An agent runtime, not another chat panel
DeepSeek Harness is easier to understand as a kit for assembling agents than as a finished coding assistant. The default dsh web command gives you a browser interface, sessions, model selection, workspaces, tools, plans, delegation, and approval prompts. A headless profile removes the server, while a Python SDK can start a bundled runtime from an application.
That range matters because teams often outgrow one chat interface. Harness puts browser, programmatic, and automation surfaces over the same composition system instead of rebuilding the model and tool loop for each integration.
A new Web UI cannot send a message until you save a model credential and select a workspace. The agent can then read and edit files, run commands, maintain a plan, and delegate tasks. This is a real working environment, not merely a visual client for DeepSeek's chat endpoint.
Plugins are the product
The main reason to consider Harness is Cordis, the framework underneath it. Model adapters, tool registration, persistence, sandbox policy, session logs, the Web UI, and even the agent loop are plugins. Profiles stack ordered bundles, and later configuration layers can replace earlier rows. Registrations are reversible effects, so a plugin can unload cleanly, while configuration edits can hot-replace an instance.
That is more substantial than a folder of optional commands. A team can add a tool, supply a service, replace a provider, or distribute an npm bundle that modifies a profile. The tutorials explain schemas, dependency injection, cleanup, packaging, and installation.
The included integrations show the architecture's reach. Catalog entries cover providers such as DeepSeek, Anthropic, and OpenAI, plus cloud-specific authentication and custom OpenAI-compatible endpoints. The MCP client connects through stdio or streamable HTTP, namespaces discovered tools, refreshes changed tool lists, and retries lost connections. Optional providers can hand a standalone task to locally installed Claude Code or Codex and return the final answer to the parent agent.
The cost is conceptual weight. Profiles, bundles, Cordis patches, services, providers, consumers, and ordered layers are a lot to learn if all you wanted was a coding chat. Harness pays off when you expect to change the runtime itself.
A quick trial hides a serious build
For the standard browser path, the README's simplicity is fair. Run npx @deepseek-ai/dsh web, visit the printed local address, enter a DeepSeek key, and choose the directory the agent may work in. Other catalog providers can be added from the Models page, and stored keys are write-only in the interface. The root source package declares Node 22.19 or newer in the 22 line, or Node 24 and later.
Building from source is different. The large TypeScript monorepo uses pnpm 11, separate host and client builds, a web build, generated catalogs, and native sandbox components. A GitHub-installed TypeScript plugin must ship a prepare build, and pnpm 10 or newer requires users to approve that install-time script. The project calls this a trust decision and recommends pinning a commit.
The Python SDK lowers integration friction on supported Linux and Apple Silicon macOS systems, but its minimal example is unsafe for ordinary host use. It exposes persistent Bash and a file editor through danger-full-access, stores uncompressed JSONL session logs, and warns users to choose a disposable checkout or container. Windows is not supported by that starter composition.
Safety and compatibility need careful reading
Harness has approval and filesystem sandbox layers, but their boundary matters. Sandbox modes govern file effects, not network access or process visibility. Linux can use bubblewrap or Landlock, macOS uses Seatbelt, and Windows uses an ACL restricted-token backend. Older Landlock versions and parts of the Windows boundary report only partial enforcement. Treat container or remote isolation as a separate choice.
MCP support is narrower than the headline may suggest. It bridges tools, but not MCP Resources or Prompts. Text results reach model context, while images, audio, and resources become placeholders there, even though structured data remains available locally during execution. An unresponsive server can hold initial synchronization for the SDK's 60-second default because the bridge exposes no separate startup timeout.
Claude Code and Codex delegation is one-shot. Each run gets a fresh child process or query, no parent conversation, no continuation, no progress stream, and no rollback of side effects after cancellation. The host must already have the product installed and authenticated. Human interaction is unavailable, so approval or input requests fail or are denied rather than pausing for a person.
Too new for a production reputation
The repository was pushed on August 13, 2026, the same day its public history shows the 0.1.0-rc.5 package update. GitHub reports no release, and both the open and all-state issue endpoints return no issues or pull requests. The contribution guide says the team currently does not accept external pull requests and asks users to report bugs through Discussions.
Those facts do not make the project inactive. The commit history, tests, documentation, and early star interest are substantial. They do mean there is no public evidence yet for response times, release cadence, upgrade reliability, or how maintainers handle outside fixes. Popularity this early is not operational maturity.
Harness is worth testing if its replaceable architecture solves a problem you already have. For a stable everyday coding assistant, Cline, OpenCode, or OpenHands is the safer first comparison. For teams building their own agent platform, Harness offers unusually capable raw material, provided they can absorb breaking changes and audit every permission boundary.