DeepSeek ships an agent harness where even the model is a plugin

DeepSeek made its name giving away model weights that punch above their price. Now it is shipping the software around those weights. The developer preview of DeepSeek Harness, published on GitHub, ships as an open-source agent runtime whose pitch fits in four words: everything is a plugin.

DeepSeek's own framing is blunt. "The model is the soul of an agent," the preview reads. "A harness lets an agent understand its environment, use tools, and keep working in real-world settings." The release is the company's attempt to own that second sentence.

Four runtime modes, one plugin kernel

Setup is minimal: install Node.js, run npx @deepseek-ai/dsh web to launch the web UI, or git clone https://github.com/deepseek-ai/deepseek-harness for the full source. Underneath sits the Cordis kernel, which manages plugin mounting, unmounting, and dependencies. Everything an agent touches is a plugin: models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and the UI itself.

According to the preview documentation, the four runtime modes break down like this.

Everything is a plugin: a different kind of leverage

The tagline sounds like marketing until you look at what it targets. Developers can select, swap, or extend any capability in configuration without touching DeepSeek's source code. Want a different model provider? Swap the model plugin. A stricter sandbox? Replace the plugin. The harness stops being a product you adopt and becomes a chassis you rebuild.

Plugin ecosystems are spreading through agent tooling. Alibaba's workplace agent platform, for example, includes a plugin marketplace with a no-code entry point for packaging a senior practitioner's methods into a shareable plugin. DeepSeek's version goes further on one axis: the model binding is a plugin too, so the harness does not care whose weights you plug into it. That neutrality has implications for who ends up owning agent workflows, a question Alibaba's own 16-day autonomous coding run has already forced into the open.

Why a model maker is shipping infrastructure

DeepSeek built its reputation on efficient open weights. It bets on sparse mixture-of-experts architectures that fire up only a fraction of a model's parameters per token, and its own paper on the V4 series is blunt about the payoff: at one million tokens of context, DeepSeek-V4-Pro needs only 27% of the single-token inference FLOPs and 10% of the KV cache of DeepSeek-V3.2, per the efficiency numbers from the V4 preview. A model that cheap to run is only useful if the software around it can point it at real environments. That is the gap the harness fills.

There is precedent for an infrastructure supplier opening up to become the layer everyone builds on. Nvidia published the full source of its DeepStream video analytics stack in March 2025 on GitHub under a dual license, Apache 2.0 for the code, betting that standardization beats control. DeepSeek's move reads the same way: if agent harnesses standardize, an open one with a swappable model slot works in DeepSeek's favor whether the winning model is DeepSeek's or someone else's. It is the same logic that carried the V4 preview into the open-weight conversation. The preview page itself concedes the work is unfinished, saying the core plugins and APIs will keep evolving while developers test them.

Traceability as the benchmarking wedge

The quietest feature may be the most consequential. Every run is traceable: everything the model sees is written to an append-only session log, from system prompts and reasoning to tool calls and results, subagent scheduling, and context injections. The Trajectory view filters those records by source, and resume, fork, search, and replay all operate on the same event stream.

That is a direct answer to a recurring agent problem: behavior with no owner. Mistral's Studio release pushes a centralized system of record for prompts and skills, with immutable versions and audit logs. DeepSeek approaches from the other side, capturing not just the instructions but the full trace of what the agent did. Then there is Minimal mode, a two-tool agent with persistent bash and a file editor, built for benchmarking models in a stripped-down environment. Auditable runs plus a minimal benchmark setup points to a clear ambition: agent evaluation that others can actually reproduce. What reproducible runs demand is less trust in the model and more control over the environment, the same shift that has pushed sandbox-first agent design to the center of coding-agent debates. And the whole benchmark conversation is about to get louder, since aggregate benchmark scores keep splitting into messy component parts.

The real wager is that the environment matters as much as the model inside it. DeepSeek spent years proving open weights can compete at the frontier. Its V4 pricing shift shows it is willing to make the economics awkward for users to keep that position. Now it wants to be the harness those weights run in. The model may be the soul, but the harness is where the company intends to live.