling, context injections. The Trajectory view supports inspection by source, resume, fork, search, and replay. Forking is the standout move: you can change one instruction and replay the run side by side with the original instead of throwing the trace away.

Concretely, in a hands-on test published August 15, a single file-writing task produced 61 session events, and a trivial "reply PONG" task still consumed about 13,467 input tokens on its first request — overhead from default system prompts, tool schemas, auto-injected repo rules, and skill summaries. That is the honest cost of a harness that logs everything: you pay tokens for the scaffolding, and you can see exactly what you paid for.

MCP, plugins, and talking to other agents

MCP is where the hype outruns the current build. The monorepo includes an mcp package and the CLI ships a dsh-mcp-client dependency, but no MCP server is enabled by default, and the architecture routes tool integration through Cordis plugins rather than treating MCP as a first-class citizen. You can connect MCP servers as a tool source; it is just not the default path yet.

What is more surprising is what the subagent providers list shows. DSH can spawn other agents as subagents — including, per the capability-seams documentation, a Codex provider and a Claude Code provider. That is an unusual position for a competitor to take: DSH is a harness that can delegate work to the very products it is measured against.

The plugin story is the real platform bet. Deep​Seek has reserved a plugin store, community repositories are tagged for discoverability, and third-party in-app stores already exist. The long game is that the harness, not the model, becomes the ecosystem — which is why the pricing discussion around DSH matters more than any single feature.

How to run it today

You need Node.js 22.19 or newer — the package manifest requires ^22.19.0 or >=24 — and then one command:

npx @deepseek-ai/dsh web

That starts the Web UI, served at http://127.0.0.1:3080 by default. In the UI: open Settings → Models, paste a Deep​Seek API key, then choose a workspace — the session composer stays locked until you do. The default model is DeepSeek V4 Flash, and the default permission policy is workspace-write with approval prompts for everything else.

There are four entry points total: the Web UI, headless one-shot runs, a Python SDK that drives DSH over JSON-RPC stdio, and --dump-config, which prints the assembled plugin tree (the web profile assembles 129 lines of plugin config; headless, 81). From source, the path is git clone, pnpm install, pnpm run build, then pnpm dsh web.

The honest part: preview-grade, and where DSH is the wrong tool

DSH is version 0.1.0-rc.6, and the README is explicit: "THERE WILL BE COMPATIBILITY-BREAKING CHANGES." Reviews published this week catalogue the rough edges — silent failures under MSYS2 on Windows, hot-reload cache staleness, a roughly 200ms batched persistence delay that lags the UI progress display, and community criticism that GitHub Issues is disabled on a repository positioned as public infrastructure. The default product experience also still trails the polished coding agents it is measured against; one hands-on review concluded the open-source release is an agent runtime scaffold, not yet a finished product.

Where is DSH the wrong tool? Four situations. First, if you want turnkey polish — today's Claude Code and Codex are more finished, and DSH is for people who want the scaffold and are willing to finish it. Second, if you cannot audit what you run: plugin provenance, config diffs, and credential boundaries are all self-supplied, and production use requires governance you provide. Third, if you are benchmarking models: you cannot run one model in Standard mode and another in Minimal and call the difference a model result — you changed the harness, not only the model. Fourth, if you are cost-sensitive about token overhead: the always-on context can burn thousands of input tokens before the model does any real work.

What it means for DeepSeek V4 Flash and DeepSeek V4 Pro

DSH defaults to DeepSeek V4 Flash, and the flagship DeepSeek V4 Pro build (Deep​Seek-V4-Pro-0813) is the same model family the harness was built to run. Both are available today through ordinary API calls — no harness required — and both are hosted on OrcaRouter at Deep​Seek's own list price: roughly $0.15 per million input and $0.29 per million output tokens for DeepSeek V4 Flash, and roughly $0.44/$0.88 for DeepSeek V4 Pro, passed through at 0% markup.

The honest boundary: OrcaRouter is a model router, not an agent runtime, so we do not host DSH — it is not a model. What a router genuinely answers here is the failover problem DSH raises. The harness is a fast-moving preview, and pointing production traffic at it means betting on vendor-reported agentic scores. Running the same Deep​Seek models through a routing layer on one key lets you test DSH's native numbers while keeping automatic failover across vendors for the traffic that has to keep working. The harness is the thing to experiment with; the models it runs are the thing to route carefully.

Bottom line

Deep​Seek Harness is the most consequential thing Deep​Seek has open-sourced since the models themselves, because it changes what "Deep​Seek" means: not just models, but the agent layer that runs them. For a reader deciding what to do: if you build agents, install it this week and run the reproduction test — the V4 Flash and V4 Pro scores Deep​Seek published came from this harness, and now you can check them yourself. But treat it as what it is: a 0.1.0-rc.6 developer preview with breaking changes ahead, a plugin system that rewards people who like owning their stack, and a harness that is still rougher than the polished alternatives. The models underneath are the reliable part — and those you can route with confidence today.