DeepSeek Harness Open-Sourced: Everything as a Plugin
Today, just hours after the official release of DeepSeek V4 Pro, DeepSeek unveiled DeepSeek Harness — a groundbreaking open-source developer preview framework for building, running, and extending AI agents.
Long anticipated — with early teasers and team recruitment efforts led by Tongyi Cui (DeepSeek Harness team) — Harness represents a paradigm shift in agent architecture: not another “smart coding assistant”, but a composable, extensible runtime system for intelligent agents.
We gained early access in early August and have since explored its capabilities — from game development to 3D animation generation — confirming its potential to redefine AI tooling ecosystems.
First Impressions: From Concept to Working Agent
Harness empowers developers to build fully autonomous agents without manual intervention. In one test, we configured it with DeepSeek-V4-Flash and instructed it to build a first-person zombie shooter — resulting in a playable prototype in under 30 minutes:
We also benchmarked its reasoning + execution fidelity using the viral “Huaqiang Bu Gua” (Huaqiang Buys Watermelon) prompt — generating a 3D animation from text description in a single shot:
Compared to a similarly prompted GPT-5.6 sol-xhigh-powered Codex implementation, Harness delivered superior narrative coherence and character relationships — despite V4-Flash’s significantly smaller parameter count. This highlights Harness’s architectural advantage over raw model scale.
Upgrading to DeepSeek V4 Pro further improved output quality:
Architecture: A Modular “Hole-Punched Board”
Harness’s repository already hosts 230+ workspace members, organized across modular domains:
packages/— Core services (LLM adapters, shell, filesystem, LSP, web, skills, subagents, workflows)apps/,examples/,python/,native/,vendor/,website/
💡 Think of traditional agents as pre-built computers. Harness is more like a massive breadboard: models, tools, UIs, storage, security policies, and context managers are all pluggable components — swappable, composable, and independently maintainable.
Its default configuration delivers an out-of-the-box agent — but its true ambition lies deeper: to standardize how agents are assembled, not just what they do.
What Is DeepSeek Harness?
Harness is neither a new LLM nor an API wrapper. It is a:
✅ SDK + application framework for building intelligent agents.
✅ Runtime orchestrator that connects models to file systems, shells, editors, browsers, and other agents.
✅ Interaction layer supporting Web UI, full-screen TUI, headless CLI, and automation protocols (ACP/JSON-RPC).
It provides built-in model routing (with seamless swap to non-DeepSeek LLMs), project-aware editing, command execution, task delegation, and multi-modal user interaction — all governed by a unified event-driven lifecycle.
The “Harness” Metaphor
Like physical harnesses — which channel power without losing control — Harness bridges raw model intelligence to real-world action while enforcing accountability, safety, and observability.
It answers critical questions:
– Can a command be safely canceled mid-execution?
– How do tool results affect context integrity?
– Where should user messages injected mid-turn be routed?
– How is session state rebuilt exactly as the model saw it?
Harness treats each as a formalized system capability, not an afterthought.
Design Principle: Everything Is a Plugin
Harness’s most radical idea: “Everything is a plugin” — including the agent loop itself.
Built atop the Cordis microkernel, every Harness instance is a Cordis Context. Packages register services, events, and capabilities; configuration (cordis.yml) composes them into functional agents.
Core Packages Breakdown
| Package | Responsibility |
|---|---|
packages/core/ |
Session management, system prompts, tool registry, agent creation, agent loop logic |
packages/llm/ |
Model adapters & streaming I/O |
packages/shell/, packages/subprocess/, packages/terminal/ |
Command execution, process trees, persistent terminals |
packages/fs/ |
Secure file read/write/search with policy enforcement |
packages/lsp/ |
Semantic code navigation via language servers |
packages/web/ |
Search & web scraping |
packages/skill/ |
Reusable skill modules |
packages/subagent/, packages/workflow/ |
Multi-agent delegation & orchestration |
Beyond infrastructure, even planning, goals, tasks, background jobs, context compression, credential management, and telemetry are decoupled — reflecting strict interface-boundary discipline.
Three-Layer Capability Model
Harness structures functionality as:
– Interface: What the capability does (e.g., “execute command”)
– Implementation: How it’s done (e.g., spawn local process)
– Consumer: How the model uses it (schema + result parsing)
This enables clean swapping — e.g., replacing local Bash with cloud sandbox or enterprise executor — without rewriting tool schemas or agent logic.
cordis.yml: Declarative Agent Assembly
Agent behavior is defined in cordis.yml — a YAML config listing plugins, IDs, and parameters:
plugins:
- id: deepseek-llm
package: packages/llm/deepseek
config: { apiKey: "${DSH_API_KEY}" }
- id: fs
package: packages/fs
config: { root: "./workspace" }
- id: bash
package: packages/shell
Same codebase → different products:
– Terminal agent: llm + fs + bash + tui
– Web app: Swap tui → web-ui
– CI automation: Use headless entrypoint → runs once, exits cleanly
– Microservice: Expose via ACP or JSON-RPC
Config supports overlays (TUI/Web share base config + interface-specific layers) and runtime expressions (!!js process.env.DEEPSEEK_API_KEY). Credentials are never hardcoded — stored separately in $DSH_HOME/.credentials.yaml or .env.
Agent Loop: Not a Loop — A Traffic System
Harness replaces the naive prompt → tool → repeat cycle with a rigorous, observable turn-step-event lifecycle:
- Turn: A user-initiated interaction
- Step: One model request + optional tool execution(s)
- Events: System prompt assembly, streaming chunks, tool calls/results, cancellation reasons — all emitted to a unified event stream
📌 The zombie shooter ran 3 turns, 127 steps.
Tools undergo a full pipeline: pre-check → security guard → execution → post-processing → result notification. Concurrency is explicitly declared (e.g., safe-for-parallel-read tools), and unsafe operations act as execution barriers.
Crucially, Harness tracks where user messages land — ensuring steering instructions are verifiably injected into the correct model request, not merely “received”.
Session Log: The Single Source of Truth
All model-visible state is reconstructible from the append-only session log, which records:
– User messages & environment context
– Model requests & streaming outputs
– Tool calls, results, permission switches, compression events, cancellation reasons
Interfaces, persistence, replay, fork/resume, and telemetry all derive from this same event source — eliminating state drift and enabling precise debugging, auditing, and evaluation.
From One Agent to Many: Subagents & Workflows
Harness natively supports hierarchical agent systems:
- Main agents delegate to subagents, created fresh, forked from history, or connected via ACP
- Each subagent has isolated scope: tools, prompts, and permissions
- Workflows script multi-step, structured collaboration — integrating goals, plans, todos, and background jobs as distinct lifecycle states
🧩 The zombie shooter spawned 5 parallel subagents.
Interfaces: Web, TUI, Headless & SDK
Harness ships four primary interfaces — all sharing core logic:
| Interface | Use Case |
|---|---|
Web UI (http://localhost:3080) |
Interactive development with sidebar, permissions, plan mode, tool cards |
| TUI | Terminal-native experience for CLI lovers |
| Headless | Scriptable, single-task mode (ideal for CI/CD) |
| ACP / JSON-RPC / Python SDK | Programmatic control — launch sessions, send tasks, receive notifications |
Four Preconfigured Agent Modes
| Mode | Capabilities | Ideal For |
|---|---|---|
| Standard | Full toolset: file editor, shell, search, skills, planning, subagents, workflows | General development |
| PTC (Program-Then-Call) | Adds TypeScript-based run_code tool — reduces round trips for complex pipelines |
Long-chain automation |
| Minimal | Only bash + str_replace_editor — minimal context overhead |
Direct, path-clear coding tasks |
| Creative | Enables runtime plugin inspection, dynamic mounting/unmounting, preset authoring | Advanced users & agent R&D |
In Creative Mode, we extended the official Web UI to create a custom three-column layout — demonstrating true runtime composability:
Self-Inspecting & Self-Modifying Agents
Harness includes self-referential Cordis tools, accessible only in Creative Mode:
– Inspect current plugin tree
– Dynamically mount/unmount temporary plugins
– Register new tools or listeners at runtime
While powerful, this capability is gated — requiring explicit opt-in and operating within Cordis’s effect-scoped lifecycle (ensuring cleanup). It signals Harness’s north star: agents that don’t just use tools — but reconfigure their own runtime.
For deeper insight, see the companion paper: A Programming Paradigm for Spatiotemporal Composability
Security: A System-Wide Constraint
Harness treats security as a cross-cutting system property, not a UI toggle:
- Default
workspace-writemode restricts FS/shell to allowed directories askapproval strategy enforces human consent for privilege escalationdanger-full-accessexists but requires explicit deployment opt-in- Tools pass through unified policy guards — no “shell bypass via file tool”
- “Fail-closed” principle: if isolation can’t be verified, execution halts
- All permissions, approvals, and failures are logged for auditability
Beyond Another Codex
Harness isn’t aiming to be “DeepSeek’s version of GitHub Copilot”. Its architecture reveals a deeper mission:
🔑 Models define intelligence ceiling. Harness defines how that intelligence enters reality — reliably, auditably, and sustainably.
Default apps are important — but they’re merely the first customer of the SDK. The real innovation lies in:
– Replaceable capability interfaces
– Event-driven, observable lifecycles
– Authoritative session logs
– Declarative composition
For enterprises, this means deployable, auditable, upgradable, and model-agnostic agent infrastructure — far beyond chat UI polish.
Harness is still evolving — but its technical vision is already complete, public, and actionable. Its greatest value may not be what it does today, but how transparently it reveals DeepSeek’s engineering answer to the agent problem.
🔗 Official Resources
– GitHub Repository
– Cordis Paper
Article adapted from Machine Heart (Ji Qi Zhi Xin).