DeepSeek Harness (dsh) vs OpenAI Agents API

DeepSeek Harness (dsh) 40

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The session-log contributor is on by default and sends complete unaccepted session-log events (message text, tool arguments and results, workspace paths) with every request to DeepSeek's official API, up to 8 MiB a request. Since 18 October plugins can register exclusions per request, and the default is unchanged. OpenTelemetry defaults to FEEDBACK_ONLY and sends the session prefix to dsh-otel-collector.deepseeksvc.com after any feedback or rating. Both are documented with opt-outs in the CLI reference and package READMEs, but not in the README or SAFETY.md. Keys stay local (8). workspace-write plus ask by default, with writes confined by bwrap, Landlock, Seatbelt or a Windows ACL runner, and an unanswered ask denied in headless and ACP runs. Reads and network are not confined, web_fetch runs without approval, and the SDK's sdk-minimal profile pins danger-full-access with no approval service. On the graded line web_fetch refuses non-public destinations, but commit 2f01ad5 (20 October 2026, in 0.2.2-alpha.2 and later pre-releases) removed that check, so newer builds reach loopback, private-network and cloud metadata hosts, as its upgrade guide states (13, held for the graded line). SAFETY.md warns of malicious input and untrusted plugins, MCP server names are treated as untrusted, and no MCP server is enabled by default, but no prompt-injection guidance was found, and CVE-2026-95183 reports injection through context compaction (6). Local JSONL session logs record approval decisions as audit events (12). No SECURITY.md or security policy file in a clone of 4 November, no security.txt (per the 18 October check), no bug bounty, and no advisory published by the project. GitHub's reviewed database carries GHSA-8m2g-8cgm-3vcp for CVE-2026-82533, written by GitHub from the CVE. SAFETY.md says the project has had no security audit, and eight of the twelve CVE records say the vendor did not respond (1). 8 + 13 + 6 + 12 + 1 = 40.

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

DeepSeek Harness (dsh) 53

MIT, Copyright 2026 DeepSeek, with third-party licences in THIRD_PARTY_NOTICES.md (30). The package READMEs state what leaves the machine, the defaults, the collector address and that exports can include message text, tool arguments, results and workspace paths, but the project has no privacy policy or retention statement of its own, and uploads fall under DeepSeek's platform policy (14). The README warns of breaking changes, and per-version upgrade guides name removals and migrations, dated only by their pre-release, with no changelog or deprecation policy (3). Telemetry is disclosed with opt-outs by setting, Web switch and environment variable, though only in reference pages and not at the top of the README or in SAFETY.md (12). A Desktop product-analytics package (README since 24 September 2026) reports interaction events with device_id and user_id by default and no user-facing control, disclosed in its README. The Desktop app is outside the listed packages and the npm Web UI never sends these events, so no term. 30 + 14 + 3 + 12 = 59.

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

DeepSeek Harness (dsh) 60

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). The harness is free under MIT with nothing to buy (20). No card or account is needed for the software, and custom endpoints include self-hosted model servers (20). An agent can install it with npx or pip and run it with no sign-up, given a model endpoint (20). DeepSeek's API is a separate purchase. 0 + 20 + 20 + 20 = 60.

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

DeepSeek Harness (dsh) 38

Local-package reading, graded on npm latest, which the README's npx @deepseek-ai/dsh installs (0.2.0-rc.2 per the 18 October check; npm not re-read on 4 November). Official npm package with Node 22.19+ and 24+ stated, and a Python wheel for Python 3.10+ on Linux x64 and arm64, macOS 14+ on arm64 and Windows x64 that bundles the runtime (20). Public CI. ci.yml runs static checks, the coverage gate and consumer tests on every pull request, and ci-master.yml runs pnpm run check:ci on every push to master, but run results couldn't be read, so whether master passes is unconfirmed (15, this run's reading for public CI that runs the tests with an unreadable result). CONTRIBUTING.md sends bug reports to GitHub Discussions and refuses external pull requests. Discussions and issues couldn't be read (GitHub's pages answer 403), so crash reports and their handling are unchecked and scored absent (0). Alpha, next and latest dist-tags separate channels. Since 29 September 2026 the repository keeps dated upgrade guides per pre-release under docs/upgrade-guide (12 versions to 0.2.2-alpha.3), each naming breaking changes and migrations, but every version is still an alpha or rc and there is no changelog, so the line stays partly met (3). Developer preview, no 1.0 or stable release (0). 20 + 15 + 0 + 3 + 0 = 38.

OpenAI Agents API 60

Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.

DeepSeek Harness (dsh) 71

Recency follows what a default install gets. npm latest was 0.2.0-rc.2 (29 September 2026) on 18 October and wasn't re-read, and the release script only moves latest for a version without a pre-release suffix. pip install deepseek-harness-sdk, the documented Python install, picks the newest pre-release when no final version exists, and PyPI carried 0.2.1rc2 on 17 October per the 18 October feed reading (30). 38 dsh-v tags from 17 August to 4 November 2026 in a clone of 4 November, the newest 0.2.2-rc.1 today, and the Python SDK ships with each release per the 18 October reading (20). CONTRIBUTING.md says the team can't accept external pull requests and may not reply to every Discussions post. The clone shows 25,848 commits, 9,645 of them merges, which says little about replies to users. Reply times in Discussions are unchecked (5). The Python SDK ships with each release, still as a pre-release (10). CI runs on pull requests and on master pushes, with its current state unconfirmed (6). 30 + 20 + 5 + 10 + 6 = 71.

OpenAI Agents API 87

Closed API. Last dated change 16 October 2026, Ultrafast mode and document skills (30). Four dated changelog entries in the 57 days since release, 10 September, 29 September, 9 October and 16 October (20). Changelog and help centre, as the openai-api listing reads them (12 of 15). Official SDKs carry beta.agents (15). SDK CI, per the openai-api listing (10). 30 + 20 + 12 + 15 + 10 = 87.

DeepSeek Harness (dsh) 68

Harness reading, scored on what a pipeline driving it has to supply. Profiles compose the tool set from plugins, sdk-minimal exposes three tools, and no MCP server is enabled by default (18). Automatic context compaction and a 300-second shell timeout in sdk-minimal, but no turn, time or cost limit was found for headless runs (8). Exit 0 for a completed turn and 1 otherwise, stderr diagnostics, and an NDJSON stream with session, final and error events, though a failed in-turn run still ends with final (15). --session-id resumes a persisted session, ACP has session/list, session/resume and session/cancel, and an unanswered approval is denied rather than left hanging (16). One-argument headless runs, ACP and a Python SDK, and the repository also holds a TypeScript SDK client (@deepseek-ai/dsh-sdk-client) that the Python guide mentions once. Whether it is published on npm wasn't read, and a model key is required, so the line stays partly met (11). 18 + 8 + 15 + 16 + 11 = 68.

OpenAI Agents API 80

Read as an API an agent drives. Context is compacted automatically, and session budgets and streamed events keep output sized (20 of 25). Sessions can be listed, continued and steered, events streamed or sent by webhook, artifacts fetched (15 of 20). Actionable error codes with recovery steps (20). No idempotency key; a documented check-then-retry procedure (10 of 20). One session call with defaults (medium sandbox, network enabled), SDKs in five languages (15). 20 + 15 + 20 + 10 + 15 = 80.