DeepSeek Ships Harness: Every Agent Primitive Is Now a Plugin

Anyone who has tried to swap the tool loop inside LangChain or fork a Claude Code clone knows the pain: the "framework" is really a load-bearing wall with decorative hooks. DeepSeek just shipped something built on the opposite assumption. The v0.1 developer preview of DeepSeek Harness landed this week under an MIT license, and it treats every part of the agent runtime, including the loop, as a mountable plugin.

That is a bigger deal than the surface release notes suggest. It's the first credible attempt I've seen from a frontier lab to publish the harness layer as neutral infrastructure rather than a moat.

What Happened

DeepSeek released DeepSeek Harness v0.1 as a developer preview, shipping the full source under MIT at deepseek-ai/deepseek-harness. The CLI is called dsh. As MarkTechPost reported, DeepSeek frames the design as a simple equation: Agent = Model + Harness. The company is drawing a line between the weights and the machinery around them, and open-sourcing the second half.

The runtime sits on top of Cordis, a meta-framework whose kernel handles plugin mounting, unmounting, and dependencies. Cordis has its own paper, "A Programming approach for Spatiotemporal Composability," describing the model. Every capability lives as a plugin: models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and the UI. Nothing sits in a privileged core.

Harness ships four runtime modes out of the gate. Standard is the full coding-agent loadout with file editing, shell, file and web search, skills, planning, goals, subagents, and workflows. Code mode wraps those tools in a Code Mode SDK so a model can express multi-step operations as one TypeScript program. Minimal keeps only a persistent bash and str_replace_editor, meant for benchmarking. Creator mode adds runtime inspection, in-memory plugin experiments, and preset-authoring guidance.

Provider coverage is broad from day one. Anthropic, OpenAI, Bedrock, Vertex, Azure, and Codex are all supported, alongside any OpenAI-compatible endpoint. Bedrock wants AWS credentials and a region, Vertex needs an ADC project, Azure requires an api-version, and Codex uses OAuth. A DeepSeek API key can be rotated in Settings and takes effect on the next request without a server restart. That is not a small detail for anyone running long-lived agent processes.

Technical Anatomy

The interesting engineering claim here is the session log. Every run is written to an append-only event stream. That stream captures system prompts, reasoning, tool calls and their results, subagent scheduling, and, critically, every context injection. Resume, fork, search, and replay all operate on the same log. A Trajectory view inspects records by source.

Most agent frameworks log tool calls. A few log reasoning. Recording every context injection is the sharper move. In production incidents I've seen with agent stacks, the root cause is almost never the tool call itself. It's some retrieval plugin, some skill preamble, some "helpful" middleware that silently mutated the prompt three turns earlier. If you cannot audit what got shoved into context and by whom, you cannot post-mortem the agent. Full stop.

Cordis as the substrate matters because plugin systems live or die on their dependency model. The kernel handling mount, unmount, and dependency resolution centrally means teams can hot-swap a sandbox or a scheduler without a hard fork. Compare that to the usual pattern where the agent loop is a 400-line function you monkeypatch and pray. The MCP spec tackled the tool-transport layer in the same spirit; Harness extends the philosophy inward to the loop and storage.

Credential handling is boring in the right way. Keys are write-only, stored in $DSH_HOME/.credentials.yaml. Settings retain only a reference, not the value. That is the minimum bar for anything a security team will let near a repo, and plenty of agent frameworks still fail it.

Deployment paths are straightforward. npx @deepseek-ai/dsh web starts the Web UI at http://127.0.0.1:3080. From source it's git clone, pnpm install, pnpm run build, pnpm dsh web. A Python SDK, deepseek-harness-sdk, ships for Python 3.10+ on Linux x64, Linux arm64, and macOS 14+ on arm64, with a bundled runtime that needs no system Node.js. That last detail alone will save a day of container-image debugging for anyone who has fought Node versions inside a Python monorepo.

Who Gets Burned

The companies with the most to lose here are the ones selling closed agent runtimes as their primary moat. If your product is "we wrap Claude and OpenAI with a proprietary loop and a nice UI," an MIT-licensed harness with hot-swappable providers, session forking, and four preset modes just compressed your differentiation window. The model providers themselves are less exposed, because Harness routes to all of them; the pain lands on the middle layer.

LangChain, LlamaIndex, and the smaller agent-framework startups now have to answer a pointed question: what does your framework do that a Cordis-based plugin cannot? "Ecosystem" is the honest answer today, but ecosystems erode fast when a frontier lab ships a cleaner primitive under MIT. Teams I've worked with in fintech spent the last eighteen months building internal forks of these frameworks because upstream extensibility was a lie. Those forks are now candidates for replatforming.

My take: the vendors who survive this cycle are the ones who reposition as plugin authors on top of neutral harnesses, not as harness owners themselves. The unit economics of maintaining a bespoke agent loop against DeepSeek, Anthropic, and OpenAI all shipping reference implementations do not work for a Series A team.

On the buyer side, regulated enterprises get the biggest gift. MIT licensing plus self-hosting plus a full audit log of context injections is roughly the shopping list a bank's model risk team writes when asked what would make agents acceptable. Healthcare and pharma R&D groups get the same. This is the first agent runtime I'd hand to a compliance officer without wincing.

Internal platform teams at mid-to-large enterprises should read the release as an inflection point. If you have been holding off on standardizing an internal coding agent because every option required lock-in, that excuse just expired.

Playbook for AI Development

Concrete moves for this week, in priority order.

First, run Minimal mode against your evaluation suite. Two tools, persistent bash and str_replace_editor, is exactly the bare environment you want for comparing models without harness-induced variance. If your current benchmarks bake in framework-specific tool wrappers, your numbers are lying to you. Rerun them here.

Second, prototype a provider-swap scenario. Point Harness at DeepSeek, then at Anthropic, then at a self-hosted OpenAI-compatible endpoint. Time how long a real migration takes. The uncomfortable read for most platform teams is that their current stack cannot do this in under a sprint. Harness can do it without a server restart.

Third, wire the session log into your observability pipeline before you build anything else on top. The append-only stream with context-injection records is the single most valuable artifact this release produces. Ship it to your existing log store, index it, and set up replay as a first-class debugging workflow. Do this before your first production incident, not after.

Fourth, if you are shipping agent products, audit whether your differentiation lives in the harness or in the domain layer above it. If it's the harness, start writing plugins instead. That is where the market is going.

Fifth, keep this in developer preview until v0.1 stabilizes. MIT license and self-hostable does not mean production-ready. Pilot internally, log everything, and wait for the sharp edges to surface before it touches customer traffic.

Key Takeaways

• DeepSeek Harness v0.1 ships MIT-licensed with the CLI dsh, and treats models, tools, sandboxes, loops, and UI as swappable Cordis plugins.
• Four modes (Standard, Code, Minimal, Creator) cover full coding-agent work, TypeScript multi-step programs, benchmarking with two tools, and plugin authoring.
• The append-only session log records every context injection, not just tool calls, and supports resume, fork, search, and replay on one event stream.
• Provider coverage spans DeepSeek, Anthropic, OpenAI, Bedrock, Vertex, Azure, Codex, and any OpenAI-compatible endpoint, with write-only credentials in $DSH_HOME/.credentials.yaml.
• Closed agent-runtime vendors just lost differentiation; regulated enterprises and internal platform teams gained a defensible self-hosted option.