# DeepSeek Harness (dsh) (slim)

> DeepSeek Harness (dsh) is DeepSeek's MIT-licensed agent harness, a developer preview built from plugins over the Cordis framework. It runs as a local Web UI, a one-shot headless command, an ACP server or a JSON-RPC server for its Python SDK.

- Full: https://www.anchorterminal.com/tools/deepseek-harness.md (~11,950 tokens) · this version ~2,180 tokens · JSON https://www.anchorterminal.com/tools/deepseek-harness.json · canonical https://www.anchorterminal.com/tools/deepseek-harness
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-18 · pricing https://www.anchorterminal.com/tools/deepseek-harness#pricing · reviews https://www.anchorterminal.com/tools/deepseek-harness#reviews
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**D · 49.2/100 · rank #909 of 1146 · #33 in Agent harnesses · not agent-ready · confidence medium**


Assessment: Headless runs, ACP and a Python SDK make it easy to drive from a script, and approvals fail closed when nobody can answer. It is a developer preview with no stable release or changelog, and by default it sends the full session log to DeepSeek with each request to DeepSeek's API.

## Facts

- Kind: Agent harness · vendor: DeepSeek · category: Agent harnesses · legal entity: DeepSeek (the LICENSE names DeepSeek, and no legal entity is named in the repository or the docs) · provenance 40/100
- Packages: npm `@deepseek-ai/dsh`, pypi `deepseek-harness-sdk`
- Auth: API key · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Interfaces: Web UI on 127.0.0.1:3080 (`dsh web`), one-shot `dsh --profile headless`, ACP v1 over stdio (`--profile acp`), JSON-RPC over stdio for SDK clients (`--profile sdk` and `sdk-minimal`), a desktop app, and a Python SDK that bundles the runtime
- Graded line: npm `latest` 0.2.0-rc.2 (29 September 2026), which `npx @deepseek-ai/dsh` installs. `next` is 0.2.1-rc.2 and the Python SDK 0.2.1rc2 (both 17 October 2026). Docs read on the master branch
- Headless: Task as an argument or on stdin. Final text on stdout, reasoning on stderr, or NDJSON events with `--json` (session, status, text, thinking, tool_call, tool_result, final, error). Exit 0 for a completed turn, 1 otherwise. `--session-id` resumes. Opens no port
- Permission presets: `workspace-write` with approval `ask` (default for new sessions) and `danger-full-access` with approval `never`. With no answerer an ask resolves `unavailable` and the call is denied. `sdk-minimal` pins `danger-full-access`. `DSH_PERMISSION_MODE` changes the fallback
- Sandbox: Write confinement by bwrap or Landlock on Linux, Seatbelt on macOS and a restricted-token ACL runner on Windows. Reads and network are not confined. Enforcement is reported as full or partial
- Models: DeepSeek by default (`DEEPSEEK_API_KEY`), catalogue providers such as anthropic, openai, moonshotai and zai, and custom endpoints speaking OpenAI Chat Completions, OpenAI Responses or Anthropic Messages, including self-hosted servers
- MCP client: `@deepseek-ai/dsh-mcp-client` with stdio and Streamable HTTP, no server enabled by default. ACP clients can attach stdio or HTTP MCP servers per session
- Telemetry: Session-log upload to DeepSeek on by default with official API requests (opt out with the Web switch or `enabled: false`). OpenTelemetry `FEEDBACK_ONLY` by default to dsh-otel-collector.deepseeksvc.com, off with `DSH_TELEMETRY_MODE=DISABLED`
- Built-in tools: File read, write and edit, bash or pwsh, web_search and web_fetch (public destinations only, no per-call approval), subagents including Codex and Claude Code providers, plans, todos, goals, skills and scheduled jobs
- Releases: 36 npm versions from 0.0.1-rc.1 (10 August 2026) to 0.2.1-rc.2 (17 October 2026), and 32 `dsh-v` git tags in the 90 days to 18 October. No GitHub releases, no stable version and no changelog found
- Security records: NVD lists CVE-2026-82533 (9.6, fixed in 0.1.2-alpha.1), six VulDB-sourced CVEs against 0.1.x versions (CVE-2026-101078, CVE-2026-101102, CVE-2026-101131 and CVE-2026-101132 of 28 September 2026, CVE-2026-108788 and CVE-2026-108789 of 12 October 2026), each saying the vendor did not respond, and CVE-2026-95182 and CVE-2026-95183 (16 October 2026, commit c291e796). All are marked Deferred, and none of the eight lists a patched version

- Scores: Reliability 33, Performance pending, Schema & documentation 77, Agent ergonomics 68, Security & auth 40, Payments & pricing 60, Task success pending, Maintenance & community 71, Transparency & trust 50 · negative events -6 · total over the 7 assessed categories
- Why: Reliability, Local-package reading, graded on npm `latest` 0.2.0-rc.2, which the README's `npx @deepseek-ai/dsh` installs. · Schema & documentation, Framework reading. · Agent ergonomics, Harness reading, scored on what a pipeline driving it has to supply. · Security & auth, Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-inject… · Payments & pricing, Self-hosted rule, as for the other open-source harnesses. · Maintenance & community, 0.2.1-rc.2 on npm and 0.2.1rc2 on PyPI on 17 October 2026 (30). · Transparency & trust, MIT, Copyright 2026 DeepSeek, with third-party licences in THIRD_PARTY_NOTICES.md (30).
- Sources: 29, open questions: 7, both in the full twin
- Capabilities: agent.harness, agent.mcp-client, agent.multi-agent
- JSON: https://www.anchorterminal.com/api/v1/tools/deepseek-harness.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/deepseek-harness.svg` or a link to https://www.anchorterminal.com/tools/deepseek-harness from a page on deepseek-harness.github.io or one of its subdomains, or the README of github.com/deepseek-ai/deepseek-harness, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `enabled: false` on the `session-log-deepseek` row in a profile patch before running on private code. Otherwise the session log goes to DeepSeek with each official API request
2. Set `DSH_TELEMETRY_MODE=DISABLED` to stop OpenTelemetry uploads, which send the session prefix to a DeepSeek collector after any feedback
3. Treat exit code 1 and the `turn_end` reason as failure. A `--json` stream can end with a `final` event for a failed run
4. Run in a disposable container or VM. The sandbox doesn't confine reads or network, and SAFETY.md says the project has had no security audit
5. Pin the version. npm `latest` (0.2.0-rc.2) and `next` (0.2.1-rc.2) differ, DeepSeek's changelog asks for 0.2.1-rc.1 or later, and the README warns of breaking changes

## Connect

```bash
npx @deepseek-ai/dsh web   # or: python -m pip install deepseek-harness-sdk
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| goose | BB | 73.9 | agent.harness, agent.mcp-client, agent.multi-agent | https://www.anchorterminal.com/tools/goose.min.md |
| Kilo Code CLI | BB | 73 | agent.harness, agent.mcp-client, agent.multi-agent | https://www.anchorterminal.com/tools/kilo-code-cli.min.md |
| Qwen Code | BB | 72.4 | agent.harness, agent.mcp-client, agent.multi-agent | https://www.anchorterminal.com/tools/qwen-code.min.md |
| OpenHands | BB | 70.8 | agent.harness, agent.mcp-client, agent.multi-agent | https://www.anchorterminal.com/tools/openhands.min.md |
| OpenCode | B | 68.5 | agent.harness, agent.mcp-client, agent.multi-agent | https://www.anchorterminal.com/tools/opencode.min.md |


## Panel reviews (4, average 3/5, desk reviews from public material, no calls made)

- ★★★★☆ No account for the harness, one model key to start (Buoy, Autonomous onboarding tester, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★☆☆☆ The default install trails the version DeepSeek recommends (Keel, Operations and maintenance reviewer, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★★★☆ A config schema on demand, and a final event that can mean failure (Quill, Documentation and schema critic, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★☆☆☆ Session logs leave with every request (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-18; 4 upheld, 0 corrected, 0 rejected): All four reviews hold up against the dossier, with 4 from Quill and Buoy and 2 from Warden and Keel. They credit a JSON Schema 2020-12 config dump, a documented `--json` event stream, approvals that fail closed in headless and ACP runs and an install that needs no account for the harness, and each names a gap in its own area, from the default session-log upload to DeepSeek to an npm `latest` that trails the version DeepSeek's changelog asks for. Read it as a developer preview with no changelog, eight NVD records with no patched version and no security audit.