DeepSeek Harness (dsh) is an MIT-licensed open-source agent runtime from DeepSeek AI, released in developer preview as v0.1 on 13 August 2026. It's built on the Cordis plugin framework around one idea: everything is a plugin — the model adapter, the tool registry, the session log, the sandbox, the UI, and the agent loop itself.
ChatGPT Business and Enterprise are a managed AI workspace. Comparing them to Harness on model quality misses the actual decision, which is a category difference: one is software your team operates, extends, hardens, and upgrades; the other is a workspace your team configures and governs.
| Harness | ChatGPT Business/Enterprise | |
|---|---|---|
| Category | Open-source agent runtime | Managed AI workspace |
| Who operates it | You install, configure, upgrade, isolate, monitor | OpenAI operates the application |
| Data boundary | Depends on provider, gateway, tools, telemetry, log settings | Vendor-hosted; controls depend on plan and configuration |
| Time to first use | Technical setup plus a reviewed provider config | Faster onboarding across a workforce |
| Extensibility | Code-level plugins, tools, providers, custom gateways | Product features, connectors, supported APIs |
| Security ownership | Customer owns runtime hardening, isolation, permissions, upgrades | Shared, with more of the runtime on the vendor |
| Cost shape | No licence fee; API, infra, engineering, security, monitoring remain | Per-seat or contract; API billed separately |
A local UI is not a local data boundary
The Web UI listens on 127.0.0.1:3080 by default. That address tells you where the interface is, not where inference happens or where every data object goes.
Harness can route to the official DeepSeek API, to shipped third-party providers including OpenAI and Anthropic, or to custom OpenAI- and Anthropic-compatible gateways. Model routing is a configuration choice, which means the data boundary is a property of your configuration rather than of the word "self-hosted."
Map every path before you call it local: prompts, attachments, retrieved content, tool output, credentials, logs, generated artefacts.
There's one DeepSeek-specific setting worth finding before any pilot. The project documents an incremental session-log contribution behaviour on the official request extension, controllable under Settings → General. Find it, decide deliberately, and write down which content can leave the environment under the provider, tool, and contribution settings you plan to ship. That question — not the listening address — is the review.
ChatGPT is vendor-hosted, and OpenAI states Business, Enterprise, and API data isn't used for training by default. Consumer controls aren't substitutes for those terms, so procurement should read the business documentation rather than the help-centre page a user found.
The project's own safety notice is the strongest evidence you have
Harness shouldn't be treated as production-ready enterprise software in its current documented state. That isn't a reviewer's opinion — the official safety notice says it's experimental developer-preview software, hasn't had a security audit, and must not be considered secure or production-ready. It recommends least privilege and a disposable VM, container, or dedicated environment. The README warns, in capitals, that there will be compatibility-breaking changes.
"The vendor says don't run this in production" is a stronger finding than "we couldn't find an audit," and compensating controls don't convert it into an enterprise-safe claim.
Filesystem sandboxing is not isolation
The documented sandbox modes — read-only, workspace-write, danger-full-access — describe filesystem effects. They don't establish network or process isolation, enforcement can be partial on some backends, and danger-full-access bypasses confinement entirely.
| Control | What it governs | What it doesn't prove |
|---|---|---|
| Sandbox mode | File access and writes | Network or process isolation |
| Approval policy | When the agent asks before acting | That an approved action is safe |
| Container or VM | A separate runtime boundary | Safe mounts, credentials, or outbound access |
Permission presets layer approval behaviour on top: the shipped default pairs workspace-write with ask, the dangerous preset pairs danger-full-access with never. A UI label is not a security boundary, and a container's security still depends on mounts, network rules, credential scope, kernel exposure, and host integration.
What's genuinely good about it
The append-only session log is the part worth paying attention to. Everything the model sees — system prompts, reasoning, tool calls and results, subagent scheduling, every context injection — lands in one event stream, with a runtime invariant that anything in a model request must be reconstructible from the log. The Trajectory view inspects it by source, and runs can be resumed, forked, searched, and replayed against the same history.
For debugging why an agent went off the rails, that's the difference between guessing and knowing. If you need auditable agent execution records, it's unusually strong for open source — which is an odd pairing with preview-stage security, and worth holding both facts at once.
Agent Teams, the multi-session coordination capability, is experimental and opt-in, with Team mode off by default on new sessions. It supports delegation experiments. It isn't an enterprise control plane, and it doesn't remove the need for authorization boundaries, audit design, workload limits, failure handling, or human approval.
Cost is a workload question, not a rate comparison
The MIT licence means no software fee. Operating cost still includes model usage or inference, infrastructure, engineering, integration, security review, monitoring, incident response, upgrades, and support.
DeepSeek publishes off-peak and peak token rates across its current model lines, and ChatGPT publishes per-seat Business pricing with Enterprise on contact-sales — check both pages on the day you build the model, because DeepSeek's prices have already moved once since Harness launched. The lowest token rate doesn't produce the lowest annual cost, and seat pricing wastes money if users rarely open the tool. Model users, request volume, data classes, integrations, support hours, and expected change rate instead.
The honest version, which cuts against the interest of anyone selling engineering: if ChatGPT Business meets the requirement without custom integration, paying a team to build and operate a Harness platform adds cost and risk without creating differentiation. A managed workspace still needs identity rules, data classification, retention review, onboarding, monitoring, and exception handling — the vendor operates more of the stack, you still govern its use.
A short selection process
- Define one workflow and the decision it improves.
- Classify the data and map every processor and storage location.
- Name the runtime, security, and business owners.
- Estimate total cost using workload and support assumptions.
- Run a time-boxed pilot with exit criteria, on synthetic or low-sensitivity data.
- Review the evidence before expanding access or data sensitivity. Using both is fine when governance separates their jobs — approved data classes, providers, owners, integrations, and escalation paths for each. A vague "employees can choose" policy produces inconsistent data handling and duplicated spend.
Full guide — the decision matrix, sandbox and permission detail, and the TCO breakdown: https://teamvoy.com/blog/deepseek-harness-vs-chatgpt-an-enterprise-decision-guide/
Written by BYLINE_TO_CONFIRM, Teamvoy. More engineering writing at teamvoy.com/blog.
Top comments (0)