DeepSeek Makes the Agent Loop a Plugin, and Sends the Bill to Anyone Who Forked One

DeepSeek open sourced the DeepSeek Harness on Thursday, a Node.js agent runtime published on GitHub as a developer preview under an MIT license ^[1]. The notable design choice is not the tool inventory but the claim that the agent loop itself is a plugin, alongside the model adapter, the tool registry and the session log, each of them replaceable ^[2].

The project's documentation states there is "no privileged core to patch," and that extending the harness means mounting a plugin next to the others ^[3]. That phrasing is aimed at a specific kind of pain. Orchestration is the part of an agent stack teams most often need to change and least often can: retry policy, when to compact context, when to hand off to a subagent, what counts as a turn. If that logic currently lives in a fork of somebody's control loop, the cost is not the fork, it is the perpetual rebase. Declaring the loop a mount point is an assertion that this cost is optional.

Whether it is optional depends entirely on how stable the plugin boundary turns out to be, and the harness is a developer preview ^[1]. A replaceable loop behind an unstable interface is the same maintenance burden with better vocabulary. The architecture rests on Cordis, described as a meta-framework for "spatiotemporal composability," with a recent paper by three researchers from Peking University and DeepSeek as its basis ^[4].

The shipped presets show what the composition buys. Standard is the full coding agent, with filesystem tools, shell access, web search, subagents and a plan mode; Minimal cuts to two tools, bash and str_replace_editor ^[5]. Code mode changes the interface rather than the toolset: instead of exposing tools as individual function calls, it generates a TypeScript SDK and lets the model write a program against it, so a sequence that would take five round trips runs as one ^[6], an 80 percent reduction in round trips for that case ^[7]. Creator mode inherits Standard and adds runtime inspection, plugin experiments and preset-authoring guidance ^[8].

The constraint that makes the plugin story auditable is the append-only session log: anything that reaches a model request must be reconstructable from it, and resume, fork, replay, transcripts, telemetry and the web UI all read that single event stream, so any new model-visible input requires a new session event ^[9]. Sandboxing is enforced per platform, with the local backend wrapping subprocesses in Linux Landlock through a Node addon DeepSeek wrote, macOS Seatbelt, or a Windows ACL restricted-token runner ^[10].

Nothing ties the harness to DeepSeek's models. The provider catalog covers Anthropic, OpenAI, AWS Bedrock, Microsoft Azure and Google's Gemini Enterprise Agent Platform, which the documentation still calls Vertex, plus DeepSeek's own endpoint and custom OpenAI-compatible gateways ^[11], six named providers in one repo ^[12]. Two subagent providers delegate work to Anthropic's Claude Code and OpenAI's Codex by resolving each binary from the host PATH, with install and login left to the user, and both switched off by default ^[13]. Bridges run an existing hooks.json from either product against the harness's interception points, which the README calls a compatibility path rather than the better design ^[14]. There is an MCP client, Agent Client Protocol support, and the harness reads AGENTS.md and CLAUDE.md ^[15].

The repo took more than 33,000 GitHub stars within a few hours ^[16], and DeepSeek says it cannot accept external pull requests at the moment, directing contributors to GitHub Discussions and to writing plugins instead ^[17]. The company also says packages in the official repo are not inherently more important than community ones ^[18]. Those two positions sit awkwardly together: a project whose entire pitch is that no component is privileged is currently the only party who can change any component in-tree.