On August 13th, DeepSeek open-sourced the layer that makes AI models interchangeable.
On August 16th, it raised the price of its own model by somewhere between 50% and more than 1,100%, depending on which tokens you’re buying and what time of day you buy them.
Most of the coverage noted that tension in a sentence and moved on to the star count. I think the tension is the story. You don’t give away the thing that commoditizes your product and simultaneously charge more for your product unless you’ve decided the product isn’t where the value is anymore.
What actually shipped
DeepSeek Harness — dsh — is an MIT-licensed agent runtime. Not a model, not an assistant. It’s the layer that decides how a model receives context, calls tools, edits files, keeps a session alive, and grinds through multi-step work without falling over. Anthropic has Claude Code. OpenAI has Codex CLI. Those are products. This is the same layer, unbundled and handed out.
The organizing idea is one sentence: everything is a plugin. Not “tools are plugins” — everything. Models, tools, skills, sessions, sandboxes, the filesystem layer, the orchestration, the UI, and — the part that made me sit up — the agent loop itself. The thing that decides what happens next is a swappable component.
Underneath sits an append-only session log that records system prompts, reasoning, tool calls and their results, and subagent scheduling. You can inspect a run, resume it, fork it, search it, replay it. One reviewer framed the guarantee well: model-visible means logged. If the model saw it, it’s on disk. That’s a runtime property, not a debugging feature bolted on afterward.
The reception was, by any measure, extraordinary. 22,000 GitHub stars in the first 90 minutes. As I write this, ten days in, deepseek-ai/deepseek-harness sits at 187,230 stars and 20,803 forks. A curated plugin list appeared two hours after launch. A third-party desktop client appeared four and a half hours after launch, and has 18,000 stars of its own.
The part that isn’t new
Here’s the detail I found most clarifying, and which almost nobody mentions: the plugin kernel isn’t DeepSeek’s.
dsh is built on Cordis, an independent open-source project by a developer who goes by shigma. Cordis has been the plugin kernel behind Koishi — a chatbot framework — since 2019. Seven years of production use, roughly 4,000 community plugins, mostly gluing bots to Discord and Telegram.
Cordis describes itself as a meta-framework of “spatiotemporal composability,” which sounds like marketing until you unpack it. Temporal: a component can be unloaded and its side effects reverted cleanly. Spatial: components declare and react to dependencies on each other. Load, unload, hot-reload, no restart.
Every plugin system claims modularity. Almost none of them can cleanly undo a component. That’s the hard half, and it’s the half you need if you want a system that can be modified continuously with little or no human oversight — an agent that rewrites its own configuration mid-run and doesn’t have to be rebooted to mean it.
So the foundation is seven years old and battle-tested in an adjacent domain. That’s a credibility point and a deflating one at once. The novel claim isn’t the kernel. It’s the decision to put the agent loop on top of a kernel built for hot-swapping chatbot plugins.
Where the lock-in actually lives
Ask where switching costs live in an agent stack and the intuitive answer is the weights. It’s wrong, and it’s been getting wronger for a year.
Models are already close to fungible at the API boundary. Tools got standardized by MCP. What’s left — the part that’s genuinely hard to walk away from — is the loop: the accumulated session history, the plugin configuration, the shape of how your team’s work gets decomposed, the trajectories you’ve built up. VentureBeat put it plainly: models can increasingly be swapped behind standardized interfaces, and the harness that controls how an agent reasons, invokes tools, edits software, and persists across a workflow is much harder to replace.
That’s the position DeepSeek just gave away for free.
Which sounds insane until you notice what MIT-licensing a runtime actually buys you: it makes your session format everyone’s session format. You don’t own the users. You own the shape of the thing. If a hundred thousand developers’ agent trajectories are dsh trajectories, the plugin contracts are the standard — and standards are a better position than margin. That’s the bet.
The bet only makes sense one of two ways
But there’s a wrinkle the tidy “commoditize your complement” reading skips over.
A model-agnostic harness commoditizes DeepSeek’s own model too. This isn’t Netscape giving away a browser to sell servers. DeepSeek is flattening the market it competes in, making its own weights just another slot in a YAML file — and then raising prices into that flattened market.
There are two honest readings, and I don’t know which is right.
The generous one: DeepSeek believes the format is worth more than the margin. Own how a hundred thousand agents are structured, and you can charge for the model later, from a position nobody else has.
The unglamorous one: inference economics finally caught up. The new numbers aren’t a repricing so much as a correction — V4-Pro went from $0.435 per million input tokens to $0.66 off-peak and $1.32 at peak, output from $0.87 to $1.98 and $3.96. The subsidy era ended, the price went where it had to go, and open-sourcing the harness is what you do when your price advantage evaporates and you need a different story.
Both can be true at once. The strategy reads the same either way from outside.
Everything is a plugin, except the part that isn’t
Slogans are load-bearing in this release, so it’s worth checking one against the source.
In a micro-kernel, the kernel decides what a plugin is. The contracts — the seams, their ordering, what a component may and may not override — are the one thing that is definitionally not pluggable. “Everything is a plugin” is a statement about who is replaceable, and the answer quietly excludes whatever defines replaceability.
To DeepSeek’s credit, the codebase is more honest than the slogan. The tool pipeline is genuinely well-engineered: a reorderable tools/pre-execute gate for allow/deny/ask policy, then monotonic guards that later listeners cannot turn back into permission, then an around-dispatch tools/execute wrapper for timeouts and retries, then tools/post-execute to inspect or replace results, then an observe-only notification at the end. Those distinctions are the difference between a security boundary and a suggestion, and somebody thought hard about them.
But not every seam that looks composable is. The filesystem write-intent slots look like the obvious place to hang a permission check — they carry a resolved path, they fire before the write. They hold exactly one decider, first-wins by registration order, and the default deployment occupies it and never yields. The package README says so outright: “This is not a composable authorization chain — layered permission/audit/sandbox interception belongs on tools/execute.” There is a test in the repo named “a SECOND write-intent decider registered AFTER fs-observation-policy is not reached.”
I like that this is documented. But it’s the shape of the problem to watch. When everything is a plugin, a plugin registered on the wrong seam loads clean, runs silently, and protects nothing. Uniform extensibility makes every extension point look equally load-bearing, and they aren’t.
Modularity has a token price
This is the part I haven’t seen anyone say, and I think it’s the most important structural criticism.
In ordinary software, modularity costs you a pointer indirection. A vtable lookup. It’s free, essentially, and that’s why we’ve spent forty years being told to decompose things.
In an agent, modularity costs you tokens on every single turn, forever — because the model has to be told what’s loaded. Every plugin that registers a tool announces itself in the context window. Every capability you make swappable is a capability you must describe, every turn, for the life of the session.
Independent testing measured dsh sending roughly 47,600 uncached input tokens against roughly 4,500 for Pi on the same model. Better than ten to one, on system prompt alone.
Some of that is a straightforward bug — duplicate injection of identical CLAUDE.md and AGENTS.md files, doubling the prompt outright — and bugs get fixed. But the floor underneath it is architectural. If your design principle is that every subsystem is independently swappable and self-describing, the model pays rent on that description continuously. Context is the scarcest resource an agent has. Spending it on the architecture instead of the problem is a real trade, and “everything is a plugin” makes that trade maximally.
The other early signals point the same way. 36Kr tried five tools from the new ecosystem and all five failed. The official compatibility list reads 41 genuine integrations against 219 needing further investigation. Two thousand plugin submissions in two days is a number about enthusiasm, not about working software.
What it could entail
Assume the rough edges get sanded down, because at this level of attention they will. What changes?
- The model becomes a slot you shop. Not a brand you adopt. If swapping providers is a config edit, per-task routing on price and capability becomes the default rather than an exotic optimization. That’s bad news for anyone whose moat was the assistant wrapped around the weights.
- Agent evaluation becomes possible for the first time. Right now “X is a better coding agent than Y” is close to unfalsifiable, because the model and the harness are welded together and you can’t vary one while holding the other still. A fixed harness with a swappable model plugin is a controlled experiment. That’s a genuinely new capability, and I suspect it produces some uncomfortable findings about how much of perceived agent quality was ever the model.
- Self-hosted models get a real runtime. The reason local models made unconvincing agents was rarely raw capability alone — it was that the good harnesses were bound to hosted APIs. An MIT-licensed, model-agnostic loop removes that as a structural barrier.
- The plugin supply chain becomes a serious problem. This one worries me. An MCP server is dangerous in a bounded way: it’s a tool behind a call boundary. A
dshplugin can replace the filesystem layer, or the guard deciding whether a write is allowed. Thousands of MIT-licensed plugins, 41 verified, and an extension model where a component can substitute the safety machinery — that’s a categorically different risk surface, and the ecosystem is growing far faster than anyone’s ability to review it.
What I’d actually do
Not adopt it yet. The reviewers recommending you wait three to six months are right: this is a developer preview with no on-disk compatibility promise, schemas explicitly subject to breaking change, a ten-to-one context tax, and an ecosystem where most third-party tooling doesn’t work on the first try.
But read it. The tool pipeline is a real piece of engineering, the append-only session log is the right default and I’d like to see it become table stakes, and the seam documentation is more candid about its own limits than most shipped software manages.
The release that matters here isn’t the code. It’s the assertion — made by a company with enough credibility to make it stick — that the harness is a layer, that layers get standardized, and that nobody should own the loop. DeepSeek published that claim and then priced its own model as if it believes it.
Whether they’re right is the interesting question. But I notice the argument only had to be made out loud once for a hundred and eighty thousand people to decide it was overdue.