DeepSeek Harness: The Plugin-Native Agent Framework, Explained
DeepSeek just open-sourced an agent harness where everything is a plugin. Here's how its architecture works — and why it matters for enterprise agent infrastructure.
In August 2026, DeepSeek AI released DeepSeek Harness (dsh) — an open-source agent harness built on a single principle: everything is a plugin. Rather than shipping a monolithic agent runtime with hard-wired tools, the harness exposes shell, filesystem, web, subagents, workflows, and skills as swappable plugins on one spine. For teams building multi-agent orchestration or enterprise logic engines, the release is a useful reference point — and a sign of where agent infrastructure is heading. If you are new to the space, start with our primer on what AI agents are.
What Is DeepSeek Harness?
DeepSeek Harness is a developer-preview, MIT-licensed agent framework you can start with a single command. It runs a Web UI, a CLI, and an automation server over the same plugin kernel, so the loop that answers a chat message is the same loop that drives a headless or scripted agent.
# Start the Web UI from npm (served at http://127.0.0.1:3080 by default)
npx @deepseek-ai/dsh webIt is explicitly a developer preview — the project documents that compatibility-breaking changes are coming — but the architectural direction is already clear and worth studying.
The Core Idea: Everything Is a Plugin
Most agent frameworks grow by adding if-statements to a core loop. DeepSeek Harness inverts that: the core is a thin Cordis plugin kernel, and every meaningful behavior — the shell executor, the filesystem, web search, subagent delegation, workflows, skill loading, even loop hygiene and approvals — is contributed as a plugin. Registrations are effects with explicit disposers, which is what makes a plugin system safe to compose rather than a pile of global hooks.
This is the same discipline we apply to Flow, where business logic is wired as swappable components rather than baked into a monolith, and to our agentic workflow design practice.
Capability Seams: Definition, Provider, Consumer
The most important design decision is the capability seam. Each capability — shell, filesystem, web, LLM — is expressed as three roles: a Service Definition (the contract), a Provider (the implementation), and a Consumer (the code that calls it). Because the loop depends on the definition, not the provider, you can swap a local shell for a sandboxed one, or a local filesystem for a policy-gated one, without rewriting the agent.
Everything is a Plugin
Shell, filesystem, web, subagents, and skills are all plugins on one spine — not hard-wired features.
Capability Seams
Each capability is a Definition → Provider → Consumer triple, so behavior swaps without rewriting the loop.
No Black Box
Model-visible means logged: every model input is reconstructable from the session log.
Composable in Time & Space
Cordis spatiotemporal composability lets plugins interleave cleanly and tear down deterministically.
Architecture, Piece by Piece
Key Features:
- One agent loop with tools, sessions, and capabilities contributed as plugins
- Registrations are effects: every contribution goes through the runtime context
- Each registration returns a disposer for deterministic teardown
- Waterfall listeners can delegate to the next plugin or short-circuit
- New behavior lands on documented extension points instead of loop rewrites
Illustrative Example:
// Illustrative: a plugin contributes a capability and reacts to lifecycle events.
export function apply(ctx: Context) {
// Provide an implementation for a capability seam.
ctx.provide(ShellService, () => ({
run: (command: string) => exec(command),
}));
// Registrations are effects; the returned disposer tears everything down.
return ctx.effect(() => {
const off = ctx.on('session/start', (session) => {
session.tools.register(shellTool());
});
return () => off();
});
}Key Features:
- Each seam has three roles: Service Definition, Provider, and Consumer
- Shell capability runs commands through a local or remote provider
- Filesystem capability is gated by a swappable policy
- Web capability exposes search and fetch as consumers of a provider
- Swap a provider without touching the agent loop
Illustrative Example:
// Illustrative: a capability seam is a Service Definition plus a Provider.
const FileService = new Service('fs', {
read: (path: string) => Promise<string>,
write: (path: string, content: string) => Promise<void>,
});
// Provider A: local disk.
ctx.provide(FileService, () => localFs());
// Provider B: sandboxed runtime — swap without changing consumers.
ctx.provide(FileService, () => sandboxFs({ policy: 'workspace-write' }));Key Features:
- Model-visible ⟺ logged: no hidden state reaches a model request
- Durable session log drives titles, telemetry, and replay
- Typed events with declaration merging for extensibility
- Compaction and context plugins operate on the same logged stream
- Auditable by construction rather than by convention
Illustrative Example:
// Illustrative: an agent turn is a typed event in the session log,
// so a transcript can be replayed without a live provider.
{
"type": "session/turn",
"request": { "messages": [ ... ] },
"response": { "content": "..." },
"toolCalls": [
{ "tool": "shell/run", "args": { "command": "ls" } }
]
}Key Features:
- Workflow plugin fans work across many subagents in phases
- Subagent plugin provides durable delegation with separate contexts
- Skill plugin loads task-specific instructions on demand
- Guard plugin enforces loop hygiene and tool timeouts
- Approval and interaction capabilities plug in where the loop needs a human
Illustrative Example:
// Illustrative: workflow, subagent, and skill are consumers of the same spine.
const workflow = ctx.service(WorkflowService);
const subagent = ctx.service(SubagentService);
const skill = ctx.service(SkillService);
await workflow.pipeline(items, async (item) => {
const child = await subagent.delegate({ prompt: buildPrompt(item) });
return child.result;
});Technology Stack at a Glance
- Node.js
- TypeScript (ESM)
- npx @deepseek-ai/dsh
- Cordis plugin kernel
- Service Definition / Provider / Consumer
- Waterfall + effect lifecycle
- Shell
- Filesystem (policy)
- Web search/fetch
- LLM providers
- Subagents
- Workflow
- Skills
- Durable session log
- Typed events
- Compaction
- Context plugins
- Web UI
- CLI
- ACP automation server
- JSON-RPC
- MIT
- Developer preview v0.1
Why It Matters for Enterprise Agents
The signal in this release is not a single tool — it is the separation of the loop from its capabilities. That separation is what lets a team audit an agent (every model input is logged), constrain it (a filesystem policy is a provider you swap, not a code path you fork), and extend it (a new capability is a plugin, not a loop change). Those are the same properties enterprises need before they run autonomous agents against production systems.
Where DeepSeek Harness stops at the open harness layer, Elatify focuses on the layer above it: ready-made autonomous components like the Sales Agent and AI Visibility Agent, the L7 orchestration engine for multi-agent control, and safety controls such as AI Guardrails. If you are evaluating open harnesses versus licensed infrastructure, our enterprise AI solutions team can map the trade-offs for your stack.
What to Watch
- Stability: developer preview means the API surface is still moving — pin versions and isolate upgrades.
- Capability seams: the Definition/Provider/Consumer split is the part most likely to influence how you structure your own agent code.
- Transparency: a durable, replayable session log is table stakes for regulated or audited deployments.
- Composability: plugins that interleave deterministically make it practical to add guards, approvals, and skills without forking the runtime.
Building on Agent Infrastructure?
Whether you are evaluating open harnesses or licensing enterprise infrastructure, our architects can map the seams, safety controls, and orchestration for your use case — or launch fast with AI Kickstarter.