Everything Is a Plugin, Including the Loop That Decides What Happens Next

DeepSeek open sourced DeepSeek Harness on August 13, 2026. Called dsh on the command line, it is a Node.js agent runtime under the MIT license, built on a plugin kernel called Cordis. The design principle is that every capability is a plugin, covering models, tools, skills, sessions, sandboxes, storage, the agent loop, scheduling, plus the user interface. All of it swaps in configuration without touching the source. It picked up 38,236 stars and 2,988 forks in roughly nine hours, which works out near 68 stars a minute. A plugin ecosystem appeared the same day. Four days later, on August 16, DeepSeek abandons flat API pricing for peak and off-peak rates that run higher than today even at the discount. Best for developers who want to rebuild their agent stack. Not ideal for production, since the README promises breaking changes in capitals.

Roughly nine and a half hours after the repository went public, DeepSeek Harness had 38,236 stars.

That is roughly 68 a minute, sustained, through the night.

It also had 2,988 forks, which is the number that matters more. Stars mean somebody bookmarked it. Three thousand forks in a working day means three thousand people cloned it to build something.

Yesterday morning nobody outside DeepSeek had heard of it.

For scale: OpenClaw, the most-starred agent project on GitHub, took months to reach numbers DSH cleared before most of the United States woke up.

What Actually Shipped

Verified against the GitHub API at the time of writing. These will be stale by the time you read them.

Zero open issues on a repository this size looks odd until you check where feedback goes. DeepSeek routes it through GitHub Discussions instead, so the issue tracker stays empty by design rather than by neglect.

Getting it running takes one line:

npx @deepseek-ai/dsh web

That serves a web interface at 127.0.0.1:3080. Building from source is a clone, pnpm install, pnpm run build, then pnpm dsh web.

Everything Is a Plugin, Literally

Generally, agent tools have a fixed core with extension points bolted on. You can add a tool. You cannot replace the thing that decides which tool to call.

DeepSeek’s own framing inverts that. Models, tools, skills, sessions, sandboxes, storage, loops, scheduling, plus the UI are all plugins. Their line is that the harness itself is just a composition of plugins.

The item in that list worth staring at is loops. The agent loop is the part that decides what happens next after each step. In every other harness that is the product. Here it is a swappable component you select in configuration.

Underneath sits Cordis, incidentally, a separate open-source kernel handling plugin mounting, unmounting, plus dependency resolution. Plugins talk through Cordis services and events rather than calling each other directly. That is ordinary software architecture, applied to a layer where almost nobody has bothered.

The practical consequence: you can run DeepSeek Harness without DeepSeek’s model in it. The model adapter is a plugin. Swap it for Claude, or GPT, or something local. The rest of the runtime does not care.

A company just open sourced the layer that makes its own product replaceable. Hold that thought, because the pricing section explains it.

Four Modes

Notably, each mode loads a different default plugin set, which is the plugin architecture doing something visible rather than theoretical.

Standard is the full coding agent. File editing, shell, file and web search, skills, planning, goals, subagents, workflows.

Code takes everything in Standard but exposes the tools through a Code Mode SDK, so the model writes one TypeScript program that combines multi-step operations instead of issuing tool calls one at a time.

Minimal strips down to two tools: a persistent bash session plus str_replace_editor. Its stated purpose is benchmarking models in a minimal environment, which is a considerate thing to ship. Comparing models fairly means removing harness advantages. Most vendors have no interest in making that easy.

Creator is for building your own presets. Standard capabilities plus runtime inspection, in-memory plugin experiments, then preset-authoring guidance.

Code mode is the one that echoes elsewhere, though. Prime Agent, which we covered last week, gives the model a persistent Python shell as its only tool so it can write programs over its own work rather than issuing individual calls. Different language, same conclusion, reached independently about a week apart.

Every Run Is Traceable

This is the feature that should get more attention than the plugin architecture, because it fixes something that actually hurts.

Everything the model sees goes into an append-only session log. System prompts, reasoning, tool calls and their results, subagent scheduling, plus every context injection. Not a summary. The raw stream, by source.

A Trajectory view lets you inspect those records and see where each piece of context came from. Resume, fork, search, plus replay all operate on that same event stream.

Certainly anyone who has debugged an agent knows why this matters. Something goes wrong forty steps in, you scroll back, but the transcript shows what the model said rather than what it was looking at. Which memory got injected, which skill description was loaded, what the subagent actually returned. Those are usually invisible, so debugging becomes guesswork about the model’s state.

Fork is the underrated verb in that list. Replay a session up to step twelve, change one thing, run the rest again. That turns agent debugging into something closer to a controlled experiment instead of rerunning the whole thing and hoping.

The Ecosystem Appeared Overnight

Within the same 24 hours, community plugins also started shipping. All of these were created after the harness went public.

dsh-cc-tui has 197 stars, BSD-3-Clause, TypeScript. A full-screen terminal interface in Claude Code’s style, since DSH shipped without one. It has a pixel whale top bar, a live status line, streaming thought expansion, double-Esc rollback, plus a context progress bar with a tokens-per-second gauge.

dsh-vision-toolkit has 150 stars, MIT, TypeScript. It helps text-only models handle visual tasks through intent-aware image questioning, long-screenshot OCR, plus UI reconstruction.

dsh-web-ui has 506 stars and no license file, which means it is not open source whatever the description says. Task board, git graph, sidebar skins. Popular, also legally unusable until somebody adds a license.

Both licensed plugins have Chinese-language READMEs. English coverage of them is currently zero.

DeepSeek seeded this deliberately by publishing a dsh-plugin topic tag for discoverability, so the ecosystem was designed in rather than hoped for.

The Pricing Change Nobody Is Connecting

Meanwhile, here is the part launch coverage is treating as a separate story.

Per VentureBeat, DeepSeek is abandoning flat API pricing on August 16 at 16:00 UTC, which is 2am Eastern on Sunday. Peak and off-peak rates replace it. Even discounted off-peak cache-miss and output prices land substantially higher than today’s. V4-Pro arrives on the API at higher prices too.

So the sequence is: give away the harness on Thursday, raise model prices on Sunday.

Admittedly that reads cynical until you think about what a harness actually is. Whoever controls the runtime controls how models get used, which tools they reach, how sessions persist, what the agent loop does. The model is a commodity that gets swapped in a config file. The runtime is where habits form.

DeepSeek is trading model-price competition for infrastructure position. Give away the layer everybody builds on, then charge more for the model, because by the time your workflow lives inside DSH the switching cost is no longer the API key.

That is a familiar play. It is also, arguably, exactly what makes the release useful, since a harness built to be model-agnostic beats one built to lock you in.

Three Harnesses in Three Weeks

Step back though. The pattern is hard to miss.

Prime Intellect shipped Prime Agent on August 5, giving the model a persistent Python shell and letting it rewrite its own prompts, memories, plus skills mid-session. On August 8 a project called KADATH appeared, breeding and scoring agents across reproducible generations. This week Ouroboros published an arXiv paper describing a harness that rewrites its own implementation through reviewed commits, reporting 86.74% on Terminal-Bench 2.1.

Now DeepSeek, with the largest single-day launch of the four, arguing that every part of the runtime should be swappable.

Four projects, three weeks, all attacking the same layer from different angles. The shared premise is that models have got good enough that the scaffolding around them is now the constraint. Nobody is claiming a better model. Everybody is claiming a better container for one.

VU’s OpenClaw deep dive covered what building this kind of orchestration by hand costs. That work is now table stakes shipped by a frontier lab for free.

The Warning You Should Read

The README carries this in capitals: there will be compatibility-breaking changes.

DeepSeek repeats it on the launch page, describing the project as still in developer preview with core plugins and APIs continuing to evolve. Their own announcement said many details are still being polished.

Take that seriously, obviously. A plugin architecture makes breaking changes worse rather than better, because every community plugin depends on interfaces that are explicitly not stable yet. Those 197-star and 150-star plugins that shipped yesterday are built against a moving target.

There is also the standard caution that applies to every agent runtime. This executes code with your permissions. We covered an operator whose agent published his own API keys to the open internet because it started a web server in the wrong directory. That agent was running DeepSeek as its reasoning engine.

One thing in DeepSeek’s favour here. They publish a Safe Use Policy plus a Data Processing Statement alongside the release, which is more governance documentation than most harness projects ship with.

/separator

Where the Model Actually Sits

Worth being precise about what a harness is, since the word gets used loosely and this release turns on it.

DeepSeek’s own formulation is simple. Agent equals model plus harness. The model is described as the soul of an agent, while the harness lets that agent understand its environment, use tools, then keep working in real settings.

In practice the harness owns everything the model does not. It decides what goes into the context window and in what order. Tools run through it, errors get caught there, results feed back through it. Sessions persist across restarts, holds memory, schedules subagents, enforces permissions, then chooses when to stop.

Ultimately, two setups running the identical model can perform very differently based purely on that layer. Which is why the same Opus 5 scores differently in different harnesses. It is also why every benchmark comparison should specify the runtime as carefully as it specifies the model.

That explains Minimal mode existing at all. Two tools, nothing else, so a benchmark measures the model rather than the scaffolding somebody built around it. DeepSeek shipping that mode is a small act of intellectual honesty in a field where vendor benchmark tables routinely compare a model in its own optimised harness against a rival in a generic one.

It also explains why the harness layer is suddenly worth competing over. If the model is a commodity you swap in configuration, whoever owns the runtime owns the workflow.

What It Does Not Do

Being clear about limits, because launch coverage tends to skip them.

Firstly, there is no terminal interface. DSH ships with a web UI and nothing else, which is why a community plugin adding a Claude Code style TUI picked up 197 stars in a day. That gap was filled by a stranger within hours of launch.

There is no stability guarantee of any kind. Not a soft caveat, a capitalised warning in the README.

Thirdly, there is no benchmark table. DeepSeek published no Terminal-Bench, SWE-bench, or OSWorld figures alongside this. For a launch positioned against Claude Code that absence is conspicuous. It may just mean the harness is too new to have run campaigns. Either way, anyone claiming DSH beats anything right now is making it up.

There is no hands-on verdict here either, including ours. This piece is built from the official documentation plus verified GitHub data. A proper test needs isolated hardware and a recorded session, which is coming in a future Fresh Commits issue.

What This Means If You Use Claude Code

Practically speaking, nothing today. You do not have to move.

What changes is the comparison. Claude Code, Codex, Cursor and the rest are products with fixed architectures you configure at the edges. DSH is a runtime you assemble. Those are different propositions. Until yesterday the assembled option was something you built yourself.

If you have ever wanted your agent’s session log to be properly inspectable, or wanted to swap the agent loop, or wanted to run the same tool setup across different model providers without rewriting anything, this is the first mainstream thing built for that.

If you want something that works out of the box on a Thursday afternoon, it is not.

The honest read for most people is to install it, run Minimal mode against a model you already pay for, then see whether the traceability changes how you debug. That is an hour, costing nothing but tokens. Our Hermes Agent coverage covers the alternative if you want an established open-source option instead of a nine-hour-old one.

What to Watch

Three checkable things, specifically.

Firstly, whether the plugin interfaces stabilise. Developer preview plus explicit breaking-change warnings means today’s ecosystem is provisional. The first release that breaks 200 community plugins will tell you how the project handles that pressure.

Secondly, whether the forks turn into anything. Nearly 3,000 forks in a day is extraordinary. Most forks are bookmarks with extra steps. The dsh-plugin topic is where that gets measured, since a real ecosystem shows up as published plugins rather than clone counts.

Thirdly, whether other labs respond. If the harness layer is where the competition moves, the interesting question is whether Anthropic and OpenAI open theirs. Both currently ship polished closed products against a free open runtime, which is a familiar position and historically an uncomfortable one.

The Other Thing DeepSeek Ships

One uncomfortable piece of context, since VU has covered it directly.

In July, Unit 42 documented an operator in Zhuhai who wired DeepSeek into an open-source agent framework and pointed it at 460 targets. Their assessment was that the actor tried Claude Code and Codex first, found provider safeguards limited their usefulness for autonomous attacks, then moved to the most permissive model available.

DeepSeek was the most permissive model available.

Now the same company ships the runtime as well. That is not an accusation. Every autonomous attempt in that campaign failed. But an agent stack is a model plus a harness. DeepSeek now publishes both halves under permissive terms with the sandbox itself listed as a swappable plugin.

The counterargument is real too. Open source is the reason anyone can audit this at all. The session log makes DSH more inspectable than any closed harness on the market, which is a security feature even though it was probably built for debugging. You cannot review what Claude Code does with your context. You can review exactly what DSH does, because the trace is the product.

Both things are true at once. Wider access means wider misuse plus wider scrutiny. This release hands over more of both than anything since Hermes.

The Part Worth Keeping

DeepSeek published a coding agent yesterday morning and it collected 38,000 stars before most of the United States had lunch.

The architecture is the interesting part and the pricing is the honest part. Every capability swaps out, including the model, including the loop that decides what happens next. Four days later the model those swaps replace costs more.

Give away the container. Charge for what goes in it. That is not a new strategy, it is just the first time anyone has run it at this layer.

Whether it works depends on something nobody can measure yet: how many of those 2,988 forks are still being worked on in a month.

Ask again in September. That number is public, it costs nothing to check, plus it will say more than any launch-day figure in this article.

Charts and Blocks

The first nine hours

The four modes

FAQ