無程式碼也能輕鬆打造專業LINE官方帳號！一鍵導入模板，讓AI助你行銷加分！
DeepSeek Harness: The Open-Source Agent Framework Where Everything Is a Plugin
The formula is everywhere now: Model + Harness = Agent.
The model reasons. The harness handles everything else — tool execution, memory, context control, sandboxing, orchestration. And on August 2026, DeepSeek shipped what might be the most important open-source reference implementation of that formula yet.
DeepSeek Harness (dsh) is the Chinese lab’s open-source agent framework: 25.9k stars, MIT license, 12,000+ commits, and an architecture built on one radical idea — everything is a plugin.
“Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI are ALL implemented as plugins, and can be mixed, matched, replaced, and extended.”
The architecture: Cordis under everything
dsh is powered by Cordis, a plugin meta-framework whose design is described in a paper on spatiotemporal composability. What that means in practice:
- No privileged core. Every part of the product — model adapter, tool registry, session log, even the agent loop itself — is a plugin. You extend dsh by mounting a plugin beside the others, and registrations unwind when the plugin unloads.
- Layered composition. A running dsh is a plugin tree composed from profiles and bundles (
dsh-baseprovides model adapters, tools, sandbox, approval policy;dsh-web-appadds the browser UI;dsh-headlessis a one-shot runner). Every row in the config tree can be replaced by a patch of your own. - Hardcoded security. Because restrictions live in the tool registry, not the prompt, a read-only agent simply has no write tools registered. One HN commenter summed it up: “Prompt-level restrictions hold right up until a long session starts improvising, and then you find out.”
Run it in one command
npx @deepseek-ai/dsh web
That starts the Web UI at http://127.0.0.1:3080 — a local browser portal for visualizing agent sessions, tool outputs, and configuration. (Or clone and build with pnpm.)
The 9 sub-agents: why multi-agent beats one big loop
Most coding agents are one large model in a loop — read files, plan, edit, test, review, all from the same brain. That works for tiny tasks and falls apart on anything touching more than a couple of files.
dsh takes the opposite approach: nine specialized sub-agents, each with a narrow job and a tuned model:
| Sub-agent | Job |
|---|---|
| File picker | Scans the codebase, pulls only relevant files (uses cheap Gemini 3.1 Flash Lite for retrieval — less context noise = sharper output) |
| Planner | Breaks big tasks into ordered steps; /in interview command asks questions first |
| Editor | Precise surgical diffs instead of whole-file rewrites — no formatting drift |
| Code reviewer | Reviews every change, flags risky edits before they ship |
| Browser-use | Drives a real Chromium instance — clicks, fills forms, screenshots, reads back what it sees |
| Researcher | Pulls docs and external context |
| Terminal runner | Executes shell commands, reads back output |
| Deep thinker | Optional; calls premium models (e.g. GPT-5.4) for the hardest reasoning |
| Follow-up suggester | Drops three clickable next actions after every response |
Main coding brains are swappable mid-session: DeepSeek V4 Pro for complex multi-file work, Kimi K2.6 for massive context analysis, Miniax M2.7 for UI/creative, DeepSeek V4 Flash for fast cheap edits. That’s a flexibility Claude Code doesn’t offer on its default plans.
The honest benchmark picture
Independent testing of DeepSeek V4 Flash across 8 harnesses on 30 multi-SaaS workflows (Airtable, Gmail, Sheets, GitHub, Slack, PostHog — 240 runs, 53.8% overall pass rate):
| Harness | Pass rate | Median time | Cost per success |
|---|---|---|---|
| Pi Agent | 66.7% | 132.2s | $0.028 |
| Prime Agent | 62.5% | 242.1s | $0.131 |
| OMP | 56.7% | 272.4s | $0.103 |
| Claude Code | 53.3% | 122.7s (fastest) | $0.195 (only 1.5% cache hits) |
| Codex | 53.3% | 245.0s | $0.081 (~70% cache hits) |
| DeepAgents | 53.3% | 187.1s | $0.045 |
| Hermes Agent | 50.0% | 175.5s | $0.056+ |
| OpenCode | 46.7% | 129.7s | $0.073 |
The cost column is the story: Claude Code used almost all fresh-input tokens (1.5% cache hit) vs Codex’s ~70% — and fresh input costs ~5x cached. dsh’s native optimization for DeepSeek’s context caching is exactly where that delta lives.
Why DeepSeek built this: strategy
- Own the agent layer. Model providers historically left tooling to third parties. But developer loyalty now lives at the workflow layer — and every frontier lab wants to control the runtime that burns their tokens.
- Maximize the 50x caching delta. DeepSeek’s API prices cached input at roughly $0.02/M vs $1/M fresh — a 50x difference. A harness that front-loads stable prompt sections (system rules, tool definitions) captures cache hits that generic third-party clients routinely destroy.
- Custom API tailoring. DeepSeek’s
automatic-prefix-cachediffers from Kimi’smoonshot-context-cache; each provider has its own error codes, retry semantics, streaming formats. A native harness implements the exact behaviors its own API needs — including MCP schema cleaning (flattening$refandanyOfso models generate valid params).
It’s also part of a wave: Alibaba Qoder, Moonshot Kimi Code, Zhipu Zcode — Chinese labs shipping native harnesses as foundation models commoditize and the fight moves to the workflow layer.
The honest caveats
- Developer preview. v0.1 with an explicit warning: “THERE WILL BE COMPATIBILITY-BREAKING CHANGES.” A public beta was slated for August 13, 2026, coinciding with DeepSeek-V4-Pro GA. Expect to update plugins regularly.
- Young plugin ecosystem. Cordis is powerful but the community plugin catalog is small next to VS Code or mature agent frameworks.
- Multi-agent overhead. Nine sub-agents = more moving parts, more latency, more points of subtle failure than a single-model loop.
- Model safety history. Cisco’s assessment of DeepSeek R1 found a 100% attack success rate on HarmBench jailbreaks — cost-efficient training appears to have compromised guardrails. Use strict tool boundaries (which dsh’s plugin architecture enables) and third-party guardrails for anything sensitive.
Conclusion
DeepSeek Harness is the clearest open-source expression yet of the Model + Harness = Agent paradigm. The “everything is a plugin” architecture is genuinely different — not a wrapper around a loop, but a composable runtime where the model adapter, the tools, the sandbox, and the UI itself are swappable parts.
It’s a preview, not a production platform — the breaking-changes warning is real, and the ecosystem needs time. But for developers who want to understand where agent engineering is heading, or who want a MIT-licensed harness natively optimized for the cheapest frontier API on the market, dsh is the reference to study. Everything is a plugin — and that’s the future of agent architecture.