What is DeepSeek Harness?
DeepSeek Harness (dsh) is DeepSeek's own open-source agent harness, released as a developer preview in August 2026. Out of the box it is a coding and general-work agent that reads and edits files in a workspace, runs commands, delegates to subagents, keeps a plan and schedules recurring tasks. You drive it from a local Web UI (npx @deepseek-ai/dsh web), an official desktop app for macOS and Windows, a headless mode, an ACP server or a Python SDK. Underneath, everything is a plugin on the Cordis framework: model adapters, tools, the sandbox, session storage, the UI and the agent loop itself can be swapped out.
It is MIT-licensed TypeScript with about 267,000 GitHub stars and 32,000 forks for a repository created on 13 August 2026, and the npm package @deepseek-ai/dsh was downloaded about 680,000 times in the week to 29 October 2026. There is no stable release: the latest is the v0.2.1-rc.5 release candidate of 30 October 2026, the README promises compatibility-breaking changes, and the safety notice says the project has not had a security audit. GitHub issues are switched off; feedback goes to Discussions, which hold about 11,500 threads.
Is DeepSeek Harness worth it?
DeepSeek Harness is the cheapest serious way to run an agent on DeepSeek's models, and a risky thing to install on a machine that holds anything you care about. The agent itself covers the same ground as Claude Code, Codex and OpenCode. The pitch is the architecture: every part is a plugin, and Creator mode lets the agent write and install new plugins for you. A community formed within weeks, and the awesome-dsh-plugin list now counts 8,076 plugins.
That openness is also the security problem. Plugins are not sandboxed. The Cordis docs describe them as trusted same-process code, and installing a bundle executes its code in the Host process, which is why the agent needs Full access or your approval to do it. Nobody vets plugins centrally: DSH ships no plugin index, the Discover tab reads only index files you add, and the docs warn that an index's titles, authors and sources are unchecked claims. The awesome-dsh-plugin maintainers check that a plugin installs and does what its line says, and state plainly that a listing is not a security review and that tool approvals do not sandbox plugin code. The command sandbox (bwrap, Seatbelt or Landlock, partial on Windows) and the default workspace-write mode with approval prompts govern what the model runs, not what a plugin does.
It is not limited to DeepSeek. Settings → Models takes a DeepSeek API key or account login, has catalogue entries for providers such as Anthropic, OpenAI, Kimi and GLM, and accepts any gateway that speaks OpenAI Chat Completions, OpenAI Responses or Anthropic Messages. The economics favour DeepSeek, though. At peak, deepseek-flash costs $0.30 per million uncached input tokens, $0.006 cached and $1.20 output; deepseek-v4-pro costs $1.32, $0.044 and $3.96. Off-peak rates are half, and the peak windows (01:00 to 04:00 and 06:00 to 10:00 UTC on weekdays) sit in the Chinese working day, so a European morning pays full price while the American working day falls entirely off-peak. On our arithmetic, a session that reads 10 million input tokens, 90% of them cached, and writes 500,000 costs about $3.70 on V4 Pro at peak and about $0.95 on Flash. Web search and fetch, free until now, are billed at $0.75 per 1,000 requests from 1 November 2026.
The data defaults deserve a buyer's attention. On the official DeepSeek API, a session-log plugin is on by default and attaches the complete session log, up to 8 MiB per request, to later model requests; according to the CLI reference, these uploads can include message text, tool arguments and results, and workspace paths. It is switched off under Settings → General. Separately, recording /feedback uploads the session to DeepSeek's collector unless DSH_TELEMETRY_MODE=DISABLED is set. DeepSeek's privacy policy says it collects, processes and stores personal data in the People's Republic of China and lists training its models among the purposes, and in our reading its platform terms offer no zero-retention or regional-hosting option. Routing DSH to another provider removes that concern, and the price advantage with it.
DeepSeek's own API docs list Claude Code, Codex and OpenCode as supported front ends for its models, so cheap DeepSeek tokens do not require DSH. OpenCode offers the same provider freedom on a stable release line, and Claude Code and Codex are built around their makers' own models. What DSH adds is a harness you can take apart and reassemble, at the price of preview software that its own safety notice says must not be treated as secure.
Where it earns its place
A solo developer already paying for DeepSeek API tokens
Run a coding agent all day for a few dollars
Run npx @deepseek-ai/dsh web, add the API key and pick a workspace. deepseek-flash at peak costs $0.30 per million uncached input tokens against $1.32 for V4 Pro, and moving long batch jobs into off-peak hours halves either bill.
A platform engineer building an internal agent for a 40-person product team
Ship a company agent with its own tools, approval rules and session storage without forking a codebase
Write Cordis plugins and publish them to a private npm registry or a team index file served over https, which the reference generator builds from a plain list. Pin a release candidate, because the preview promises breaking changes, and budget time to re-test on every upgrade.
A security lead at a European fintech asked whether staff may install DSH
Decide what configuration, if any, is acceptable
Require a disposable VM or container as the safety notice advises, route models through an approved non-DeepSeek gateway or switch off session-log upload, set DSH_TELEMETRY_MODE=DISABLED, and allow plugins only from an internal index. The software is free; the review and the data-residency question are the real cost.
An evaluation researcher running agent benchmarks
Run many isolated agent tasks from Python
pip install deepseek-harness-sdk bundles the runtime, so no system Node.js is needed. The sdk-minimal profile runs in danger-full-access mode, so each task needs its own workspace, session ID and container.
Before you commit
- Setup
- npx @deepseek-ai/dsh web needs Node.js and opens the Web UI on 127.0.0.1:3080; add a DeepSeek key under Settings → Models and choose a workspace. Official desktop builds cover Apple-silicon Macs and 64-bit Windows. The Python SDK is deepseek-harness-sdk; the PyPI name deepseek-harness belongs to an unrelated project. Binding the Web UI to 0.0.0.0 is unsupported.
- Integrations
- DeepSeek by API key or account login, catalogue providers including anthropic, openai, moonshotai and zai, and custom gateways over OpenAI Chat Completions, OpenAI Responses or Anthropic Messages; MCP, LSP, ACP, headless mode and a Python SDK. Plugins install from npm, Git or tarballs with dsh plugin add. Community indexes include awesome-dsh-plugin and dsh-market; anywhere-labs' DSH Desktop (about 34,300 stars) is an unofficial client that states it has no affiliation with DeepSeek, and coeasy/dsh-go is a two-star marketplace proposing signed-publisher trust levels.
- Data and privacy
- On the official DeepSeek API the full session log, up to 8 MiB per request, is attached to model requests by default (switch under Settings → General). /feedback uploads the session to DeepSeek's collector unless DSH_TELEMETRY_MODE=DISABLED. DeepSeek's privacy policy places storage of personal data in the People's Republic of China. Sessions are kept locally as JSONL under $DSH_HOME; keys sit in $DSH_HOME/.credentials.yaml.
- Cost at scale
- The harness is free and has no paid or enterprise edition. On DeepSeek, the cost is tokens: a session reading 10 million input tokens (90% cached) and writing 500,000 costs about $3.70 on V4 Pro at peak or $0.95 on Flash, half that off-peak. Search and fetch cost $0.75 per 1,000 requests from 1 November 2026; concurrency limits are 2,500 for Flash and 500 for V4 Pro.
- Limits
- Pre-1.0, with release candidates every few days and promised breaking changes; no security audit; Windows sandboxing is partial. Issues are disabled, so bug reports live among about 11,500 Discussions threads. No security advisories have been published, which for an 11-week-old project says little.
What’s good
- Every part, down to the agent loop, swaps out as a plugin
- Works with Anthropic, OpenAI and any compatible gateway, not only DeepSeek
- DeepSeek tokens from $0.30 per million uncached input, half that off-peak
- Web UI, desktop app, headless mode, ACP and a Python SDK from one codebase
What’s not
- Developer preview with no security audit and promised breaking changes
- Plugins run unsandboxed in the host process, with no central vetting
- Session logs go to DeepSeek by default on its official API
- DeepSeek's privacy policy places data storage in China
Best for
Developers on DeepSeek's API who want an agent they can rebuild from plugins, run on a machine or VM with nothing sensitive on it.
DeepSeek Harness alternatives
DeepSeek Harness: common questions
- Is DeepSeek Harness worth it?
- Cheap DeepSeek tokens and a harness you can rebuild piece by piece, wrapped in unaudited preview code that sends your session logs to DeepSeek by default. We rate it 3.7 out of 5.
- How much does DeepSeek Harness cost?
- Free and open source (MIT); you pay for model usage. On DeepSeek's API at peak, deepseek-flash costs $0.30 per million uncached input tokens and $1.20 per million output tokens, deepseek-v4-pro $1.32 and $3.96; off-peak rates are half.
- What are the downsides of DeepSeek Harness?
- Developer preview with no security audit and promised breaking changes; plugins run unsandboxed in the host process, with no central vetting; session logs go to DeepSeek by default on its official API; deepSeek's privacy policy places data storage in China.
- Who is DeepSeek Harness best for?
- Developers on DeepSeek's API who want an agent they can rebuild from plugins, run on a machine or VM with nothing sensitive on it.
- How much does DeepSeek Harness cost for a team or in production?
- The harness is free and has no paid or enterprise edition. On DeepSeek, the cost is tokens: a session reading 10 million input tokens (90% cached) and writing 500,000 costs about $3.70 on V4 Pro at peak or $0.95 on Flash, half that off-peak. Search and fetch cost $0.75 per 1,000 requests from 1 November 2026; concurrency limits are 2,500 for Flash and 500 for V4 Pro.
- Is DeepSeek Harness safe for company data?
- On the official DeepSeek API the full session log, up to 8 MiB per request, is attached to model requests by default (switch under Settings → General). /feedback uploads the session to DeepSeek's collector unless DSH_TELEMETRY_MODE=DISABLED. DeepSeek's privacy policy places storage of personal data in the People's Republic of China. Sessions are kept locally as JSONL under $DSH_HOME; keys sit in $DSH_HOME/.credentials.yaml.
- What are the best DeepSeek Harness alternatives?
- The closest alternatives we have reviewed are OpenCode, OpenAI Codex CLI, Cline and Aider.
Answers checked Oct 31, 2026.