DeepSeek Harness (DSH) explained, with a first-run guide

Checked on 2026-11-09. This page is based on the DeepSeek Harness README, safety notice and user docs, and on the DSH Go README. We have not installed or run either project ourselves: every command and UI path below comes from the official documentation and has not been verified by us. DSH is in developer preview (the latest npm release when we checked was 0.2.2-rc.1), and the project says plainly that compatibility-breaking changes will happen, so treat the linked sources as authoritative.

DeepSeek Harness (command name dsh) is an open-source agent harness from DeepSeek AI. It is not a new model. It is the runtime that lets a model read and write files, run commands, call tools and keep a plan. Its stated design is "everything is a plugin", built on the Cordis plugin framework. The most direct way to use it is a local Web UI, and it also has headless, SDK and ACP modes.

DSH Go is an unofficial, community-built Android client. Its README states that it is not affiliated with DeepSeek. It can install a Linux environment on the phone and run DSH there, or connect to DSH on your computer or server. This page covers the official DSH first, then DSH Go, then how the two relate.

For our source review, see the DeepSeek Harness profile and the DSH Go profile.

Read the safety notice first

The official repository asks you to read SAFETY.md before running it. In summary (our paraphrase of the vendor's text):

• DSH is experimental developer-preview software. It has not had a security audit and must not be treated as secure or production-ready.
• It runs model-generated code and commands, loads third-party plugins, and can reach the network, processes, credentials and files made available to it. Wrong model output, defects, misconfiguration, malicious input or untrusted plugins may damage the host, change or delete files, or leak data.
• Sandboxing, approvals and permission controls reduce risk but do not guarantee isolation.
• The vendor recommends least privilege, a disposable VM, container or dedicated environment, and backups of anything it can reach.

Our suggestion: for a first run, use a directory that contains only a test project, or run it inside a VM.

Step 1: Install and start the Web UI

There are two official ways, both needing Node.js. The repository package.json and the npm package declare Node >= 24.9.0, so check node -v first; an older Node may fail to start.

Run from npm (try this first):

npx @deepseek-ai/dsh web

This starts the Web UI at http://127.0.0.1:3080 and opens your browser on a local launch; --no-open starts the server only. When launched over SSH it just prints the URL, because your SSH client or editor owns the forwarded local port.

Run from source:

git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build
pnpm dsh web

pnpm run build prepares the artifacts and pnpm dsh web uses them without rebuilding. The repository pins pnpm 11. See the official README.

Mind the directory you start in. dsh uses the directory it was launched from as its default file location, so run it inside the project you want it to work on, not your home directory.

Step 2: Configure a model

With the Web UI running, open Settings → Models:

• DeepSeek: enter an API key from the DeepSeek platform on the DeepSeek card and save. It takes effect without a restart.
• Other providers: choose "Add model provider". Built-in entries include anthropic, openai, moonshotai (Kimi) and zai (GLM); enter the key.
• Relays, company gateways or self-hosted servers: switch to "Custom model API" and enter a Provider ID, base URL, protocol and models. There are three protocols: OpenAI Chat Completions, OpenAI Responses and Anthropic Messages; pick the one the gateway actually speaks. The Provider ID is permanent: to rename, add a new provider and delete the old one.

Keys are write-only in the UI and stored in $DSH_HOME/.credentials.yaml. When started with dsh web, model settings are written to $DSH_HOME/profiles/web/cordis.patch.yml, which you can also edit directly.

Cost: the software is free under the MIT license; model calls are billed by whichever provider you use. We do not quote prices here. See the official model configuration guide.

Step 3: Choose a workspace and run a first task

A fresh Web UI has no workspace selected, and the composer stays disabled until you select one. Click "Choose workspace", add the project directory where you started dsh, select it, and start a session. The official example begins with a read-only task:

Summarize this repository and identify its main packages.

According to the docs, the agent can read and edit workspace files, run commands, delegate work and keep a plan, and the Web UI asks before operations that need approval under the active permission policy. See the Web UI guide.

Permissions and sandbox: defaults and limits

DSH bundles a sandbox mode and an approval policy into named presets, shown as one Permissions picker. Per the permission presets doc, the default table has two entries:

An experimental Auto option (from the Auto review plugin) combines full file access with asking when required.

Know what the sandbox covers. Per the sandbox doc:

• The sandbox governs file effects only; network access and process visibility are outside it.
• Backends are bwrap/Landlock on Linux, Seatbelt on macOS and restricted ACL tokens on Windows. Older Landlock ABIs and the Windows backend report only partial enforcement and must not be treated as an absolute boundary.

So even under workspace-write, keep production credentials out of anything it can reach.

Other ways to run it

dsh web is one entry point. Per the CLI doc, the same dsh command also supports:

Plugins are ordinary npm packages, and plugin authors are asked to tag their repositories with the dsh-plugin topic. Check where a plugin comes from before installing it: the safety notice names untrusted plugins as a main risk. The repository also contains Electron desktop source (apps/desktop), but the latest GitHub release had no installer attached when we checked.

Reaching the Web UI from another device

The Web UI listens on loopback only, so other devices cannot reach it by default. The documented approach is a reverse proxy plus --public-url and --trusted-host, or --tls-cert and --tls-key to serve HTTPS directly. The printed URL contains an access token, so share it only with people you trust, and never expose it over plain HTTP on the public internet. See the reverse proxy guide.

DSH Go: DSH on an Android phone

DSH Go is an Android client by community developer ccch1mneyyy, written in Flutter. The main code is AGPL-3.0; sdk/ and examples/ are MIT. Its README states that it is an unofficial community project, not affiliated with DeepSeek. The latest version when we checked was v1.0.13.

It works in two ways:

• Run on the phone: the app installs Ubuntu, Node.js and the DSH runtime inside itself, with no root or Termux; allow about 1 GB. The engine runs on the phone, but model requests still go to the provider you configure, need a network connection and are billed as usual: running locally does not mean offline.
• Drive DSH on your computer: connect over SSH or through the community project DSHarness Remote. Remote-only use needs no local runtime on the phone. The README notes that DSHarness Remote supports fewer features: image attachments only, no in-app web view, and plugin management limited to on/off.

Install: Android 8.0 or later. Download the APK from GitHub Releases; most phones need the arm64 build, and there is no 32-bit ARM build. It is not on Google Play, so you must allow installs from that source; there is no iOS or HarmonyOS version yet. Builds signed differently from early test builds cannot install over them, and uninstalling clears chats, the Linux environment and settings.

Before you use it (all from the DSH Go README):

• "Send anonymous usage statistics" is on by default; turn it off in onboarding or under Settings → Privacy & sharing.
• With phone control enabled, the local engine can read the screen, tap and type; screen text needed for a task may go to the model, and vision models may receive screenshots. The author advises against lifting restrictions on a device holding payment or banking details.
• Share links are end-to-end encrypted, but anyone with the full link can read and save the content.

How they relate, and which to use

In short: DSH Go does not replace DSH; it runs DSH. Get the official Web UI working on a computer with npx @deepseek-ai/dsh web first, confirm your model and permission settings, and only then decide whether you want DSH Go on your phone. If you just want a quick look from a phone browser, the 0.2.2-rc.1 release notes say the Web UI's phone and tablet layout was improved, and the reverse proxy setup above works for that too, with the same care for the access token.

FAQ

Is DSH a new model?

No. It is a harness and you connect your own model. DeepSeek's API is the default, and Anthropic, OpenAI, Kimi, GLM or any gateway speaking one of the three supported protocols also work.

Why isn't DSH in this site's "released this week" list?

When we checked, every DSH release on GitHub was a pre-release (alpha or rc), and the "released this week" section of the trending page counts stable releases only.

Can I use it in production?

The official safety notice says it must not be treated as secure or production-ready, and the developer preview will have compatibility-breaking changes.

Is DSH Go made by DeepSeek?

No. Its README says it is an unofficial community project, not affiliated with or representing DeepSeek.

Sources

• DeepSeek Harness repository and README
• DeepSeek Harness documentation site
• Safety notice SAFETY.md
• Web UI guide, model configuration, reverse proxy deployments
• Permission presets, process sandbox, CLI modes
• DeepSeek Harness releases
• DSH Go repository and README, DSH Go releases