它到底是什么？
它不是一个只绑定 DeepSeek 模型的聊天壳，也不是普通的代码补全工具。官方将它定义为 Agent Harness：负责把模型、工具注册、会话记录、Agent 循环、权限策略和应用入口组合成可以运行的系统。
核心设计来自 Cordis。模型适配器、工具注册表、会话日志和 Agent 循环本身都是插件；配置中的插件树决定系统如何启动，卸载插件时相应注册也能撤销。官方提供 Web、headless、SDK、SDK minimal 与 ACP 等 profile，分别面向交互界面、一次性任务、程序调用和自动化协议。
为什么值得关注？
- 组合能力：不是在固定核心上添加少量扩展，而是让主要能力都成为可替换插件。
- 入口完整：既能运行 Web UI，也有 headless、TypeScript/Python SDK 与 ACP 入口。
- 适合实验：模型、工具、持久化、沙箱与审批策略可以通过 profile、bundle 和 patch 重新组合。
- 开源许可清晰：主仓库采用 MIT 许可证，并单独披露第三方依赖许可证。
五分钟怎么试？
安装 Node.js 后，官方最短入口是 npx @deepseek-ai/dsh web。它默认在本机 127.0.0.1:3080 启动 Web UI。首次评估建议使用一次性容器或虚拟机，不要直接开放主目录、SSH 密钥、生产凭据和重要代码仓库。
为什么是 80 分？
What is it?
This is not merely a chat shell tied to DeepSeek models or a conventional code-completion tool. The project describes itself as an agent harness: a runtime that composes models, tool registration, session history, agent loops, permission policy and application surfaces.
Cordis provides the architectural base. Model adapters, the tool registry, session log and agent loop are plugins, while a configured plugin tree defines the running system. Shipped profiles include Web, headless, SDK, SDK minimal and ACP for interactive, one-shot, programmatic and automation-oriented use.
Why does it matter?
- Deep composability: major runtime capabilities are replaceable plugins, not just extensions around a fixed core.
- Multiple surfaces: Web UI, headless execution, TypeScript and Python SDKs, plus ACP.
- Strong experimentation fit: profiles, bundles and patches can recombine models, tools, persistence, sandboxing and approval policy.
- Clear open-source terms: the main repository uses MIT and separately discloses third-party licenses.
How do you try it?
With Node.js installed, the shortest official path is npx @deepseek-ai/dsh web. It starts the Web UI on 127.0.0.1:3080 by default. Use a disposable container or VM for the first trial; do not expose a home directory, SSH keys, production credentials or important repositories.
Why 80?
| 维度 / Dimension | 得分 / Score | 当前依据 / Evidence |
|---|---|---|
| 实用价值 / Utility | 22/25 | 插件化运行时覆盖模型、工具、会话、策略与多个应用入口 |
| 可用程度 / Usability | 15/20 | 一条 npx 命令可启动，但配置体系面向开发者且仍会破坏兼容 |
| 项目健康 / Health | 14/15 | DeepSeek 官方维护、文档和中英文安全说明完整 |
| 热度动量 / Momentum | 15/15 | 发布时间短、公开关注极高；站内日增量从下一次快照开始 |
| 安全隐私 / Safety | 5/15 | 可执行生成代码、加载插件并访问文件、进程、网络和凭据，且尚未审计 |
| 成本 / Cost | 9/10 | 框架 MIT 开源；实际成本取决于模型、运行环境与维护投入 |
最大风险不是模型价格
官方安全说明比营销口号更重要：Harness 可以执行模型生成的代码与命令、加载第三方插件，并访问授予它的网络、进程、文件和凭据。审批、权限控制和沙箱只能降低风险，不能保证隔离，更不能保护已经允许访问的资源。
因此首轮测试应限制操作系统权限和挂载目录，使用短期凭据，逐项审查插件与命令，并保留可恢复备份。不要把它当成运行不可信任务的唯一安全边界。
适合谁，不适合谁？
适合：在构建 Agent 平台、研究可组合运行时、需要替换模型与工具链，或希望通过 SDK/ACP 嵌入现有系统的开发团队。
暂不适合：只想要稳定开箱即用编程助手的个人用户，以及要求版本兼容、安全审计和生产支持承诺的关键业务。
接下来观察什么？
- 首次公开快照后的 Star 与 Fork 增长是否持续，而非只看累计数字。
- profile、bundle 与插件 API 在破坏性迭代中的稳定速度。
- 第三方插件生态是否形成，以及审核、签名和供应链治理是否跟上。
- 沙箱、审批和凭据隔离在真实任务中的默认配置与绕过面。
来源与边界
架构、安装、开发阶段和风险判断来自 DeepSeek Harness 官方仓库、架构文档与安全说明；指标来自 GitHub REST API。本站尚未完成统一环境安装与任务实测，初评置信度 60%。
The largest risk is not model pricing
The official safety notice matters more than the tagline: Harness can execute model-generated code and commands, load third-party plugins, and access any network, process, file or credential made available to it. Approvals, permission controls and sandboxing reduce risk but do not guarantee isolation.
Limit OS privileges and mounted paths for the first trial, use short-lived credentials, review plugins and commands, and keep recoverable backups. It should not be the sole security control for untrusted workloads.
Who is it for?
Good fit: teams building agent platforms, studying composable runtimes, replacing model or tool layers, or embedding a harness through an SDK or ACP.
Not yet a fit: individuals who only want a stable turnkey coding assistant, or critical production workloads that require compatibility, security-audit and support commitments.
What should we watch next?
- Whether growth persists after the first public snapshot instead of relying on cumulative numbers.
- How quickly profile, bundle and plugin APIs stabilize through breaking iterations.
- Whether third-party plugin growth is matched by review, signing and supply-chain controls.
- Default sandbox, approval and credential-isolation behavior under real tasks.
Sources and limits
Architecture, setup, maturity and risk findings come from the official repository, architecture guide and safety notice. Metrics come from the GitHub REST API. We have not yet completed a standardized installation and task benchmark; initial confidence is 60%.