DeepSeek Harness: What It Is, What You Get, and What You Need

Reviewed October 9, 2026

DeepSeek Harness, or DSH, is not another DeepSeek language model. It is the runtime around a model: the software layer that gives an AI agent access to files, shell commands, tools, sessions, skills, subagents, workflows and optional browser or desktop control.

DeepSeek currently distributes Harness as a public preview and publishes the source code under the MIT license. Its most important design choice is architectural rather than model-specific: model adapters, tools, the agent loop, storage and other capabilities are built as replaceable components.¹²

What is included?

Capability	Status	Why it matters
Web UI	Yes	Local browser interface
Local runtime	Yes	Harness runs on your machine
DeepSeek models	Yes	First-party support
Other cloud models	Yes	OpenAI, Anthropic, Moonshot/Kimi, Z.ai/GLM and others
Custom compatible endpoints	Yes	OpenAI-/Anthropic-style APIs
File access	Yes	Read and modify project files
Shell / terminal	Yes	Run builds, tests and scripts
MCP	Yes	Connect external tools and services
Skills	Yes	Reusable agent capabilities
Subagents	Yes	Delegate work to child agents
Workflows	Yes	Multi-step orchestration
Scheduling	Reminders	One-time, interval, daily, weekly and cron rules; delivery is not execution
Browser control	Optional / experimental	Drive a browser through supported providers
Computer use	Optional	Control the desktop through a provider
Sandbox / approvals	Yes	Reduce risk, not complete isolation
Python SDK	Yes	Programmatic integration

DeepSeek documents several agent presets. Standard Mode exposes a broad toolset. Code Mode lets the model orchestrate tool operations more programmatically. Minimal Mode intentionally reduces the environment for cleaner evaluation. Creator Mode is aimed at building and experimenting with custom Harness configurations.¹

The key detail: Harness is not locked to DeepSeek models

The product name can be misleading.

The current provider guide describes support for services including:

• DeepSeek
• OpenAI
• Anthropic
• Moonshot/Kimi
• Z.ai/GLM
• custom compatible endpoints

Custom providers can use supported protocols such as OpenAI Chat Completions, OpenAI Responses or Anthropic Messages.³

An app subscription is not an API credential. A ChatGPT or Claude subscription does not automatically provide model access through DSH. The current provider guide uses API keys or compatible endpoints and does not currently support OAuth login such as Codex. A selected default applies to new sessions; existing sessions retain the model ID recorded in their logs.³

Configure and actually test a provider on your Mac

In the running Web UI, open Settings → Models. The DeepSeek card accepts a DeepSeek API key. Add model provider → Third-party model provider includes built-in entries such as anthropic, openai, moonshotai (Kimi) and zai (GLM). For a local Ollama server, relay or custom gateway choose Custom model API. It requires a unique lowercase Provider ID, base URL, one matching protocol — openai-completions, openai-responses or anthropic-messages — credentials, and at least one real model identifier. A gateway exposing two distinct API protocols needs two providers.³

Fetch available models can query compatible /models endpoints; if discovery returns no usable result, enter a real model ID manually. Do not mistake a successful model listing for working inference: make a short chat request, then test a safe file/tool task in a disposable workspace. MISSING_CREDENTIAL indicates absent credentials; UNKNOWN_MODEL means the selected model is not configured. An OpenAI-style gateway may also reject developer roles or max_completion_tokens; the DSH guide documents compat.supportsDeveloperRole: false and compat.maxTokensField: max_tokens in the provider configuration.³

Where keys live: The Models page returns a redacted display value, but the project documents actual credentials at $DSH_HOME/.credentials.yaml. The default Web UI profile config is $DSH_HOME/profiles/web/cordis.patch.yml and points to those credentials. UI redaction is not proof of disk encryption or secure backups. Restrict file access, avoid committing secrets and preserve existing provider entries when editing a Cordis configuration patch.³

The useful distinction is between the agent runtime and its model provider.

You can keep the same tool stack, session model and workspace while changing the underlying LLM. In practical terms, the same repository can be tested with DeepSeek, Claude, GPT, Kimi or GLM without replacing the entire agent environment.

What do you need to install it?

For the current Node-based web application, the repository requires Node.js ^22.19.0 or >=24.0.0.²

The simplest start command is:

npx @deepseek-ai/dsh web

The official README confirms that the local Web UI starts at http://127.0.0.1:3080 and opens the browser. Use npx @deepseek-ai/dsh web --no-open when you want to start the server without opening a browser. Loopback does not mean offline inference: a cloud model provider still receives prompts, and plugins may access the network. Initial npx installation can download packages.²³

Minimum requirements

You need:

1. a macOS, Windows or Linux machine,
2. a supported Node.js version,
3. DeepSeek Harness,
4. a compatible model provider or endpoint,
5. a workspace the agent is allowed to access.

A high-end local GPU is not required when model inference happens through a cloud API.

Do you need a DeepSeek API key?

No.

You need a DeepSeek credential only when you use DeepSeek’s hosted model service. A custom provider uses its own API key, endpoint and model identifiers.³⁴

That makes DSH closer to an open agent runtime than a single-vendor chatbot.

How much does DeepSeek Harness cost?

The Harness source code is released under the MIT license.²

Model inference is separate.

Depending on your configuration, the actual workload may be billed by:

• DeepSeek,
• OpenAI,
• Anthropic,
• another model provider,
• or your own local infrastructure.

DeepSeek’s own terms distinguish its hosted models from custom-model services.⁴

Cost model: The MIT-licensed runtime is not an unlimited API plan. Cloud providers may bill tokens, tools and auxiliary services under their own current rate cards.

This matters more for agents than for ordinary chat. Multi-step tasks may repeatedly send context, tool output and intermediate state back to the model. Harness therefore includes token-pressure and usage telemetry, while the model provider remains the authoritative source for billing.⁵

Why “everything is a plugin” matters

DeepSeek Harness is built on Cordis, a component system that manages plugins, dependencies and lifecycle behavior.⁶

That architecture allows key parts of the runtime to be swapped or extended, including:

• model adapters,
• tools,
• agent loop behavior,
• storage,
• session logic,
• sandboxing,
• UI-level services.

For developers, the practical benefit is extensibility without maintaining a full fork for every change.

MCP support

Harness includes Model Context Protocol integration.⁷

Configured MCP servers can contribute tools to the normal Harness tool catalog, making it possible to connect services such as:

• GitHub,
• databases,
• browser tools,
• internal APIs,
• local services,
• knowledge systems.

The current implementation does not support every MCP capability, so the integration should be treated as substantial but not universal.⁷

Subagents

DSH has a dedicated subagent subsystem with explicit child-agent lifecycle and delegation behavior.⁸

A parent agent can therefore split a larger task into specialized jobs such as:

1. repository analysis,
2. test inspection,
3. architecture review,
4. documentation research,
5. final synthesis.

The architecture is promising, but the project remains preview software and should not be treated as fully mature enterprise orchestration.⁹

DSH scheduled reminders are not completed unattended jobs

The current DeepSeek Harness Schedule guide documents conversation-linked reminders, not a verified background CI runner. The standard Web profile already ships with Host Schedule and the Automation tasks screen. The standard, cordis and ptc presets expose schedule_create, schedule_list, schedule_update and schedule_delete; minimal and delegated subagents do not have these tools. This feature does not require a separately installed experimental cron plugin in the shipped Web profile.¹⁰

Supported reminder schedules include once, fixed intervals, daily or weekly local times and five-field cron expressions, all with the appropriate IANA time zone where applicable.

Reproduce a safe reminder test on a Mac

1. In a fresh DSH Web Session, ask: Remind me every day at 9:00 AM America/New_York to check my site's build status.
2. Open Automation tasks, find the entry and confirm the daily / America/New_York rule. That is a reminder, not a scheduled GitHub Actions execution.
3. Set a one-time reminder a few minutes ahead and verify that the message appears in the original Session while DSH’s Host is running.
4. Check delivery records. A successful delivery means an inbox message was stored, not that an agent ran tests, committed code or deployed the website.

The Host can restore a Session to deliver a scheduled reminder even when that Session is not open. If the Host stops, reminders are not delivered until restart. For missed recurring occurrences, the service catches up with only the latest one; delivery may be repeated after a failure, so exactly-once execution is not guaranteed. Use a real IANA zone like America/New_York, not a constant UTC offset that breaks across daylight saving.¹⁰

How to run actual recurring repository work

For scheduled agent tasks, use a separate controller that starts DSH and validates the result:

• Scheduler / queue: create a uniquely identified job and define the allowed workspace, requested task and retry policy.
• DSH ACP worker: open or resume a Session and submit a task using the official ACP package, with session/new, session/prompt, session/update, session/cancel and session/close.
• Completion gate: record tool failures, tests and real output artifacts; approve a commit or pull request before marking the job successful.
• Safety: one writing worker per repository, scoped credentials, human approval before production publishing, and deduplication against retries.

An external scheduler like Hermes could be used as the controller, but this is an architecture proposal, not an independently verified built-in Hermes↔DSH↔Plane integration. DSH’s ACP service is a JSON-RPC stdio worker for trusted clients. A reminder delivery is not a job receipt and does not replace a reliable queue.¹¹

Sources: DSH Schedule guide and DSH ACP protocol reference. These procedures are documented checks, not benchmarks or automation we have executed.

Browser and computer control

Harness can integrate browser-use providers. Current documentation references options such as Playwright MCP, Chrome DevTools MCP and Stagehand.¹²

A separate Computer Use subsystem supports desktop interaction through a configured provider.¹³

That pushes DSH beyond a conventional code assistant and toward a general-purpose agent runtime.

Security is the biggest caveat

The official safety documentation is unusually explicit.

DeepSeek’s official SAFETY.md explicitly calls DSH experimental developer-preview software without a security audit. For untrusted material it recommends a disposable VM, container or dedicated environment, plus backups and least-privilege permissions. Approval prompts and sandboxing alone do not guarantee isolation.⁹

Depending on your permissions, an agent may be able to:

• read files,
• modify files,
• execute shell commands,
• start processes,
• load plugins,
• access networks,
• use credentials.

DSH does provide sandboxes, permissions and approval mechanisms. But the documentation also warns that these controls do not provide guaranteed isolation.¹⁴

Safer first-test setup

Use:

• a disposable repository,
• clean Git commits before each run,
• no production SSH keys,
• no sensitive credentials,
• approval for destructive commands,
• careful review of third-party plugins,
• narrow permissions for browser or desktop control.

ACP profile for editors

DeepSeek documents separate Web, Headless, SDK and ACP profiles. An editor that supports the Agent Client Protocol can use the dedicated launcher:

dsh --profile acp

This starts the ACP service, not a different model. The editor must support the protocol and manage the process. Providers and tool permissions remain part of the Harness configuration. Test with a disposable repository containing no secrets; a successful chat reply is not proof that file operations are safe. ⁶

For automation: dsh --profile acp starts a JSON-RPC stdio service for a separate controller. It does not start a recurring task without incoming session/prompt calls; a controller must verify tests and external side effects independently.¹¹

DeepSeek Harness vs Claude Code, Codex or Hermes

The main distinction is product architecture rather than raw model quality.

A tightly integrated coding agent usually ships model, agent loop and tool environment as one product.

DeepSeek Harness exposes more of that stack as a replaceable runtime layer.

Area	DeepSeek Harness	Typical integrated coding agent
Model switching	Core design goal	Varies
Custom providers	First-class	Varies
Plugin architecture	Very open	Usually narrower
MCP	Integrated	Product-dependent
Scheduling	Built-in reminders; verify actual jobs with an external controller	Varies
Subagents	Built in	Varies
Runtime modification	Explicitly encouraged	Usually more limited
Setup complexity	Higher	Usually lower
Preview risk	Currently significant	Product-dependent

When the runtime is worth the setup

Harness is useful when you need provider switching, custom tools or control of the agent loop. For simple DeepSeek chat, a lighter client is easier to maintain.

For a meaningful trial, create three known-answer tasks in a disposable repository: explain a module, fix a defect and run tests. Give the same tasks to two providers and record correct completions, unintended file edits, tool calls, tokens and wall time. A faster answer that fails the tests is not an improvement.

Cordis makes the runtime adaptable, but the public preview still needs strict workspace and permission boundaries. ²⁶ For one possible model, see DeepSeek V4.1 Flash.

Primary-source references

Footnotes

1. DeepSeek: product page ↩ ↩²

2. DeepSeek: README ↩ ↩² ↩³ ↩⁴ ↩⁵

3. DeepSeek: provider guide ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

4. DeepSeek: data processing ↩ ↩²

5. DeepSeek: token meter ↩

6. DeepSeek: architecture ↩ ↩² ↩³

7. DeepSeek: MCP ↩ ↩²

8. DeepSeek: subagents ↩

9. DeepSeek: safety notice ↩ ↩²

10. DeepSeek: scheduling ↩ ↩²

11. DeepSeek: ACP protocol and programmatic worker ↩ ↩²

12. DeepSeek: browser use ↩

13. DeepSeek: computer use ↩

14. DeepSeek: sandbox ↩