Skip to content
Archive
By Harness the Agents

DeepSeek Harness Isn't a Claude Code Killer. It's Something More Interesting.

DeepSeek's open-source agent harness passed 168,000 GitHub stars in its first week. I installed it, read the repo, and ran it myself. Here is what holds up.

The DeepSeek Harness wordmark beside the DeepSeek whale logo, in blue on a white background with faint circuit-board traces.

DeepSeek Harness Isn't a Claude Code Killer. It's Something More Interesting.

The README promises a one-line install. Type npx @deepseek-ai/dsh web, and you're in. On my machine, that one line took sixteen minutes, pulled hundreds of packages into the npx cache, and took another ten minutes to re-resolve the next time I ran it. I don't hold this against DeepSeek. I mention it because the gap between the one-line promise and the sixteen-minute reality is the whole story of DeepSeek Harness in miniature. What shipped on 13 August is genuinely interesting, genuinely rough, and widely misread.

The misreading goes like this: DeepSeek has built a Claude Code competitor. It's the frame most of the launch coverage reached for, and I understand why. It looks like one, it walks like one, and parts of it were quite literally written by one. But it's the wrong frame, and after a week of reading the repository, running the thing, and checking the claims that other people made about it, I think the real story sits one layer up.

Key Takeaways

DeepSeek Harness (dsh) is an MIT-licensed agentic coding harness in developer preview, released 13 August 2026. It passed 168,000 GitHub stars and 552,000 npm downloads in its first week.Its "everything is a plugin" claim is literally true. The model adapter, the tools and the agent loop itself are all swappable, built on a framework with four years of production history outside AI.Token hunger is real and corroborated, but cache hit rates near 99% soften the bill. Treat it as a tinkerer's preview, not a daily driver.The strategic move matters more than the tool: a model lab is giving the harness layer away, and that is a shot at the harness-as-subscription business model, not at Claude Code's feature list.

A note on method before we start. Everything below about the repository, the install, and the run is first-hand from this week. Where I rely on other people's testing, I say so and name them.

What did DeepSeek actually ship?

As of 20 August 2026, the repository is one week old, sits at 168,325 stars, and the npm package was downloaded 552,210 times in the week of 12-18 August. Those are large numbers for a developer preview that its own docs warn will break compatibility without notice. What they bought is a local agent harness: you run dsh web, a browser interface opens on port 3080, you point it at a workspace, pick a model and a mode, and let it work.

The detail I find most telling is what's inside. This is not a thin wrapper around an API. The checkout I built from source has 226 workspace packages, a permission system with sandbox modes from read-only to danger-full-access, and four agent presets. Standard is the full coding agent, PTC has the model write one program and execute it, Minimal ships two tools, and the self-extending Creator mode carries a header comment telling you to treat it as shell access.

Most remarkable of all: official plugin packages let the harness call Claude Code and Codex as sub-agents. DeepSeek's harness will happily delegate a subtask to its supposed rivals. And every session is written to an append-only log that records the full system prompt, every tool call and every token count. My own test run produced 250 events for a ten-step task, all of it inspectable afterwards.

One practical warning. There is an unrelated third-party project also called deepseek-harness, a protocol adapter released back in May. If you go looking, you want the deepseek-ai organisation. The other one isn't malicious, just confusingly named.

DeepSeek Harness is an MIT-licensed agentic coding harness released in developer preview on 13 August 2026. The GitHub repository passed 168,000 stars within a week, and the tool can orchestrate Claude Code and Codex as sub-agents rather than only competing with them.

The framework came from a chatbot ecosystem

Here is the part almost none of the English-language coverage caught. DeepSeek did not build the harness's plugin architecture from scratch. It's built on Cordis, an MIT-licensed TypeScript plugin framework that has been in production since 2022 underneath Koishi, a chatbot framework with thousands of community plugins. Cordis's creator, Yifan Shi, is the first author of the paper DeepSeek published alongside the release, with a Peking University affiliation on the byline. The paper is a self-hosted preprint, 88 pages, honestly labelled a draft. The Cordis repository itself sat at 6,465 stars when I checked on 20 August.

The idea it formalises has a forbidding name, spatiotemporal composability, and a plain meaning. Temporal: any part of the system can be unloaded at runtime, and everything it did gets cleanly undone. Spatial: parts declare what they depend on and wake up or shut down as those dependencies come and go. The paper proves that the order you load and unload things in doesn't matter; the system converges to the same state regardless. If this sounds like a solved problem, it isn't. The paper's motivating statistic is that 87 of the 100 most popular VSCode extensions can't be unloaded without restarting the editor.

I wanted to know whether "everything is a plugin" was marketing or mechanism, so I dumped the resolved configuration. It's mechanism. The default web profile composes 135 plugin rows across 24 YAML patch layers, each one annotated with which package contributed it. The model adapter, the tool registry, the session log, the agent loop: all plugins, all reversible. The repo also gates every source file at 100% test coverage in CI, which is an almost comically strict bar for a week-old preview.

DeepSeek Harness runs on Cordis, a plugin framework in production since 2022 in the Koishi chatbot ecosystem, formalised in an 88-page preprint from Peking University and DeepSeek. Its core guarantee: any component can be loaded or unloaded at runtime and the system converges to the same state regardless of order.

It was built with its rivals' tools

Now the awkward, funny bit. A code-forensics write-up (winzheng.com, a single source, though it claims its scripts are reproducible) walked the commit history and found that 1,760 of the first 12,293 commits carry a codex/ branch prefix, that the eleventh commit is titled "fix issues found in the second round of Codex review", and that a CLAUDE.md symlink pointing at AGENTS.md existed from the very first commit. In plain terms: DeepSeek's team built the harness heavily with OpenAI's Codex and Anthropic's Claude Code in the loop.

I'd file this under delightful rather than scandalous. Every serious engineering team I know now builds with these tools, and DeepSeek plainly does too. The same report also checked the spicier rumour, that the harness was lifted from leaked Claude Code source, and found no string overlap at all. Worth saying, because that rumour did the rounds. What the forensics actually show is more interesting than the rumour: the lab's conviction that the model is the commodity and the loop around it is the product extends to how it builds its own software.

One more honesty note. The harness is Chinese-first in places the English coverage hasn't mentioned. The preset metadata files are written in Chinese first, and some shipped UI strings are Chinese-only. If you want a small, concrete sign of who DeepSeek expects its early adopters to be, that's it.

I ran it myself

Reading about a harness only gets you so far, so I ran a real task. Rather than a DeepSeek API key, I used an OpenCode Go subscription key, which routes through a catalogue of sixteen models from seven or more labs. That choice was accidental and turned out to be the most instructive part of the whole test: I ran DeepSeek's harness on DeepSeek's V4 Flash model without going anywhere near DeepSeek's own API. The provider swap the architecture promises is not theoretical. It's a YAML file and an environment variable.

The task: build a single-page site showing live clocks for Hangzhou, London and New York, then verify it. The run took 2 minutes 8 seconds, 10 steps and 9 tool calls, burning about 108,000 tokens with 91% of input served from cache. The agent probed the environment, wrote the page, extracted its own JavaScript and syntax-checked it with node, caught a rounding bug in its own verification script, fixed that, and re-ran the check. I then verified the output independently: the timezone maths was right, including the fact that London is currently on British Summer Time and New York on EDT. Small task, correct result, full log.

The rough edges are real too. Launching from a source checkout is fragile about your working directory in ways the docs don't mention. The headless mode prints no token summary; I computed the numbers by hand from the session log. And the system prompt told the model it was deepseek-v4-flash because that's what my configured route was named, which is fine until someone proxies a different model and the agent develops a false sense of identity. Preview-grade stuff, all of it.

In a first-hand test on 20 August 2026, DeepSeek Harness completed a verified single-page build in 2 minutes 8 seconds over 10 steps, using roughly 108,000 tokens with a 91% cache-read rate, running through a third-party OpenCode Go model key rather than DeepSeek's own API.

The honest bill

The strongest criticism of the harness is that it burns tokens, and the criticism holds up. Julian Goldie's AI Success Lab timed it against Claude Code on the same one-page site in launch week: the DeepSeek stack used about 483,000 tokens to Claude Code's 48,000, though it finished in 11 minutes to Claude Code's 30-plus and cost roughly five cents. A Reddit user's side-by-side on code review tasks found the same shape, and his follow-up admits he hadn't tuned the dsh config at all.

Test

Tokens

Time

Notes

One-page site, dsh + V4 Pro (AI Success Lab)

~483,000

11 min

~$0.05, cache-heavy

One-page site, Claude Code (same task)

~48,000

30+ min

Scored higher on quality, 9/10 vs 7/10

Code review, dsh untuned (Reddit)

500,000

n/a

70% cache hit rate

Code review, OpenCode (same tasks)

~70,000

n/a

95% cache hit rate

Clock build, my run (20 August)

~108,000

2 min 8 s

91% cache read, output verified

What rescues the economics is the cache. Testers for QbitAI, a Chinese outlet with two weeks of closed-beta access, measured cache hit rates around 99%, and my own run sat at 91%. Cached input is close to free, so the scary token counts translate into small bills.

Reliability is the softer underbelly. AtlasCloud reran the ISS-tracker build from the launch coverage three times (disclosure: a vendor blog, running against its own hosted endpoint), and in two of the three runs the harness printed "Done" while the page in the browser was actually broken. My clock task verified cleanly, but my clock task was also trivial. Treat the demos as demos.

DeepSeek Harness is token-hungry but cache-heavy: independent tests in August 2026 show roughly ten times the token consumption of Claude Code on identical tasks, offset by cache hit rates near 99% and DeepSeek's official pricing of $0.007 to $0.014 per million cached input tokens.

What does DeepSeek Harness cost?

Pricing needs a date stamp, because much of the launch-week coverage is already wrong. On 16 August, DeepSeek moved its API to peak and off-peak pricing. As of 20 August, the official pricing page lists V4 Flash at $0.22 to $0.44 per million input tokens depending on the hour, $0.66 to $1.32 per million output, with cache hits at $0.007 to $0.014. Pro runs at triple that. If a review quotes you flat $0.14 prices, it's quoting June. The longer version of why these numbers stay low is in how China's AI price war works.

Between the two models, the early consensus matches my instinct: Flash for everyday work, Pro when the problem is genuinely hard. If you're weighing them against the rest of the field, I keep a running comparison in Qwen vs DeepSeek vs Llama.

Is DeepSeek Harness safe to run?

State the deployment assumption first, as always. The harness runs locally and you choose the model route, so the data-residency question is about which provider you point it at, not about the harness itself; my test sent prompts to OpenCode Go's servers, not DeepSeek's. Two real cautions remain. The repo's own notes describe telemetry that is disabled by default but, if enabled, ships with no redaction rules. And plugins execute in-process with your permissions, so the plugin ecosystem is a supply-chain question, the same shape of question as whether DeepSeek is safe for enterprise in the first place. Nobody has done an independent security audit yet.

What the move means

DeepSeek's own product page for the release states the thesis in four words: Agent equals Model plus Harness. The model predicts tokens; the harness decides what tools it gets, when it stops and what it remembers. VentureBeat's launch coverage had the sharp framing: once frontier models converge in capability, the layer that controls how an agent reasons and persists across a workflow becomes much harder to replace than the model itself. Which raises the question of why a lab would give that layer away under MIT.

Because giving the expensive thing away is what DeepSeek does. It did it to the model layer with open weights, and the field guide to China's open-weight ecosystem is the long version of that story. The harness is the same wedge driven one layer up, and the 36Kr commentary quoted by one source-code reviewer said the quiet part plainly: this is not a shot at Claude Code's feature list, it's a shot at the harness as a paid product. Whether the bet pays off depends on something DeepSeek can't control, which is whether strangers actually build plugins. That's the number I'd watch, not the stars.

So should you try it? If you tinker, yes. The install is heavy but the source build is clean, and there is real pleasure in reading a codebase this disciplined. If you self-host models or care about cost at scale, yes, with the provider config as the point of the exercise. If you need a stable daily driver, no. The repo promises breaking changes in writing, and it means it.

DeepSeek Harness is a strategic release, not just a tool: by MIT-licensing the harness layer and declaring "Agent = Model + Harness", DeepSeek is arguing the harness should be a commodity, the same wedge it previously drove through the model layer with open weights.

Frequently asked questions

Is DeepSeek Harness safe to run with shell access?

The harness runs locally, so the question splits in two. Your prompts go to whichever model provider you configure, and the built-in sandbox starts at read-only with workspace-write and full-access modes above it. The sharper risk is plugins: they run in-process with your permissions, and the week-old plugin ecosystem has no independent audit yet.

Can DeepSeek Harness really call Claude Code and Codex?

Yes, and this is confirmed in the repository, not just claimed in coverage. Optional plugin packages named subagent-claude-code and subagent-codex drive the official Claude Agent SDK and Codex's app-server. You still need those tools installed and authenticated; the harness provides the orchestration, not the subscriptions.

Should I use Flash or Pro with DeepSeek Harness?

Flash for most work. Early independent tests show roughly ten times Claude Code's token usage on identical tasks either way, so the cheaper model is where the economics work. As of 20 August 2026, DeepSeek's official pricing puts Flash output at a third of Pro's price. Reserve Pro for problems that genuinely need the extra reasoning.

The bottom line

DeepSeek Harness is a rough, disciplined, genuinely novel piece of engineering that most launch coverage described as the wrong thing. It isn't trying to out-Claude Claude Code. It's a model lab declaring that the layer above the model should be free, and building that declaration out of four-year-old chatbot framework parts and its rivals' own coding tools. Whether that declaration sticks depends on the plugin authors, and they'll take months to judge. In the meantime it's the most instructive sixteen-minute install I've done this year.

If you're weighing Chinese models or agent tooling for something real, get in touch.

Sources (all retrieved 2026-08-20):