DeepSeek Harness vs Claude Code: same quality, one-seventh the tokens

Introduction

A harness, literally, is the tack and reins you put on a horse. In AI it means the execution layer wrapped around a model: the model does the thinking, the harness gets the thinking safely into the world — calling tools on the model's behalf, managing files, controlling permissions, holding context. Claude Code is Anthropic's model inside Anthropic's reins; those reins are not open source, and they will not let you swap in somebody else's horse.

On 13 August, DeepSeek open-sourced the reins themselves, announcing that "everything is a plugin" and that any model can be harnessed. Two months on, the community directory lists 13,160 plugins, a third-party benchmark measured it finishing Claude Code's work on one-seventh the tokens, and it has taken its first high-severity vulnerability at CVSS 9.4.

Understanding the move takes one sentence: DeepSeek gives away the reins in order to sell the feed. Anthropic makes money on subscriptions, so the more closed the harness and the tighter the user is locked in, the better — its reins are merchandise. DeepSeek makes money selling tokens, so the wider the harness spreads the more API calls follow — its reins are a giveaway. Reins have always done the arithmetic for whoever owns them; whichever harness you pick, you are spending money according to that company's business model. What follows works the sentence out in data.

1. Is this genuinely hot, or manufactured?

Genuinely hot, and hot in an unusual shape.

Related Reddit discussion runs to 248 posts and 12,166 upvotes, with negatives at only 8.1% — against 12.7% negatives for the DeepSeek brand itself, Harness is one of this company's rare pieces of purely additive good news this year. Three posts landed on launch day (327 upvotes, 247, 247), and eight days later the v0.1.1 release post charted again. The clearest signal that it has moved in, though, is a joke post: on day four, the community built it a "Liang slider" theme skin, which took the highest score in the whole slice at 1,224 upvotes. People who decorate a tool intend to live in it (inference).

The most informative piece of praise is the "Insanely Good" post and its 190 comments. The author wanted a message relay running over SimpleX, an encrypted messaging protocol — and rather than wait for a community plugin or read the docs, had the agent write the integration itself, stressing the point in capitals: "BY SIMPLY ASKING IT TO". The other recurring verdict is "unopinionated": it has not been welded shut into a coding assistant, so you can shape it into an agent of any form (attributed).

Two thorns are just as real. One is lodged in security: on 24 August came "it escaped from the working directory" (126 upvotes, 187 comments, the loudest thread in the slice), and on 10 September a security advisory gave it a formal designation — CVE-2026-82533, CVSS 9.4: an agent inside the sandbox can reach back and switch its own sandbox off (confirmed). The horse undid its own reins. The second thorn is preview-stage roughness: sub-agents are "buggy" (user's words, attributed), and the project itself warns of breaking changes to come.

2. How well does it work? Same horse, different reins, seven times the difference

The community had its suspicions well before this. Three weeks before launch, a user ran the same DeepSeek V4 Flash through three harnesses — Claude Code, OpenCode and Pi — on their own workload: output quality came out broadly identical, while elapsed time differed by nearly 4x (308 upvotes, 158 comments; personal experiment, attributed). After DSH shipped, the third-party platform Composio turned this into a formal benchmark (1 September, confirmed): 30 hard real-application tasks (Gmail, Sheets, GitHub, PagerDuty and others, on real accounts, scored on end state), six harnesses all driving the same DeepSeek V4 Pro, with a 900-second cap per task. The results:

In plain terms: quality in the same band (one task apart, which at n=30 carries no statistical weight), 6% slower, and token consumption at one-seventh. The cleanest single-point comparison is the PostHog task, which both got right: Claude Code burned 428,677 tokens, DSH burned 53,243 — same horse, same answer, eight times the context.

The strangest cell in that table is the tool-call row: Claude Code takes fewer actions (11.7 against 14.2) and still spends 7.3x the tokens. It is not doing more work; it is simply carrying the whole suitcase at every step. And how much luggage goes along on each step is precisely the harness's job.

Why did the two companies choose opposite answers here? Put the revenue structure in and the answer stops being flattering: Anthropic sells tokens at a high price, so a profligate harness causes it no pain; [DeepSeek sells tokens at floor prices](/insights/deepseek-analysis), so its harness has to count every one or the "cheap" label does not hold up. DSH has one further proprietary interlock: the project says it shapes requests to maximise hits against DeepSeek's native cache, with KV cache hit rates as high as 99.93% (vendor's own figure) — and DeepSeek's API discounts cached input. The tighter the execution framework meshes with the price list, the thinner the bill.

Some users read it the other way: V4 Pro only shows its real level in DSH's minimal, zero-noise mode (74 upvotes, attributed) — the overhead of the execution framework itself is a genuine argument, and the four preset modes the project ships are its answer to that argument.

3. If you are on Claude Code: should you switch?

Don't ask which is better; look at the structure of your bill first. The data sorts people into three groups.

Worth testing seriously: pay-as-you-go, high task volume, budget-sensitive. Your numbers are $0.028 against $0.074 — a 2.6x difference in cost per success, and 7.3x in tokens. If you burn three figures of dollars a month on agent tasks, that spread pays for a new GPU. Reddit already carries first-hand posts of "6 minutes, one pass, $0.07" (304 upvotes).

Worth holding still: security-sensitive and compliance settings. The CVSS 9.4 sandbox self-release landed on day 28 after launch, and Tencent's Zhuque Lab has already published a paper assessing its resistance to prompt injection (on arXiv). Before handing it production credentials — email, code repositories, ticketing systems — wait for the 1.0 security model, or at least for how the next CVE is handled. The same goes for the plugin ecosystem: the community directory says so itself, that inclusion is not an endorsement of safety.

Fine to stay put: speed over cost, deeply tied into the Claude ecosystem. Claude Code is still the fastest of the six harnesses (305 seconds against 324), and if your hourly rate dwarfs your token bill, 6% faster is its entire case — and a sufficient one.

Choosing a harness has become a question of position. Use DSH and the savings are yours; use Claude Code and the extra spend becomes Anthropic's revenue. Neither company is lying to you. Their reins simply serve different masters (judgement).

4. If you build AI tools: wiped out, or time to get on board?

Two fates, then a bucket of cold water everyone shares.

For third-party clients — companies that wrap a model in a usable interface and execution environment — the verdict is in, with execution suspended. A crop of these companies grew up around cheap models over the past year, and a user put their whole reason for existing in one line back in April: "DeepSeek v4 is cheap, but unusable without the execution tooling around it — so I'm still here" (original post, a small post at 2 upvotes and the single densest piece of information in the slice). Once the official tool arrived, that reason for existing was annexed for free: the UI gets praised, the cache interlock is something nobody else can reproduce, and it is open source besides. Users are discussing migration openly ("replacing zcode once sub-agents are fixed", attributed). What is left for these companies is vertical depth — compliance packaging for one industry, private deployment for one class of enterprise. The window for the purely general-purpose client is closing (judgement).

For plugin builders the upside is real, but read the expiry date. Getting on board is crude in its simplicity: tag a GitHub repository dsh-plugin, write a README explaining how it works with dsh, and you are in the ecosystem directory — no store review, no revenue share, no platform negotiation. 13,160 plugins in 34 days, across 13 categories, ranked on real stars (community site's own figures). The leading plugins (memory, reasoning enhancement, desktop) have already built up star pools of their own. For the first time an independent developer can catch official-ecosystem traffic with a weekend's work.

But that SimpleX case from section one shows its other face here: when that user needed a new integration, they did not go looking in the plugin directory — they had the agent write one on the spot. If an agent can generate integrations on demand, then the directory's boom is itself a transitional state: these 13,160 plugins may be the last generation of plugins written mainly by humans (judgement, and arguable — quality and long-term maintenance of complex plugins still need people, and on-the-spot generation currently only covers shallow integrations). The operational reading for plugin founders: take the money while the window is open, and move toward what an agent cannot write any time soon — private data sources, industry compliance logic, services that require an operational commitment. The moat around a shallow glue layer is measured in months.

Three platform risks everyone who boards shares: ① breaking changes are announced in writing, so maintenance cost cannot be budgeted before 1.0; ② if your plugin takes off, the project can build the same capability into the next version, and nothing commits it not to; ③ "everything is a plugin" is also "everything is attack surface", and the trust cost with enterprise customers gets spread across every plugin author.

5. What this move tells us: the harness war has opened

Why would a model company give away for free what another sells? Because the two business logics differ at the root, and what you sell decides what you give away. Anthropic sells subscriptions: the more closed the harness and the more exclusive the experience, the steadier the monthly fee, so Claude Code is a product and it charges. DeepSeek sells tokens: any tool will do so long as the call lands on its API, so the harness is a channel, and giving it away is the better trade — that line from April, "cheap but unusable", was its business-opportunity memo. Give away the reins, sell the feed; the more usable and more widespread the reins, the more feed moves. This is structurally identical to its play at the model layer: open weights buy an ecosystem, the ecosystem buys standard-setting position, and now the same script runs again at the execution-framework layer — down to the theoretical packaging being the same recipe (the Cordis kernel rests on a programming-languages paper co-authored by Peking University and DeepSeek, "A Programming Paradigm for Spatiotemporal Composability", confirmed).

Enlarged, this is the first shot of the harness war. Scores at the model layer have converged to touching distance (the top arena places are separated by single-digit percentages), and the next fight over the entry point is at the execution-framework layer: whoever's harness becomes the default execution environment of the agent era stands on the road all token traffic must take. The industry sensed it early — the argument that "it's the harness, the model is fine" was already circulating in June (confirmed) — and DeepSeek is simply the first model vendor to turn the hunch into an open-source product.

The soft spot is also on display, and it is bound to the genes of this model: an integrated closed-source harness can trade closure for a security boundary, while an all-plugin open-source harness hands the boundary to the community. Taking a CVSS 9.4 on day 28, with the content of the flaw being precisely "the horse undid its own reins", is almost a cautionary fable written to order for this model: you can give away the reins, but once given away, how tight they are held is no longer up to you (judgement). The DeepSeek brand already carries trust debt with the general public (this project's brand report of 29 September: NSS of -34.1 on content-safety topics), and if Harness accumulates a security record in enterprise settings, the old "cheap but we daren't use it" narrative will revive on a new product.

A verifiable bet to leave on the table, to be read back in twelve months: if the harness war is real, the Claude Code camp will be forced within a year to pick one of two moves — open up (open-source some components, or accept third-party models) or cut prices. If neither happens, the experience moat around the closed-source route is deeper than this article estimates, and you are welcome to bring this piece back to settle up (judgement).

FAQ

Is DeepSeek Harness actually cheaper to run than Claude Code? On the one third-party benchmark available, substantially. Composio ran 30 real-application tasks through six harnesses on the same DeepSeek V4 Pro: Claude Code averaged 649,900 tokens per task against DeepSeek Harness's 88,562, which is one-seventh, and cost per shared success was $0.074 against $0.028. Pass rates were 19/30 and 20/30, a one-task gap that carries no statistical weight at n=30.

Is it safe to give DeepSeek Harness access to production systems? Not yet, if the setting is security-sensitive or regulated. On day 28 after launch it took CVE-2026-82533 at CVSS 9.4, a flaw in which an agent inside the sandbox can switch its own sandbox off, and Tencent's Zhuque Lab has published an arXiv paper assessing its prompt-injection resistance. The project also announces breaking changes before 1.0, and the community plugin directory states that inclusion is not an endorsement of safety.

Why would DeepSeek open-source a harness when Anthropic sells one? Because the two companies sell different things. Anthropic sells subscriptions, so a closed, exclusive harness protects the monthly fee and Claude Code is a paid product. DeepSeek sells tokens, so any tool is acceptable provided the call lands on its API, which makes the harness a distribution channel worth giving away. DSH also shapes requests to maximise hits on DeepSeek's native cache — the project claims KV cache hit rates up to 99.93%, and cached input is discounted on its API.