It is the program that wraps a DeepSeek model so the model can do real work: read files, run commands, keep a plan, and stop to ask you first. DeepSeek released its own one, called dsh, as open source.
The same model can do much better or worse depending on the harness around it, the way one engine performs differently in different cars. That is why benchmark reports say which harness they used.
Example task: "Login tests fail. Fix them." Watch the harness pass work between you, the model, and the tools until the job is done.
The harness receives your message. Nothing has happened yet.
Calls the model, runs what it asks for, feeds the result back, repeats.
Read file, edit file, run command, call an API or MCP server.
Picks what fits in the model's window each turn and shrinks old parts.
System rules and skills that shape how the model behaves.
Sessions, plans and saved state so work can resume later.
A policy says which actions need your approval first.
Keeps commands the agent runs away from the rest of your machine.
Tests and linters that tell the agent whether it actually succeeded.
dshIllustration. The README only says "everything is a plugin". The labels are capabilities named in DeepSeek's docs, not a confirmed list of built-in plugins.
dshThe product above. DeepSeek built both the engine and the car.
The harness stays the same and only the engine changes. DeepSeek's docs list these as supported:
"Harness" also means the test rig used to score models. Different job, same word.
| Agent harness | Eval harness | |
|---|---|---|
| Job | Lets a model act on real work | Measures a model on fixed tasks |
| Changes the score? | Yes. It is part of what gets tested. | No. It is the measuring tape. |
| Examples | dsh, Claude Code, Codex CLI, Terminus | lm-evaluation-harness, SWE-bench grader, Terminal-Bench |
Real example from the DeepSeek-V3.1 model card: SWE-bench Verified 66.0 was run in DeepSeek's "internal code agent framework", and Terminal-bench 31.3 in the Terminus 1 framework. Each score belongs to the model and the harness together.
dsh were not read: its built-in plugin list, its SAFETY.md, and the details of its permission model.dsh feature by feature with Claude Code. Press calls it an "alternative"; that is framing, not a test.