DeepSeek Harness: The Open-Source Agent Runtime Where Everything Is a Plugin — The Complete Guide for Agentic AI Architects (2026)

A single GitHub repository crossed 218,000 stars in under four weeks. Not a model, not a chatbot wrapper — an agent harness that treats the model adapter, tools, session store, sandbox, and even the agent loop itself as swappable plugins. DeepSeek Harness (dsh) landed on August 13, 2026, and by September it had become the fastest-growing open-source agent infrastructure project in history.

For Agentic AI Architects evaluating the runtime layer beneath their agents, DeepSeek Harness poses a sharp question: should the harness be a fixed product you extend around the edges (the Claude Code and Codex model), or a composable kernel whose every seam you can replace (the DeepSeek Harness model)?

This guide dissects the architecture, walks through its four operating modes, compares it head-to-head with Claude Code, OpenHands, Codex, and OpenCode, and maps the implications for enterprise RPA teams considering agentic upgrades. Everything cited traces back to the official repository, DeepSeek’s product page, and independent analysis from The New Stack, The Register, and DataCamp.

Table of Contents

• What Is DeepSeek Harness?
• Why It Matters for RPA and Agentic AI Teams
• The Cordis Plugin Architecture, Explained
• Four Operating Modes: Standard, PTC, Minimal, Creator
• The Append-Only Session Log
• Tool Execution Pipeline and Sandboxing
• DeepSeek Harness vs. Claude Code vs. OpenHands vs. Codex vs. OpenCode
• RPA Integration and Enterprise Implications
• Getting Started: Installation and First Run
• Limitations and Security Considerations
• FAQs
• Key Takeaways
• References

What Is DeepSeek Harness?

DeepSeek Harness is an open-source, MIT-licensed agent runtime developed by DeepSeek AI. It is not a model. It is everything that sits between a language model and the real world — the tools, sessions, sandboxing, and control loop that let model reasoning act on a filesystem, run shell commands, search the web, and manage multi-step tasks without losing context.

DeepSeek’s own framing is concise: Agent = Model + Harness. The model handles reasoning and generation. The harness supplies the agency — the ability to act, remember, and iterate.

What makes it architecturally unusual is the tagline: “Everything is a plugin.” The model adapter, tool registry, session store, sandbox, storage layer, scheduling system, the agent loop itself, and even the UI are all Cordis plugins. Any of them can be swapped, extended, or replaced through configuration alone, without touching DeepSeek Harness’s source code.

The repository was created on August 13, 2026. Within two days it had 90,000 stars. By September 2, it had crossed 210,000 (DataCamp). At the time of writing it stands above 218,000 — making it one of the fastest-growing open-source projects ever published on GitHub.

Key Facts at a Glance

Why It Matters for RPA and Agentic AI Teams

The concept of an “agent harness” — a reusable runtime that gives any model the ability to act — is the infrastructure layer that the RPA-to-agentic transition has been missing. Traditional RPA platforms (UiPath, Automation Anywhere, Blue Prism) provide a fixed runtime: the robot runner, the orchestrator, the queue. The model (or the workflow logic) plugs into slots the platform defines. You can extend, but you cannot fundamentally reshape how the runtime works.

More Read

Oracle Fusion Agentic Applications: The Complete Guide to AI Agent Studio and the New Pro-Code Builder (2026)

RPA in Healthcare: Transforming Patient Care

Top 8 Trending Open-Source Agentic AI Repos Worth Starring in 2026

DeepSeek Harness inverts this. The runtime itself is the extensible part. For Agentic AI Architects working inside enterprises that already run classic RPA platforms, this creates a new architectural option: use the harness as a flexible orchestration layer that can invoke RPA bots as tools, while the model adapter, approval pipeline, and session management are tuned for the organization’s compliance and governance requirements.

Over 26,000 enterprises have already integrated DeepSeek APIs into production systems (Panto, 2026). DeepSeek ranked third in enterprise AI market share by early 2026. The Harness is the open-source infrastructure layer that sits beneath all of that adoption.

The Cordis Plugin Architecture, Explained

Cordis is the plugin composition framework that underlies DeepSeek Harness. It originated in the Koishi chatbot ecosystem and was built by a developer known as Shigma. DeepSeek vendors and extends it for agent workloads. Its design is formalized in the academic paper “A Programming Paradigm for Spatiotemporal Composability”.

Understanding Cordis is essential to understanding why DeepSeek Harness feels different from every other agent framework. Here are the three core concepts:

1. Everything Is a Plugin (Including the Loop)

In most agent frameworks, the agent loop — the cycle of receiving input, calling the model, executing tools, and deciding whether to continue or return — is hardcoded. In DeepSeek Harness, it is a plugin. So are the model adapter (ctx.llm), the tool registry (ctx.tools), the session store (ctx.sessions), the sandbox, the storage layer, the scheduling system, and the UI.

Plugins provide every agent capability through Cordis services and events. Developers select, swap, or extend any capability in configuration. The architecture documentation states this directly: “You extend dsh by mounting a plugin beside the others.”

The one exception: Cordis itself is not a plugin. It is the kernel that loads, wires, and manages the plugins. Saying “everything is a plugin” goes slightly too far — there is always a non-pluggable core — but the surface area that is pluggable is vastly larger than in any competing harness.

2. Spatial Composability: Automatic Dependency Resolution

A plugin declares the services it needs without requiring a hand-written boot sequence. Cordis activates it when those services exist and deactivates it if a required service disappears. Dependencies decide when a component can run — developers do not manually arrange startup order.

DeepSeek calls this spatial composability. In practice, it means you can drop a new model adapter plugin into the configuration, and if it satisfies the ctx.llm service contract, everything that depends on ctx.llm picks it up automatically.

3. Temporal Composability: Clean Teardown

Cordis tracks every side effect a plugin produces — event listeners, prompt sections, tool schemas. Removing a plugin removes those effects cleanly, without leaving orphaned listeners or dangling registrations. This applies to effects Cordis tracks; it does not undo external actions like shell commands already executed.

For Agentic AI Architects, temporal composability means you can hot-swap plugins mid-session for testing without restarting the entire runtime. In Claude Code or Codex, changing the tool registry or session store requires restarting the process.

Four Operating Modes: Standard, PTC, Minimal, Creator

DeepSeek Harness ships with four presets that control what the agent can access and how it reaches those capabilities. None outranks the others — they answer different questions about how much of the runtime should be exposed to a given session.

Standard Mode

The general-purpose coding agent. Full filesystem tools, shell access, web search, skills, planning, goals, subagents, and workflows. This is where most users start and where the Harness most directly competes with Claude Code and Codex.

PTC Mode (Programmatic Tool Calling)

Keeps nearly all of Standard’s toolset but changes how the model reaches it. Instead of issuing individual tool calls across multiple model steps, the model writes a program against a generated SDK, calling multiple tools through run_code. Every call still passes through the same policy checks — PTC changes the plan’s representation, not what is permitted.

The product page originally called this “Code mode.” A later release renamed it to PTC mode while keeping old session records readable. The acronym likely stands for “programmatic tool calling,” though DeepSeek has not published a canonical expansion (DataCamp).

Minimal Mode

Strips the agent to exactly two tools: a persistent shell and a string-replace file editor. DeepSeek uses this for model benchmarking — because benchmark scores partly reflect the harness, not only the model’s weights. Running evaluations in Minimal mode removes harness-contributed advantages and isolates model capability.

This is a critical insight for the broader agentic AI community: your agent’s performance is a joint function of model capability and harness capability. Changing either changes the result. Minimal mode gives you a way to measure the model in isolation.

Creator Mode

A development and inspection mode that lets developers probe the runtime and test Cordis plugins in memory. It is for building custom presets and studying how the agent loop assembles — not for end-user coding tasks.

The Append-Only Session Log

This is arguably the most architecturally significant feature in DeepSeek Harness, and the one most likely to influence how other agent runtimes evolve.

A session in DeepSeek Harness is not an array of chat messages. It is an append-only log of typed events: system prompts, reasoning traces, tool calls and results, subagent scheduling, context injections, and every other interaction. The session documentation requires that anything sent to the model must be recoverable from this log.

Five capabilities build on the event stream:

For enterprise agentic deployments — where auditability and explainability are non-negotiable — this event log architecture is a major differentiator. It provides a complete, inspectable record of every decision an agent made, which tools it used, and what data it saw. Compare this to a typical chat-based session history where you see messages but not the intermediate reasoning or tool execution context.

Re-deriving history from the log is not a deterministic re-run — model output and external state can differ on replay — but the log itself provides an immutable record of what actually happened.

Tool Execution Pipeline and Sandboxing

When a model requests a tool, it does not get to run it directly. Two separate controls stand between the request and any filesystem or network change:

The Tool Execution Pipeline

Every tool call passes through three stages:

1. Pre-execution policy check — Does the current permission preset allow this tool? Does the user need to approve it?
2. Execution — The tool runs within the sandbox constraints.
3. Post-processing — Results are filtered, sanitized, and fed back to the model.

The model chooses the tool; the runtime decides whether and how it runs. This separation is what makes the harness an actual governance layer rather than just a convenience wrapper.

Sandboxing vs. Approvals

DeepSeek keeps these two concerns explicitly separated:

• Approval asks whether the user should confirm an action.
• Sandboxing limits where and how it executes.

Permission presets bundle both controls together for convenience, but the underlying architecture keeps them independent. This mirrors how container runtimes separate process permissions from execution boundaries — and it is the right architectural choice for enterprise deployments where security policy and user experience are managed by different teams.

An important caveat: telling a model in a system prompt to “only read files” is a suggestion it can follow, not an enforced boundary. OS-level sandbox restrictions enforce behavior; prompt instructions do not. The safety notice is explicit that the project has not undergone a security audit.

DeepSeek Harness vs. Claude Code vs. OpenHands vs. Codex vs. OpenCode

A feature checklist misses the point. Each competitor supports extensions; the question is which parts developers can replace. Here is the architectural comparison that matters:

The Key Distinction

Claude Code, Codex, and OpenCode all follow the “fixed core, extensible periphery” pattern — you can add tools, skills, and integrations, but the agent loop, session management, and model adapter are not yours to change. DeepSeek Harness follows the “composable kernel” pattern — the periphery and the core are both pluggable.

Neither pattern is universally better. Fixed-core harnesses are easier to adopt and harder to break. Composable-kernel harnesses give you more control and more responsibility. The right choice depends on whether the runtime itself is part of your engineering work, or just the platform your engineering work runs on.

As the DataCamp comparison puts it: “Use DeepSeek Harness when the runtime itself is part of the work. If you only need repository edits, a ready-made coding agent asks less of you” (DataCamp).

Interoperability: Harness Can Drive Claude Code

One detail worth highlighting for multi-vendor shops: DeepSeek Harness registers a subagent provider whose default name is claude-code. Each accepted run invokes the official Claude Agent SDK in the delegating session’s workspace. In other words, Harness can orchestrate Claude Code as a subagent — you do not have to choose one or the other for every task (AgentConn).

RPA Integration and Enterprise Implications

For enterprise teams running UiPath, Automation Anywhere, or SS&C Blue Prism, DeepSeek Harness introduces a new architectural layer worth evaluating. Here is how it fits into existing RPA estates:

Agent-as-Orchestrator Pattern

The traditional RPA pattern is orchestrator → robot → task. The agentic pattern adds a reasoning layer: agent → orchestrator → robot → task. DeepSeek Harness can serve as the agent layer, invoking RPA bots as tools through its plugin system. The tool execution pipeline provides approval gates, and the session log creates an audit trail.

Integration is already production-ready through platforms like Workato, which offers connectors for DeepSeek + Power Automate Desktop Flow and DeepSeek + Workato RPA.

Governance Through Plugin Boundaries

The plugin architecture maps well to enterprise governance requirements. The approval plugin can enforce human-in-the-loop for high-risk actions. The sandbox plugin can restrict filesystem access to specific directories. The session log provides the audit trail that compliance teams need. And because each of these is a replaceable plugin, the security team can implement organization-specific policies without forking the entire codebase.

Multi-Model Strategy

Because the model adapter is a plugin, enterprises can use different models for different task types — DeepSeek for cost-sensitive batch work, Claude for complex reasoning tasks, a local model for sensitive data processing — all within the same harness instance, with the same tools, sessions, and governance policies.

This aligns with the broader industry trend toward the A2A protocol and the Agentic AI Foundation’s open agentic stack, where interoperability between agents and models is a first-class design requirement.

Getting Started: Installation and First Run

DeepSeek Harness runs on Node.js. The fastest path to a running instance is a single command:

npx @deepseek-ai/dsh web

This starts the Web UI at http://127.0.0.1:3080 by default.

Running from Source

git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build
pnpm dsh web

Model Configuration

Out of the box, DeepSeek Harness connects to DeepSeek’s own models. To use Anthropic (Claude), OpenAI, or any OpenAI-compatible endpoint, configure the model adapter plugin with the provider’s API key and endpoint URL. The Web UI guide covers the configuration details.

Plugin Discovery

Community plugins use the dsh-plugin GitHub topic for discoverability. The plugin ecosystem is young but growing rapidly — expect the same kind of community expansion that MCP servers experienced after the Model Context Protocol’s initial launch.

Limitations and Security Considerations

Before adopting DeepSeek Harness for anything beyond experimentation, these constraints must be understood and accepted:

Developer Preview Status

DeepSeek’s repository states plainly: “THERE WILL BE COMPATIBILITY-BREAKING CHANGES.” This has already happened — the Code-to-PTC mode rename came with changes to session APIs and removal of optional SQLite storage. Pin your versions. Do not depend on API stability.

No Security Audit

The SAFETY.md file is explicit: the project has not undergone a security audit. A runtime that can edit files, run shell commands, and load third-party plugins can cause real damage. Use limited permissions and a disposable environment for untrusted work.

Complexity Cost

Making more of the runtime replaceable means more for developers to learn: plugin dependencies, Cordis service contracts, settings layering, provider differences, and version compatibility. The flexibility is the complexity. If your team just needs a coding agent that works, a fixed-core harness like Claude Code has a significantly lower adoption cost.

Data Residency Nuances

DeepSeek Harness stores session content, tool records, and settings locally by default, per its data processing statement. But an external model provider, web tool, MCP server, or third-party plugin can still send data outside your machine under its own policy. “Local-first” does not mean “air-gapped.”

Frequently Asked Questions

Is DeepSeek Harness the same as a DeepSeek model?

No. The model and runtime are separate layers. Harness does not include model weights or run inference itself — it sends requests to DeepSeek, Anthropic, OpenAI, or any OpenAI-compatible endpoint. Think of it as the operating environment that a model runs inside, not the model itself.

Can I use DeepSeek Harness with Claude or GPT-4?

Yes. The model adapter is a plugin. You configure the provider endpoint and API key, and the same harness, tools, sessions, and governance policies work regardless of which model answers the requests.

How does DeepSeek Harness compare to LangGraph or CrewAI?

LangGraph and CrewAI are agent frameworks — libraries for building agent logic in Python. DeepSeek Harness is an agent runtime — a running system that provides the full execution environment. They operate at different levels of the stack. You could, in principle, build a Harness plugin that uses LangGraph internally for its agent loop.

Is DeepSeek Harness production-ready?

No. It is explicitly in developer preview with expected breaking changes and no security audit. It is ready for evaluation, prototyping, and internal tooling. Production deployments should wait for a stable release and a completed security review.

What does the dsh-plugin ecosystem look like?

Young and growing. The dsh-plugin topic on GitHub is the community’s discovery mechanism. Given the project’s velocity (218k+ stars in four weeks), plugin development is accelerating rapidly — similar to the early MCP server ecosystem after Anthropic’s launch.

Key Takeaways

• DeepSeek Harness is an agent runtime, not a model. It provides the tools, sessions, sandboxing, and control loop that let any compatible model act on the real world.
• “Everything is a plugin” is architecturally radical. The model adapter, tool registry, session store, sandbox, agent loop, and UI are all swappable Cordis plugins — a level of composability no competing harness offers.
• The append-only session log is the killer feature for enterprise adoption. Resume, fork, search, replay, and trajectory visualization all build on a complete, inspectable event record — exactly what compliance and audit teams need.
• 218,000+ GitHub stars in under four weeks makes it the fastest-growing open-source agent infrastructure project in history.
• It is NOT production-ready. Developer preview, no security audit, breaking changes expected. Evaluate and prototype now; deploy later.
• For RPA teams: DeepSeek Harness can serve as the agentic orchestration layer above existing RPA infrastructure, invoking bots as tools with governance controls baked into the plugin architecture.
• Multi-model support via plugin architecture enables cost-optimized routing: use different models for different task types within the same runtime instance.

References

1. DeepSeek AI. “DeepSeek Harness: Everything is a Plugin.” GitHub Repository, August 2026. https://github.com/deepseek-ai/deepseek-harness
2. DeepSeek. “DeepSeek Harness Developer Preview.” Product Page, 2026. https://deepseek.com/harness/en/
3. Lardinois, Frederic. “DeepSeek open sources an agent harness where everything is a plugin.” The New Stack, August 13, 2026. https://thenewstack.io/deepseek-harness-open-source-plugins/
4. The Register. “DeepSeek’s innovative harness treats everything as a plug-in.” August 14, 2026. https://www.theregister.com/
5. Abdelaty, Khalid. “What Is DeepSeek Harness? The Agent Runtime Where Everything Is a Plugin.” DataCamp, September 8, 2026. https://www.datacamp.com/blog/what-is-deepseek-harness
6. DataCamp. “DeepSeek Harness vs. Claude Code: What Changes With the Same Model?” 2026. https://www.datacamp.com/blog/deepseek-harness-vs-claude-code
7. Wavect. “DeepSeek Harness Review: Production Readiness.” 2026. https://wavect.io/blog/deepseek-harness-enterprise-review/
8. Cordiverse. “A Programming Paradigm for Spatiotemporal Composability.” arXiv, 2026. https://arxiv.org/abs/2608.25512
9. AgentConn. “Inside DeepSeek Harness: A Kernel, Not a Rival.” 2026. https://agentconn.com/blog/deepseek-harness-plugin-architecture/
10. Panto. “DeepSeek AI Statistics 2026: Users, Adoption and Revenue.” 2026. https://www.getpanto.ai/blog/deepseek-ai-statistics
11. Habr. “Inside DeepSeek Harness: Cordis, Session Events, Tool Pipelines, and Permission Boundaries.” 2026. https://habr.com/en/articles/1070958/

This article is part of RPABOTS.WORLD’s coverage of the open-source agentic AI ecosystem. For more on how agent protocols and standards are evolving, see our guide to A2A joining MCP at the Agentic AI Foundation, and for how classic RPA platforms are responding, see our 2026 Agentic Platform Showdown.