Why is DeepSeek's Harness a black whale?

On the evening of August 13 Beijing time, DeepSeek opened the DeepSeek Harness Developer Preview to global developers, and open-sourced its source code under the MIT license.

Different from the model weight releases that the public are more familiar with, what DeepSeek open-sources this time is a complete set of Agent operation infrastructure outside the model. Models, tools, skills, sessions, sandboxes, storage, Agent loops, task scheduling and user interfaces can all be loaded, unloaded and replaced as plugins.

DeepSeek summed up this architecture with a highly memorable phrase: Everything is a plugin.

It is worth noting that DeepSeek has also opened a separate WeChat Official Account for Harness, named "DeepSeek Harness Team". This account uses a black whale as its logo, which is clearly distinct from the blue whale used for DeepSeek's model products.

Behind this independent brand differentiation, DeepSeek may hope to build an independent developer communication channel for Harness, and continuously operate the ecosystem around it. Whether a model can continuously complete tasks in the real environment increasingly depends on the system outside the model: what context it sees, what tools it can call, how it handles failures, whether it can resume tasks, who approves high-risk operations, and how to avoid deviating from the target after long-running operations. Harness is exactly the operation layer responsible for connecting the model with these capabilities.

DeepSeek Harness allows developers to reassemble Agents like building blocks, and it also extends DeepSeek's open source boundary from models to the Agent engineering system.

01

Beyond Model Capabilities, Why Do We Still Need Harness

The large language model itself is only responsible for generating the next step of content. An Agent that can read and write files, run commands, call external services, dispatch sub-Agents and continue working based on execution results also requires a continuously operating control system.

Anthropic once summarized the basic unit of Agent as a large language model enhanced by retrieval, tools and memory. When it comes to long-term tasks, Harness is also responsible for context management, permission control, state persistence, error recovery and loop termination conditions. When discussing hosted Agents in April 2026, Anthropic further pointed out that Harness embodies developers' judgments on "what the model itself cannot do", and these judgments will become obsolete as model capabilities improve.

This points out a long-term contradiction in Harness design: the framework needs to provide sufficient control without restricting the model with overly rigid processes.

This also explains why DeepSeek emphasizes replaceability. When the same model is placed in different Harnesses, its final performance may show significant differences. How the system prompt is organized, whether the tool definition is clear, when the context is compressed, and whether retries are allowed after failures will all affect task success rate, token consumption and running time.

As model evaluation gradually shifts from single-round Q&A to real engineering tasks, Harness itself has become an evaluation variable.

At present, multiple technical routes have gathered at this layer. OpenAI Agents SDK provides tools, Agent handoff, guardrails, sessions and tracing; Claude Agent SDK opens up the tools, Agent loop and context management used by Claude Code; LangGraph focuses on persistent execution, human intervention and state recovery. DeepSeek Harness enters a market with mature existing participants, and its differentiation direction is to further split these capabilities into plugins that can be combined through configuration.

02

Everything Is a Plugin?

DeepSeek Harness is built on top of the Cordis plugin system. According to official documentation, model adapters, tool registries, session logs and even the Agent loop itself are all plugins. Developers do not need to modify the main code of Harness, and can replace or extend specific capabilities through plugins.

Cordis calls this capability "spatiotemporal composability". The "time" here means that after a plugin is unloaded, the services, events and side effects it registered can be revoked accordingly; the "space" means that plugins can declare dependencies and re-establish collaborative relationships when other components change.

The Cordis paper made public on August 13 is still marked as a preprint under continuous revision, and its implementation includes side effect tracking, dependency resolution, configuration coordination and hot updates. Obviously, the scenario targeted by this design has extended from the traditional plugin system to a "self-evolving Agent Harness".

For developers, this split brings three types of direct value.

First, the model and the operating environment can be separated. Developers can keep the same set of sessions, tools and permission systems, and only replace the model adapter; or they can fix the model and compare the effects of different context management or Agent loops. For model evaluation, this helps to distinguish whether the capability improvement comes from the model itself or external engineering optimizations.

Second, enterprises can retain their own infrastructure. Sandboxes, storage, approval, credentials and telemetry can all exist as plugins, which can theoretically integrate with internal permission systems and audit requirements, reducing the degree of lock-in by a single Agent product.

Third, Agent capabilities can form an independent ecosystem. Developers do not need to maintain a forked version of DeepSeek Harness, they only need to publish plugins. The official has recommended adding the "dsh-plugin" tag to the plugin repository, an arrangement that helps gradually form a searchable and reusable plugin ecosystem.

This design also transfers risks to the plugin system. A tool plugin can access files and external services, a storage plugin holds complete sessions, and a loop plugin may change the Agent's decision path. Plugin source verification, permission boundaries, dependency conflicts, version compatibility and supply chain security will all become prerequisites for the ecosystem to enter the production environment. The higher the degree of openness, the higher the governance cost.

03

Four Modes, Which Are Essentially Four Agent Experiment Methods

Official documents divide the preset operation modes of DeepSeek Harness into four types: Standard, PTC, Minimal and Creative. They load different plugin combinations and correspond to different development purposes.

The Standard mode provides a relatively complete set of tools for daily Agent tasks. The Minimal mode only retains Shell and file editing tools, which is mainly used for benchmark testing. It minimizes the differences of peripheral tools, making the evaluation closer to a direct observation of the model's autonomous planning, code modification and terminal operation capabilities. The benchmark instructions in the official repository currently only explain how to run the minimal variant of jsonrpc-agent, and have not released the comparison results between DeepSeek Harness and other Harnesses.

The PTC mode adopts Programmatic Tool Calling. The model first generates a piece of code, which then organizes multiple rounds of tool calls. For tasks that require continuous query, batch processing or branching based on intermediate results, this method can reduce repeated back-and-forth between the model and tools, and may also reduce the accumulation of intermediate information in the context. However, the code generated by the model gains stronger scheduling capabilities, which also puts forward higher requirements for sandbox isolation, timeout, resource quota and permission control. The value of PTC ultimately needs to be verified by task success rate, cost and security incidents.

The Creative mode is the most experimental. The Agent can inspect the current runtime, test Cordis plugins in memory, and then combine new operation modes.

The official development documentation already provides a "self-referential" Cordis demo, which allows the Agent to inspect and modify the running plugin environment. This leaves an interface for Harness self-adjustment, but there is still a long engineering path before it reaches stable "self-evolution".

04

Turn Every Run Into a Replayable Event Stream

Another important design of DeepSeek Harness is the append-only session log.

A Session consists of sequentially appended events, which is the single source of truth for the entire interaction history of the Agent. The model message history is derived from this log and is no longer stored separately; recovery and replay are also reconstructed from the same set of events.

According to official documentation, system prompts, chain of thought, tool calls and their results, sub-Agent scheduling and context injection will all be recorded, and can be viewed by source in the Trajectory view; how complete the reasoning content that can be displayed still depends on the actual data returned by the specific model interface. The value of doing this is very straightforward: when the Agent makes a wrong decision at the dozens of steps, developers can go back to the context that the model actually saw at that time, to confirm whether the problem comes from model judgment, tool return, prompt change or incorrect context injection. OpenAI Agents SDK and LangGraph also regard tracing, persistence and recovery as important capabilities of the Agent runtime, indicating that observability has evolved from a debugging tool to a standard component of Agent infrastructure.

Append-only logs will also bring new data governance issues. The complete event stream may contain code, credential clues, internal file content and tool return results. Replayability improves auditability, but also expands the data surface that needs to be protected.

05

It Is at a Different Level From MCP

"Everything is a plugin" easily reminds people of MCP. The problems they solve are not the same.

MCP is an open standard that connects AI applications with external data, tools and workflows, focusing on unifying connection methods. Harness is responsible for the upper-layer operation logic: when to hand over tools to the model, whether approval is required before calling, how to write results to the session, whether to retry after failure, when the Agent dispatches subtasks, and under what conditions it stops.

Therefore, MCP servers can become the source of tools in DeepSeek Harness, Skills can become capability packages, and Cordis plugins are responsible for combining models, tools, states, loops, interfaces and policies into a runnable Agent, that is, the control layer of "how the Agent runs".

This position has potential ecosystem value. Whoever controls Harness is closer to the entry point of real tasks, and can more easily influence model selection, tool distribution, operation costs and developer workflows. However, the MIT license can only lower the adoption threshold, and cannot automatically form an ecosystem. Whether developers are willing to continuously maintain plugins, whether enterprises dare to grant production permissions to third-party components, and whether plugins can run stably across versions will determine how far this architecture can go.

06

v0.1 Is Still a Design Blueprint

DeepSeek has given a very clear reminder of the version status: it is currently in the developer preview stage, and there will be breaking changes that damage compatibility in the future. As of press time, the version marked in the package.json in the root directory of the repository is 0.1.0-rc.5, and the GitHub Releases page is still empty. To be more precise, it is currently in the candidate and fast iteration stage of the v0.1 series.

After developers install Node.js, they can start the Web interface through npx @deepseek-ai/dsh web, with the default address http://127.0.0.1:3080; they can also clone the source code from DeepSeek's official repository for installation. The official development documentation currently requires Node.js 22.19 and above in the 22.x version, or 24 and above.

From the installation process, the deployment threshold of DeepSeek Harness is not high, and Agents that can operate terminals and files such as WorkBuddy can also be used to assist in completing Node.js environment check, installation and startup.

It should be noted that although Harness itself is open source for free under the MIT license, the official default usage still requires configuring the DeepSeek API Key; users can open the Web UI for free, but actually running the Agent will incur model invocation costs.

DeepSeek Harness has advanced the open source competition beyond models. Open weights solve the problem of "who can run the model", and open Harness further touches on "who can decide how the model works".

When Agents start to perform tasks that last for hours or even days, the model is only one component in the system, and the operation layer will increasingly determine the upper limit of capabilities and usage boundaries.

"Everything is a plugin" gives developers more room for modification, and also makes DeepSeek take on a more difficult ecosystem mission.

This article is from the WeChat Official Account "Tencent Tech", written by Xiao Jing, edited by Su Yang, and published with authorization from 36Kr.