DeepSeek Harness 0.2.1: What the Release Notes and Safety Page Say Before You Install a Plugin

DeepSeek Harness, short name dsh, is an open-source agent harness from DeepSeek AI, released under the MIT license. Its README calls it a "developer preview" with "compatibility-breaking changes" ahead, and its own SAFETY.md says it has not had a security audit and must not be treated as secure or production-ready. The 0.2.1 release candidates add a lot for plugin users and authors. Before you install it, read the safety page, because the project is built around third-party plugins that can run code.

I read the repository page and README, SAFETY.md, the release notes for the 0.2.1 alpha and release candidate builds, and part of one community discussion. I did not install or run dsh. The English documentation site would not load for me, so I did not read it. Everything below comes from those pages.

What it is

The README describes DeepSeek Harness as an agent harness built on an "everything-is-a-plugin" architecture, powered by Cordis, a framework whose design the README links to a paper titled A Programming Paradigm for Spatiotemporal Composability. I have not read that paper.

At the time I read the repository page, it showed:

• License: MIT.
• Default branch: master. Created August 13, 2026.
• About 262,000 stars and 31,700 forks.
• Languages including TypeScript, JavaScript, Python, C, C++, C# and Swift.

Stars are a popularity number, not a quality or safety signal.

To try it, the README gives npx @deepseek-ai/dsh web, which starts a Web UI at http://127.0.0.1:3080. Over SSH it only prints the host URL, and --no-open skips opening a browser. You can also build from a checkout with pnpm install, pnpm run build and pnpm dsh web.

What SAFETY.md says

This page is short and worth reading in full. Key statements:

• It is "experimental developer-preview software" that "has not undergone a security audit".
• The project "can execute model-generated code and commands, load third-party plugins, and access the network, processes, credentials, and files made available to it."
• Sandboxing, approval prompts and permission controls "can reduce risk, but they do not guarantee isolation or prevent damage."
• "Do not rely on DeepSeek Harness as the sole security control for untrusted workloads."
• Its advice: least privileges, a disposable virtual machine, container or dedicated environment, backups, no sensitive credentials unless you accept the risk, and review of plugins, configuration and proposed commands before they run.

Because the architecture is plugin-first, the plugin review step is the one I would not skip.

What 0.2.1 added

The latest release I could read is v0.2.1-rc.3, published October 23. The notes are written in Chinese and English. The first candidate, rc.1, was published October 17 and summarizes changes since v0.2.0-rc.2. These are the items that matter most to a builder, as the notes list them:

Plugins

• Discover and install plugins from custom plugin index sources.
• A "Let the Agent create a plugin" entry on the plugin management page.
• Enable, disable and uninstall plugins, with dependency sync after updates, and hot reload where a plugin can be replaced in place. Otherwise the UI prompts for a restart.
• Install results show the actual installed version. When an older version is installed because of a new-release cooldown policy, the UI explains it and offers an exact-version install.
• An experimental session-state recording interface for plugins to write and read their own session records.
• An experimental Claude Code Mods compatibility layer. The notes say its present purpose is to check that the Claude Code Mods API is roughly a subset of DeepSeek Harness plugins, and not to give users full compatibility.

Agent behavior

• Sub-agents can use a separate agent preset for role and tools.
• Better guidance on delegation depth and waiting for sub-tasks.
• A working_directory tool, plus read and switch interfaces in the TypeScript and Python SDKs.
• Global instructions can read an AGENTS.md from a shared agents directory set with DSH_AGENTS_HOME.
• A minimal mode that can read images and auto-compress long conversations. /compact compresses context manually in Web and desktop.
• An SSH helper runtime for remote file operations, processes, terminals and sandboxes.

Secrets

• Secrets and tokens in sent messages are detected and redacted by default, with a way to view them on demand.

Models

• Support for DeepSeek-V4.1-Flash-1017, and for DeepSeek Search and Fetch APIs, which can be turned on in Web Search settings (rc.2, October 17).
• Custom model APIs can set reasoning levels per model in the UI.

Stability

• Unfinished tasks are marked "task stopped" after an unexpected app exit, so they are not mistaken for finished.

I only list what the notes say. I did not test whether any of it works as described.

For plugin authors: compatibility is moving

Two things in the pages I read point the same way.

First, the README says: "THERE WILL BE COMPATIBILITY-BREAKING CHANGES."

Second, the alpha.4 notes say third-party plugin compatibility now checks engines.dsh first when a plugin declares it, and otherwise uses the existing rules. The notes tell plugin authors to check that the declared range covers the DSH versions they support.

A community discussion shows what this can look like. On October 24, a user who maintains a published third-party bundle reported that two public exports (settleRun and SettingsProvider.installSection) were removed between 0.1.5 and 0.2.1-rc.2, with no changelog entry they could find, and that one of them fails at ESM link time. I could only read the first part of that post, so I cannot confirm the second removal or the maintainers' response. Treat it as one user's report, not a verified defect.

If you ship a plugin, declare engines.dsh, pin the versions you test, and read each release's notes.

Security questions the pages leave open

These are gaps in what I read, not findings.

• The SAFETY.md page does not describe a plugin signing or review process. I did not find one in the README either.
• The release notes mention secret redaction in sent messages, but not what a plugin can read or send.
• Sandboxing and approval prompts are mentioned as risk reducers only. I did not read how they work in dsh.

Search results also showed community discussions titled as security reviews, including one about third-party plugins getting config write access at boot, and one titled as a third-party audit. I did not read them, so I make no claim about their content or their accuracy.

What I would check

These are my untested suggestions, not results.

1. A disposable environment. Run it in a VM or container with no real credentials, as SAFETY.md advises.

2. Plugin source. Before installing a plugin, read its repository and its package.json, including its engines.dsh range.

3. Official versus third-party. Compare what the Official plugin list gives you against what you actually need, and install the smaller set.

4. Redaction. Paste a fake token into a message and check whether it is masked, and what a plugin can still see.

5. Upgrade path. Pin the version, read the notes for each release candidate, and test your plugins on a copy before you upgrade.

What I would not conclude

• That 262,000 stars means it is safe or stable. The project says neither.
• That it is production-ready. SAFETY.md says it must not be treated that way.
• That the Claude Code Mods layer lets you reuse Claude Code Mods. The notes say it is an experiment to test a hypothesis.
• That the removed exports in the discussion are confirmed. I read one user's report.

Frequently asked questions

What is DeepSeek Harness?

An open-source agent harness from DeepSeek AI, MIT-licensed, built so that features are plugins. The command is dsh.

Is it ready for production?

The project says no. SAFETY.md calls it experimental developer-preview software that has not had a security audit.

How do I run it?

npx @deepseek-ai/dsh web starts a Web UI on 127.0.0.1:3080. You can also build from a repository checkout with pnpm.

Can it use other models?

The notes mention custom model APIs, with per-model reasoning levels, and support for DeepSeek-V4.1-Flash-1017. I did not check which other providers work.

Does it work with Claude Code plugins?

Not fully. The release notes describe an experimental Claude Code Mods compatibility layer whose main purpose is to test a design question, not to give full compatibility.

What breaks on upgrade?

The README warns of compatibility-breaking changes. One community report lists removed plugin exports between versions. I could not verify it fully.

Is the documentation available?

The README links to a documentation site. The English page I tried did not load for me on October 27, so I did not rely on it.

Sources

All pages read on October 27, 2026.

• deepseek-ai/deepseek-harness repository and README: description, license, run instructions, developer-preview notice, repository statistics.
• SAFETY.md: safety and sandbox limitations, responsible use.
• Releases: notes for 0.2.1 alpha builds and release candidates rc.1 to rc.3.
• Discussion #10864: one user's report on removed plugin exports, partly read, unverified.

Not read: the English documentation site, the Cordis paper, the CONTRIBUTING and architecture pages, and the security-related community discussions.