DeepSeek Harness (dsh): Setup, Ollama, Plugins, Privacy and Alternatives

DeepSeek Harness (dsh) is DeepSeek's open-source agent harness, published on GitHub on 13 August 2026 under the MIT licence and still labelled a developer preview. It runs as a desktop app for macOS and Windows or as a local web UI that a single npx command starts, calls DeepSeek's API by default, and also works with Ollama and other local model servers. Tools, model adapters and even the interface are plugins.

The project’s safety notice is blunt: the code has had no security audit, it can execute model-generated commands and third-party plugins, and it should not be treated as production-ready. Read this guide as an evaluation of a preview, with an eye on data flows.

Commands, versions and defaults were checked on 4 November 2026 against the repository and its docs, npm, DeepSeek’s Harness pages and privacy policy, and Ollama’s integration page; npm’s latest tag then pointed to 0.2.1-rc.5 from 29 October. Our primer on agent harnesses explains the idea.

What DeepSeek Harness is and what its agent can do

The agent reads and edits files in a folder you choose, runs shell commands, keeps a plan and a to-do list, delegates to subagents, runs background jobs, searches and fetches web pages, and loads skills and MCP servers. DeepSeek also pitches it for documents, spreadsheets and slides, and the desktop build bundles Python libraries for Office files.

Under the hood, the harness runs on Cordis, a plugin framework described in a paper on arXiv, under the tagline “Everything is a Plugin.” Model adapters, tools, the sandbox, settings pages and the chat interface are plugins that a profile assembles from layered YAML patches, so one codebase serves the desktop app, the browser UI and a headless runner. Providers other than DeepSeek go through pi-ai, the model library from the Pi coding agent project.

DeepSeek Harness on GitHub

How to install DeepSeek Harness

DeepSeek Harness desktop

DeepSeek offers desktop builds for macOS on Apple silicon and 64-bit Windows, but none for Linux. The installers, last updated on 30 October 2026, weigh about 265 MB for macOS and 289 MB for Windows. The app wraps the web UI in Electron and carries its own Node.js, Python and pnpm, and a menu entry can register a dsh command for your terminal.

Run the web UI with npx

npx @deepseek-ai/dsh web

The server listens on 127.0.0.1 port 3080 and opens your browser at a URL holding a fresh process token, which the page swaps for a signed cookie; --no-open and --port change that behaviour. Current builds declare Node.js 24.9 or later, and npm install -g @deepseek-ai/dsh@latest gives you a permanent dsh command. On first use, enter a DeepSeek API key or another provider under Settings → Models, then add the project folder with Choose workspace; the composer stays disabled until you do.

DeepSeek Harness on Windows

Use the 64-bit installer, or Node.js for Windows plus the npx command. The shell tool is PowerShell on Windows and Bash elsewhere, each inside a native sandbox: bubblewrap or Landlock on Linux, Seatbelt on macOS and a restricted-token runner on Windows that the project itself rates as partial enforcement.

DeepSeek Harness CLI and SDK modes

No shipped profile is a full-screen terminal chat. The command line is for automation:

The Python SDK, pip install deepseek-harness-sdk (0.2.1rc2, released on 17 October), needs Python 3.10 or later and bundles its own runtime for Linux, Windows x64 and macOS 14 or later on Apple silicon.

DeepSeek Harness and Docker

DeepSeek publishes no container image, and the repository’s only Dockerfile is a test fixture. The safety notice still recommends a disposable virtual machine or container, so build your own: a Node.js 24 base, the npm package and your project mounted as the working directory. The server refuses wildcard addresses such as 0.0.0.0, so bind the container’s own address, following the container example in the web app reference:

dsh --profile web --no-open --host "$(hostname -i | awk '{print $1}')"

Without TLS, a listener on a non-loopback address serves plain HTTP and prints a warning, so expose the port only on a network you trust.

DeepSeek Harness with Ollama and other local models

The quick route: ollama launch dsh

ollama launch dsh --model qwen3.8

Ollama’s launcher installs the npm package when it is missing and keeps its settings in ~/.ollama/launch/dsh/settings.yaml without touching your Harness profiles or credentials. It also switches on web search through Ollama’s cloud, which needs ollama signin, and tags ending in :cloud, such as deepseek-v4-flash:cloud, run on Ollama’s servers rather than yours.

Ollama sizes its default window by VRAM, giving only 4K tokens below 24 GiB, yet asks for at least 64,000 tokens for agent work. Start the server with OLLAMA_CONTEXT_LENGTH=65536 ollama serve and check the loaded window with ollama ps.

LM Studio, llama.cpp and vLLM

Any server that speaks OpenAI Chat Completions, OpenAI Responses or Anthropic Messages works. In Settings → Models, choose Add model provider, switch to Custom model API, and enter a lowercase provider ID, which is permanent, the base URL, the protocol, a key and the model IDs. Local servers ignore the key, but the adapter will not send a request without one, so type a placeholder.

The page saves to $DSH_HOME/profiles/web/cordis.patch.yml, normally under ~/.dsh. Written by hand, an LM Studio route looks like this, with LMSTUDIO_API_KEY exported as any value:

- id: llm-pi-ai
  config:
    providers:
      lmstudio:
        apiKeyEnv: LMSTUDIO_API_KEY
        api: openai-completions
        baseURL: http://127.0.0.1:1234/v1
        models:
          - id: qwen/qwen3-coder-30b
            contextWindow: 65536
            maxTokens: 16384

An override replaces the entry’s whole configuration, so keep any providers already saved there. If a server refuses every request despite a correct address and key, DeepSeek’s model guide suggests setting compat.supportsDeveloperRole: false and compat.maxTokensField: max_tokens on the route.

Which local models handle its tool calls

We found no local-model recommendations in DeepSeek’s documentation, so the usual rule applies: choose a model trained for tool calling, with room for instructions, tool definitions and files. Ollama’s example, Qwen3.8 27B, is an 18 GB download listed with tool, thinking and vision support and a 256K window. Our comparison of local models for tool calling covers the alternatives; for DeepSeek’s own weights, see our guide to running DeepSeek V4.1 Flash on your own hardware. Always enter a context window, because for an unsized model the adapter assumes 1,000,000 tokens and would not compact before a 64K local window fills.

DeepSeek Harness API: models, keys and cost

Out of the box, requests go to DeepSeek’s API with a key from DeepSeek’s developer platform, stored write-only in $DSH_HOME/.credentials.yaml, or through a DeepSeek account sign-in. The model list follows DeepSeek’s published catalogue, with deepseek-flash and deepseek-v4-pro built in. DeepSeek’s pricing page maps those IDs to DeepSeek-V4.1-Flash-1017 and DeepSeek-V4-Pro-0813, bills tokens against a prepaid balance, and charges $0.75 per 1,000 successful Search or Fetch API requests as of 4 November 2026. The harness itself is free.

Hosted alternatives come from the pi-ai catalogue, with provider IDs such as anthropic, openai, moonshotai for Kimi and zai for GLM. DeepSeek offers the harness as software you run rather than a hosted API, so the headless, SDK and ACP profiles and the Python SDK are its programmatic routes.

DeepSeek Harness plugins, skills and MCP

Plugins

Plugins are Cordis packages that add tools, services, settings or interface panels. Installable ones are npm packages declaring a dsh.bundle patch and an engines.dsh version range; add them from the Plugins page or with dsh plugin --profile web add <package>. In Creator mode, the agent writes and installs a plugin from a chat request.

Authors tag repositories with the dsh-plugin topic, which covered about 27,000 public repositories on 4 November 2026, many of them tagged only for visibility. Plugins run inside the harness process with its permissions, and the safety notice warns that untrusted ones can damage the host or leak credentials, so read the code and pin versions.

Skills

Skills are SKILL.md folders or single Markdown files, read from .dsh/skills and .agents/skills in the project and from the matching user-level folders, so skills written for other agents load unchanged.

MCP servers

The @deepseek-ai/dsh-mcp-client plugin connects stdio or Streamable HTTP servers, one configuration row each, and exposes their tools as mcp__<server>__<tool>, the naming Claude Code and Codex also use. Before starting a stdio server it strips environment variables that look like credentials, so pass secrets through the row’s env. Resources are supported; MCP prompt templates are not.

Security, privacy and data residency

Sandbox and approvals

New sessions start in the workspace-write preset: shell commands may write inside the workspace, added folders and a temporary area, and actions that need approval wait for you. Read-only and danger-full-access are the other presets, and DSH_PERMISSION_MODE picks the starting one. The sandbox governs file writes, not network access. The safety notice adds that sandboxing and prompts reduce risk without guaranteeing isolation, and asks for least privilege and backups.

Where your data goes

With DeepSeek’s models, whatever the agent reads or runs becomes context sent to DeepSeek: prompts, file contents and command output. DeepSeek’s Harness privacy policy, dated 20 September 2026, says that for official models it collects session logs, including inputs, uploads, outputs, tool calls and plugin configuration, may use inputs and outputs for training after de-identification unless you opt out, and collects, processes and stores personal data in the People’s Republic of China. For custom models it needs no account and says your input goes straight to the provider you configured, without storage or processing on DeepSeek’s servers. Our review of DeepSeek’s app, API and open weights covers the wider terms, and our guide to deploying DeepSeek models on-premises covers running the weights in-house.

A local setup still has smaller flows. Web search keeps calling DeepSeek’s service, or Ollama’s under the launcher, so review the web search settings before confidential work. Feedback uploads the session log, and any value in DSH_TELEMETRY_DISABLED opts the process out. Desktop analytics follow a product-analytics setting that is on by default, while the browser UI started from npm sends none. Verify the result with egress monitoring.

DeepSeek Harness vs Claude Code, Codex, OpenCode, Pi and Hermes Agent

DeepSeek Harness vs Claude Code

Claude Code is Anthropic’s proprietary agent and is supported only with Claude models; local servers work only through an Anthropic-format endpoint that Anthropic does not support, as our guide to Claude Code on local models explains. It is the more finished product, with managed settings for administrators. DeepSeek Harness is open source, model-agnostic and confines writes by default, but it is a preview.

DeepSeek Harness vs Codex

OpenAI’s Codex CLI is an Apache-2.0 terminal agent written mostly in Rust. Its sandbox modes share the harness’s three names, but Codex’s workspace-write mode also blocks network access for commands, which the harness’s sandbox does not. Codex runs local models through --oss or any server with a Responses API, as our Codex local model setup shows.

DeepSeek Harness vs OpenCode

Both are MIT-licensed and treat local servers as ordinary providers. OpenCode, terminal-first with a desktop app, lets most actions run unasked and has no sandbox, while DeepSeek Harness confines writes from the first session. Our OpenCode guide for local models covers its configuration.

DeepSeek Harness vs Pi agent

The two share code, since the harness reaches other providers through Pi’s pi-ai library. Pi is a minimal terminal agent with four default tools, no approval prompts and no sandbox, extended in TypeScript; the harness ships subagents, plan mode, a sandbox and a graphical workspace. See our Pi setup guide.

DeepSeek Harness vs Hermes Agent

Nous Research’s Hermes Agent, also MIT-licensed, lives on a machine you control, answers through chat apps, runs a built-in cron scheduler and needs at least 64K tokens of context. DeepSeek Harness is a workspace you open, and its scheduled tasks are still experimental. Our Hermes Agent comparison with Claude Code and OpenCode goes deeper. For a closed-source desktop agent from the makers of LM Studio, see our LM Studio Bionic review.

Which should you choose

• DeepSeek Harness for a graphical workspace on DeepSeek or local models, run somewhere disposable.
• Claude Code for a supported product on Claude models.
• Codex CLI for a sandbox that also blocks network access.
• OpenCode for the broadest provider list in a terminal.
• Pi for a small core you extend yourself.
• Hermes Agent for an always-on assistant in your chat apps.

How VDF AI fits

VDF AI does not run, host or integrate with DeepSeek Harness. The harness is built for one person on one machine: its sandbox, approvals and model settings live in a local profile, plugins run with the process’s permissions, and nothing in it lets an administrator decide which models, tools or data each team may use.

VDF AI is the governed alternative for organisations that need those controls. It runs on infrastructure you control and provides governed agents, multi-agent orchestration through Networks, private RAG over company documents, role-based access control on every plan and audit logs. VDF Code is its coding assistant for engineering teams, deployed on servers you operate.

At the model layer, VDF AI Router can register an on-premises endpoint, such as a vLLM or Ollama server running DeepSeek’s open weights, beside the cloud models your policy approves, and its air-gap mode keeps routing on local models only.