DeepSeek Harness Open Source Explosion: Deep Dive into Plugin Hot-Swapping Architecture

150K Stars Behind: A Fully Reconfigurable Coding Framework

In early 2025, DeepSeek shocked the AI world with its open-source reasoning model R1—using reinforcement learning to enable "self-thinking" and self-training, dramatically reducing training costs and being adopted by multiple labs within months. The Reinforcement Learning training paradigm employed by DeepSeek R1 differs fundamentally from traditional large models that rely on large-scale human-annotated data for supervised fine-tuning. During R1's training, the model interacts with its environment to receive reward signals, gradually learning to generate longer, deeper chains of thought. This "self-thinking" capability enables significant performance improvements on tasks requiring multi-step logic, such as mathematical reasoning and code generation, while training costs are only a fraction of comparable models. This technical approach was quickly adopted and replicated by labs including Meta and Alibaba.

Now, DeepSeek strikes again with the open-source release of its coding tool framework (hereafter referred to as DeepSeek Harness), directly competing with Anthropic's Claude Code. According to hands-on reviews by Bilibili content creators, this framework racked up over 150,000 GitHub stars in just a few days.

Its most striking feature lies in its underlying architectural philosophy: everything is a plugin. Tools, sandboxes, and Agent loops are all decomposed into replaceable modules that can theoretically be hot-swapped and hot-replaced at runtime without restarts. In software engineering, Plugin Architecture is a design pattern that decomposes system functionality into independent, replaceable modules, each communicating with the host program through standard interfaces. "Hot-swapping" further requires modules to be dynamically loaded and unloaded while the system is running, without downtime. While this architecture is widely used in IDEs (like VS Code's extension system) and browsers, applying it to AI Agent frameworks—enabling Agents to modify and reconfigure their own tool chains at runtime—remains a cutting-edge attempt. Built atop Codex (OpenAI's open-source command-line coding agent framework), this plugin system allows models to "reshape" the very framework they operate within during execution.

Full-Chain Traceability: A Debugging Powerhouse for Agents

The DeepSeek Harness team places significant emphasis on the web interface. For users accustomed to command-line tools like OpenCode and Claude Code, this web-first approach might seem off-putting, but it delivers a killer feature—Trace tracking.

In AI Agent development, "Observability" has always been a core pain point. Traditional chatbots only need to focus on inputs and outputs, but Agent systems involve complex internal states including multi-turn reasoning, tool invocations, and context management. When errors occur, developers often struggle to pinpoint root causes. The concept of trace tracking borrows from distributed systems' link tracing technology (such as OpenTelemetry), recording every decision step, tool call, and reasoning process of the Agent to form a complete execution chain. The industry already has dedicated Agent observability tools like LangSmith and Arize Phoenix, but they're typically bolt-on solutions requiring additional integration. DeepSeek Harness builds trace tracking directly into the web interface, dramatically lowering the barrier to entry.

After entering a basic prompt (like "how many files are in this directory"), instead of staying on the chat interface, you click "Trace" to see everything happening behind the scenes: the complete text of the initial system prompt, all tools available to the framework (web search, sub-agents, etc.), the user prompt, permission information and machine skills information injected by the framework to the model, plus the model's thought process, tool call decisions, and execution results.

Going further, you can export the complete conversation in JSON format to examine context injection counts, reasoning processes, tool usage, model evaluations, inference time, token consumption, and other metrics. Compared to many frameworks that deliberately hide these details, DeepSeek Harness's transparency is extremely developer-friendly for debugging Agents.

Model and Plugin Configuration: Flexible but Process Somewhat Cumbersome

Most operations are concentrated in the settings menu. Users can connect API keys from OpenRouter, OpenAI, and Anthropic, and also support custom providers to integrate local models like Ollama. OpenRouter is a unified AI model API gateway that aggregates the APIs of dozens of model providers including OpenAI, Anthropic, Google, and Meta under a single unified interface. Developers only need one API key to switch between different vendors' models without separately registering and managing accounts with each provider. Ollama is a local model running tool that supports deploying and running open-source large models (like Llama, Qwen, etc.) on personal computers for completely offline AI inference, suitable for scenarios with strict data privacy requirements. If you've already configured a specific provider's API key in your shell, the framework automatically reuses it without requiring re-entry.

A noteworthy detail—how web search is handled. By default, web search relies on the DeepSeek official API key and throws errors if not configured. The content creator's workaround is to use the official FireCrawl plugin. FireCrawl is a web scraping and search API service designed specifically for AI applications. Unlike traditional crawlers, it converts web content into structured, LLM-friendly Markdown text, automatically handling JavaScript rendering, anti-scraping mechanisms, and other technical obstacles. For AI coding Agents, web search capability is crucial—they need to consult the latest API documentation, search Stack Overflow for solutions, understand library version changes, etc.

The specific operation involves installing via npx command (you may also need to install PNPM first—a high-performance Node.js package manager known for its unique content-addressed storage strategy that significantly saves disk space and speeds up installation compared to npm. DeepSeek Harness's choice of PNPM as the backend plugin installation tool indicates its tech stack heavily relies on the Node.js ecosystem), manually editing the configuration file to add two lines of code, exposing a general web search tool (disabled by default), and finally restarting the framework to enable it.

This exposes a contradiction: what happened to "runtime hot-loading without restarts"? The answer is—hot-swapping only applies to dynamic plugins, while preset plugins like FireCrawl are "frozen" at conversation start and thus still require restarts.

Dynamic Plugin Hot-Swapping: Letting Models Modify the Framework Themselves

What truly embodies the "everything is a plugin" philosophy are dynamic plugins. The content creator demonstrated an interesting scenario: directly telling the model to "change the framework theme to black and orange." After the model completes it and you approve it in the interface, the theme changes instantly. This plugin was created by the model on the fly, so you can freely toggle it on and off without restarting the entire framework.

To make it persistent, simply have the model write the plugin to the configuration file—the model will create its own to-do list to complete the save, and it remains effective after restart. Additionally, the framework includes built-in PTC coding mode, minimal mode for handling simple tasks, and creator mode specifically for creating plugins.

Skills can be activated via slash commands or installed with npm; users can also leverage creator mode to craft custom Agent presets. A detail rare in other coding frameworks: it allows changing Enter key behavior—it can be queue or steer (interrupt the previous prompt to listen to the current prompt), with support for Command/Control + Enter to temporarily switch. This design reflects the framework's careful consideration of multi-turn dialogue interaction flows: when an Agent is executing a time-consuming task, users may need to urgently modify instructions. "Steer" mode allows users to interrupt the current execution flow and immediately respond to new, higher-priority requests.

Critical Vulnerability: Plugin Architecture Disconnected from Sandbox Security

Despite many highlights, the content creator bluntly points out core issues. First, rough experience at the surface level: cumbersome plugin installation process and lack of tool search and discoverability mechanisms like Claude has.

But the biggest problem is security vulnerabilities. The creator believes this plugin architecture actually addresses a "pseudo pain point"—they never mind restarting the framework to install or update plugins. Yet the cost it brings is quite high: the current plugin architecture is completely separated from the sandbox, with each plugin having full Shell access and file system access permissions.

Sandbox is a core concept in computer security, referring to executing untrusted code in an isolated, restricted environment where it cannot access sensitive resources of the host system. In AI coding tools, sandboxes are typically used to limit the execution scope of model-generated code—for example, Claude Code runs code in Docker containers or restricted shells to prevent accidental file deletion or key leakage. DeepSeek Harness's problem is that its plugin system bypasses the sandbox's security boundary: each plugin runs with the same permissions as the host process, freely accessing the file system and shell. This contrasts sharply with browser extension security models—browsers like Chrome design fine-grained permission declaration mechanisms for extensions (such as only allowing access to specific websites) and isolate extensions from the system through sandboxes. The lack of similar permission stratification and isolation mechanisms means a malicious plugin could theoretically read API keys from .env files, modify system files, or even execute arbitrary commands in the background.

Considering plugins are discovered and installed through GitHub, this means users could easily install a malicious plugin that can effortlessly read your API keys. While "agents can completely reshape the framework to suit their needs" sounds cool, this freedom comes at the cost of missing security boundaries.

Worth Watching but Not Yet a Claude Code Replacement

Overall, DeepSeek Harness is an exciting starting point for open-source coding frameworks: full-chain trace tracking, dynamic plugin hot-swapping, and model self-modification capabilities all demonstrate product thinking different from Claude Code. The 150K star buzz also confirms the community's strong appetite for open-source AI programming tools.

However, it's currently still in developer preview stage. The cumbersome installation process, lack of tool discoverability, and especially the security vulnerabilities from plugin-sandbox disconnection are unavoidable shortcomings. The content creator's final verdict: until these issues are fixed, they'll continue choosing Claude Code paired with FireCrawl. For ordinary users, perhaps now is more suitable for observation and experimentation rather than full migration.

Key Takeaways

• DeepSeek Harness is an open-source coding framework built on a "everything is a plugin" architecture with dynamic hot-swapping capabilities
• Built-in web-based trace tracking provides full visibility into Agent decision-making, tool calls, and reasoning processes
• Supports multiple model providers (OpenRouter, OpenAI, Anthropic, Ollama) with flexible configuration
• Dynamic plugins can be created and modified by the model at runtime without restarts; preset plugins still require restarts
• Major security concern: plugins run with full system permissions outside the sandbox, creating potential for malicious code execution
• Currently in developer preview with rough UX and missing tool discoverability features