DeepSeek Harness runs on your machine. So where does it think?

Say you are looking for an AI that actually does work, not one that only chats. You want it to open files in your work folder, summarize documents, or fix code on its own. Then you come across DeepSeek Harness. It is open source, it comes from a lab that builds its own models, and it installs with one command. Type npx @deepseek-ai/dsh web and a web page opens at 127.0.0.1:3080, which is your own computer.

Everything seems to stay at home. Then the obvious question follows: if you drop in a file with customer data, does that data really stay on your machine?

At Productize we answered that by running DeepSeek Harness version 0.2.2-rc.1 in a container (a small, sealed-off environment, separate from your real computer, that you can delete when you are done) and watching where the program connected, while also reading the project's code. We were evaluating it for our own agent work.

What we saw by running it ourselves is limited to the results in Part 4 under "What we saw when we ran it", plus the default values the program printed, listed in "Start here" at the end. Everything else, the strengths, the gaps, and the settings to change, we read from the code and docs and have not tried ourselves, so it carries less weight than what we saw with our own eyes.

Part 1What DeepSeek Harness is, and how it differs from a chat app

DeepSeek Harness is a program that lets an AI model do work on your machine by itself. A chat app can only reply in a text box: you copy content in, then copy the answer back out yourself. In dsh, the agent reads and edits files in your work folder, runs commands, hands subtasks to other agents, and plans on its own. Before anything that needs permission, the web page asks you first.

To picture it, a chat app is like an advisor you talk to on the phone. A harness is like handing an assistant the keys to your office. A lot more work gets done, and there is a lot more to think about too, starting with which rooms that key opens.

On cost, the program is free but the model it calls is not. The default is the deepseek-flash model through DeepSeek's API, which charges per token (a small unit of text, roughly a word or part of a word) and deducts from a balance you top up in advance. According to DeepSeek's pricing page, which we checked on November 9, 2026, at peak hours the text you send in costs $0.30 per million tokens and the text the model writes back costs $1.20 per million tokens. Other hours cost half. DeepSeek can change its prices, so check that page again before you top up.

There are several ways to use it, and they are all the same program with different settings. dsh calls each set of settings a profile. The commands below are typed into a command line window (Terminal) and need Node.js installed first.

• Web page Open it with npx @deepseek-ai/dsh web
• Command line Run a single task with dsh --profile headless "your task". You get the answer and it exits.
• Desktop app The same thing as the web page, wrapped in Electron
• Python SDK (pip install deepseek-harness-sdk) For calling it from your own program

The name says DeepSeek, but it is not tied to DeepSeek's models alone. You can set it to use a DeepSeek API key, a DeepSeek account, or ready-made models like Anthropic, OpenAI, Kimi, and GLM. You can also point it at a model server you run yourself, as long as it speaks the same format as OpenAI or Anthropic. If you set nothing, though, the default is DeepSeek's own deepseek-flash model.

The project is upfront about its status from the first page. The licence is MIT, the program is in developer preview, and the README says in capital letters "THERE WILL BE COMPATIBILITY-BREAKING CHANGES", meaning a new version may not work with what you built on an old one.

Part 2The good parts worth taking

1. A permission system that says "no" when nobody answers

This is the part we like most. When the agent wants to do something that needs permission, the system sends the question to whoever is meant to answer it. If nobody is waiting for that question, or the program receiving it crashes midway, the answer is "not allowed", not "go ahead". An odd answer that is not on the list of accepted answers also counts as a refusal. An approval works once only. And if you set the approval policy to never, every request is refused straight away, before anyone is asked.

Our view is that a permission system that lets things through when nobody answers is more dangerous than having none at all, because people assume someone is watching. dsh gets this right.

2. Everything is a plugin

The web page, the command line, and the SDK are not separate programs. They are different sets of plugins stacked together, so you can add or remove capabilities one piece at a time. Install more plugins with dsh plugin --profile <name> add <package>. The plugin marketplace is still experimental, and the docs themselves say the program only checks the file format, not whether a plugin is safe. Read any plugin from elsewhere yourself before you install it, every time.

3. Scheduled, repeating work

You can have the agent work on a schedule, through the Automation tasks page or by simply telling it. Set a task to run once, or on a repeat like "every weekday at 9 a.m." (it uses the RFC 5545 calendar standard). Scheduled tasks survive a restart. If runs are missed while the machine is off, it runs the most recent missed one, once, when the program comes back. But know this: when the program closes, the schedule stops too.

4. MIT licence

You can use it commercially and modify it, as long as you keep the copyright notice. Also worth opening is THIRD_PARTY_NOTICES.md, because some bundled components carry their own terms, such as the Claude SDK and LibreOffice parts. If you plan to ship it inside your own product, go through them one by one.

5. Honest about risk

SAFETY.md says plainly that the project has not had a security audit, that it should not be used as a production system, and that the sandbox and approvals only reduce risk rather than block everything. On testing, it has a suite that runs the sandbox on real operating systems in its automated test system (CI), not only against mocks. Reading that made us trust the project more.

Part 3What is missing, and how ready it is

Going through the list of packages in the project, we looked for the part that remembers, and did not find one. Each conversation's history is saved and searchable, but nothing yet remembers things about you from one task to the next. The docs include an example of connecting an outside memory server through MCP (a common standard for plugging tools into AI), but they say themselves that it is only a connection example, not a promise that it works well.

Chat channels are the same story. You can talk to dsh through the web page, the command line, the desktop app, and the SDK, but there is no LINE, Discord, or WhatsApp. If you want customers to message you on LINE and have the agent reply, you have to write the connector yourself.

BENCHMARK.md is telling too. The whole file is 231 bytes. It explains how to run a benchmark yourself, with no scores, no speeds, and no pass rates at all. So for now, no number tells you how good dsh is. If you want to know whether it handles your work well, you have to measure it on your own real tasks.

On readiness, the short answer is that it is still a preview for developers, and the next version may change enough to break what you built. The SDK itself checks that the SDK version and the program version match exactly. If you embed it in your own work, pin the version on both sides and do not let either update itself to the latest release.

Part 4If you change nothing, where does your data go?

If you change no settings at all, the prompts you type are sent to DeepSeek's cloud model to think about, not processed on your machine. The program runs locally, but the thinking happens somewhere else. And it is not only what you type. Whatever file the agent opens also reaches the model in the next request, because tool results have to go back to the model so it can keep working.

How we checked

1. Started a fresh container (node:22-bookworm) and installed @deepseek-ai/dsh@0.2.2-rc.1 from npm, the same package anyone would install.
2. Ran tcpdump to record every time the machine looked up a web address (DNS) and every time it started a connection to another machine.
3. Tested the recorder first by calling example.com, which it caught. This step matters, because a broken recorder reports "nothing went out", which looks exactly the same as nothing really going out.
4. Ran dsh --profile headless "Reply with the single word OK." without changing a single default.

What we saw when we ran it

On the first run we gave it no API key (the code that proves who you are to the model provider). dsh stopped immediately with MISSING_CREDENTIAL: llm-deepseek: no API key for provider route "deepseek-official", and the recorder saw no outbound connection at all. That is good: it does not quietly call anything before you set it up.

On the second run we gave it a fake key that starts the way a real one does. The recorder saw the machine look up api.deepseek.com right away. The program asked api.deepseek.com/models for the list of models and was refused (HTTP 401) because the key was fake, then sent our prompt anyway. The reply said the key was invalid and came with a request reference number. At that point it was clear that the prompt really did reach DeepSeek's servers.

The part we watched most closely was telemetry. The settings the program printed do point to a server, dsh-otel-collector.deepseeksvc.com, but the mode is set to FEEDBACK_ONLY. In both the normal run and the run with telemetry turned off, there was not a single connection to deepseeksvc.com. The docs explain that this mode only sends something when you give feedback, such as rating or editing a message. Credit to DeepSeek for not sending all the time. Know this too, though: each time you give feedback, what gets sent is the whole conversation up to that point.

What we read in the code but did not confirm by running

The thing that gave us most pause is in the sandbox. The default for the web page and the command line is workspace-write, which means it can only write files inside the work folder and a temporary folder. That sounds safe, but reading files and connecting to the internet are not restricted at all. On macOS this boundary allows everything as a base and then blocks writing, so secret files outside the work folder can still be read. On Windows and some older Linux versions, the program itself reports that it can only partly enforce this.

Next is the sdk-minimal profile, which is what the Python SDK uses in its examples. It is set to danger-full-access and comes with no permission system. If you call it from your own program and add nothing, the agent can do anything on your machine. The permission system we praised in Part 2 is simply not there.

Then there is the session log. If you use a model through DeepSeek's API, by default dsh attaches the part of the session log it has not sent yet to the next request. The docs say what goes out may include messages, tool results (including the contents of files the agent read, so that content leaves a second time), and file paths on your machine. You can turn it off at Settings → General → Upload Session Log when using the official model API. Our recorder only saw where traffic went, not what was inside the requests, so we could not confirm this by running it. It only applies when you use DeepSeek's models.

The rest is smaller. The web search tool uses DeepSeek's search service by default. The web fetch tool works without asking each time, and it can reach even other machines on your home or office network. The desktop app turns on app usage analytics and checks for updates every 10 minutes by default.

Part 5Before customer data: which settings to check

If it were us, before putting in any customer data, we would go through the 7 items below one at a time. They fall into 2 groups. Items 1 to 5 you can change yourself. Items 6 and 7 need help from someone who can run Docker, such as a freelance developer or your company's IT person. What you ask them for fits in one sentence: "Please run dsh in a container that can see only this work folder and reach only the model server, then prove with fake data that nothing leaks anywhere else." The first group cuts down what gets sent out, but on its own it is not enough for customer data. If you do not have a helper yet, keep customer data out and use dsh on non-sensitive files for now. You can see every default with dsh --profile web --dump-default-config. This command only prints the settings. It does not start the program.

One more thing to say plainly: getting all 7 items right still does not mean you comply with data protection law. Settings only tell you where data goes. The legal basis, how long data is kept, and sending data across borders all need a separate look.

On DeepSeek's side, we read 2 documents. The first is the privacy policy, last updated February 10, 2026. It says 3 things.

• Personal data is stored and processed in China.
• What you type in is kept for as long as you have an account.
• Data about the users of apps that developers build on the open platform is not covered by this policy.

That last point sent us to a second document, the open platform terms of service, in effect from April 29, 2026. On data, these terms say only 3 things.

• Data you send to the API still belongs to you.
• DeepSeek assigns its rights in the output to you.
• If you send your customers' personal data, you must get your customers' consent yourself for passing it to DeepSeek to process.

The terms also say clearly that disputes fall under Chinese law. But they answer none of these 4 questions.

• Which country stores the data you send through the API?
• How long is it kept?
• Is it used to train models?
• Can you ask for it not to be used for training?

If these 4 questions matter for your work, get written answers from DeepSeek before you send any customer data.

Part 6Should you choose DeepSeek Harness?

Yes, if your work is trying out an agent on non-sensitive files, or you want a well-designed permission system to study. Not yet, if you need something stable for production, or you plan to use it with customer data before a helper has set up an isolated box for you. Changing settings in the program alone is not enough. Find your kind of work in the table and see which side it lands on.

For our own agent work, we chose to borrow some ideas, especially the permission system that refuses when nobody answers and the schedule that survives a restart, but not to move the whole system over. We had a second AI (Codex) read the same version of the code separately, without seeing our notes. It only read the code and did not run it, and it reached the same conclusion we did: do not move the whole system over yet, and take only some pieces, such as the permission system.

Start here

Before you try it on real work, open the command line and type dsh --profile web --dump-default-config. Look for provider, searchProvider, session-log-deepseek, session-telemetry-otel, and sandbox-policy. These 5 values tell you where your data will travel, before you put in your first file. Below are the defaults we saw when we ran it, and what to change before using it with customer data. The number in brackets is the item in the Part 5 checklist.

• provider: the default is deepseek-official (model deepseek-flash). Change it to a provider that passes the test in item 1.
• searchProvider: the default is deepseek-official. If the job does not need the internet, turn off the web search and web fetch plugins (item 3).
• session-log-deepseek: the docs say the default is to send the session log to DeepSeek when you use DeepSeek's model. Turn off Upload Session Log in Settings → General (item 2).
• session-telemetry-otel: the default is FEEDBACK_ONLY mode, sending to dsh-otel-collector.deepseeksvc.com. Turn it off by setting DSH_TELEMETRY_DISABLED=1 before starting the program (item 4).
• sandbox-policy: the default is workspace-write. Change it to read-only (item 5).

If your work involves customer data, go through the Part 5 checklist one item at a time, starting with item 1, switching the model. As long as you use DeepSeek's model, every message you type goes to DeepSeek.

Read next: Before an agent acts, someone has to approve it first, AI data privacy: a three-layer defense for using AI without leaking secrets, Agent harness: how to tell which guardrails have expired, Best local LLM for coding? Choose by the job