10 practical sectionsCopy-ready examplesSafety-focused

The DeepSeek Harness guide, from zero to advanced

This is the main guide: setting up a workspace, connecting a model, writing instructions that actually work, configuring permissions safely, and using skills, plugins, MCP, subagents and workflows for large jobs.

Part 1

Understand these five core concepts first

Before typing your first instruction, learn these five terms. Understanding them removes most early confusion.

1. Workspace

The folder that is the agent's world. It reads and writes inside it; outside access is limited by the sandbox mode. Usually one project equals one workspace.

2. Model

The brain that interprets your instructions. DeepSeek Harness can use DeepSeek models, other providers (Anthropic, OpenAI, Kimi, GLM), your own gateway, or a local model.

3. Tools

Concrete abilities the model can call: reading files, running commands, searching the web, creating documents. You never call tools manually — the model chooses them.

4. Permissions (sandbox + approval)

Two safety dials: how wide the file access is, and whether risky actions need your approval. These keep the agent under control.

5. Sessions & context

Each conversation is a session with a context history. Long sessions can be slimmed by delegating to subagents so focus stays sharp.

Part 2

Setting up your workspace

  1. Create a dedicated folder for the job

    For example D:\work\quarterly-report. Put in it only files the agent may change.

  2. Turn on version control

    git init plus one initial commit is enough. Every change then becomes comparable or revertible.

  3. Point the agent at that folder

    With the CLI, run the command from inside that folder. With the web interface or desktop app, pick it via Choose workspace.

A habit that prevents trouble

Never place the workspace inside a directory holding credentials, SSH keys or customer data. If the work touches sensitive data, rehearse with sample data first.

Part 3

Connecting a model and API key

  1. Get an API key

    Create a key at platform.deepseek.com. Keep it in a password manager, not in a project note.

  2. Enter it in Settings → Models

    Paste the key into the DeepSeek Harness interface. It is stored in a local credentials file (inside $DSH_HOME, by default ~/.dsh) and no restart is required.

  3. Choose a model and reasoning level

    Faster models suit routine work; stronger models suit analysis and large refactors. Reasoning effort can be set from off, low, high up to max.

Model provider options
OptionWhen to useNotes
DeepSeek (default)General use with the most efficient cost.Includes fast models for light tasks and stronger models for heavy work.
Third-party providersWhen your organisation already has another subscription (Anthropic, OpenAI, Kimi, GLM).Added via “Add model provider”.
Your own gatewayWhen you need full control, logging or an internal proxy.Supports three protocols: openai-completions, openai-responses, anthropic-messages.
Local models (Ollama)When data must not leave your machine or network.Run through the Ollama integration; local model quality is usually below cloud models.
Choosing a model deliberately

For easily verified work (formatting, renaming, extracting data), use a fast model. For decisions that are expensive to get wrong (data migration, large refactors), use the strongest model at a high reasoning level and ask for a plan first.

Part 4

Writing instructions that produce good work

Output quality is driven by how you ask. These four patterns almost always improve results: state the goal, the constraints, the output shape, and the verification.

Instruction comparison
Less effectiveMore effective
“Fix my site.”“In src/, find every internal link pointing to a 404, fix them to correct relative links, then list the changes.”
“Write a report.”“From data/sales.xlsx, produce a two-page Word report: summary, table by region, three recommendations. Include the totals.”
“Research competitors.”“Find the five leading competitors in Indonesia, compare pricing and features in a table, and include source links I can verify.”
  • Name the folders or files that may be touched — and those that may not.
  • Specify the output shape: a table, a Word file, a change list or a short summary.
  • Ask the agent to verify itself, for example by running tests or reopening the result.
  • For risky work, ask for a plan first without changing any files.
  • Split large jobs into rounds you can review.
contoh perintah lengkap
Tujuan: rapikan struktur folder dokumen/ agar konsisten.
Batasan: jangan ubah isi berkas, jangan hapus apa pun, hanya pindahkan dan ganti nama.
Keluaran: tabel berisi 'lama -> baru' plus skrip yang bisa saya jalankan sendiri.
Verifikasi: setelah selesai, daftar berkas yang tersisa di dokumen/ dan pastikan jumlahnya sama.

This four-line pattern works for almost any task.

Part 5

Configuring permissions: sandbox and approval

Raise permissions only when the work truly needs it. A safe progression: start at read-only, move to workspace-write for daily work, and use danger-full-access only for tasks that genuinely require access outside the workspace.

Permissions and risk summary
SettingMeaningRisk
read-only + askRead only; out-of-bounds actions request approval.Lowest. Ideal for exploration.
workspace-write + askFree writes inside the workspace; sensitive actions still ask.Moderate. The best choice for most work.
danger-full-access + neverFull filesystem access with no prompts.High. Use only when you understand the consequences.
When approval is unavailable

Requests that cannot be approved are rejected (fail-closed) rather than silently executed. If a task fails without a clear reason, first check whether the sandbox mode or approval policy blocked it.

Part 6

Using skills for repeatable procedures

A skill is a markdown file holding your procedure. Written once, the agent follows it every time that task appears — no re-explaining. Skills can live inside a project (project-scoped) or in your user folder (all projects).

SKILL.md
---
name: format-laporan
description: Standar penulisan laporan internal perusahaan.
---

# Aturan
- Judul maksimal 60 karakter, tanpa singkatan.
- Wajib ada ringkasan eksekutif maksimal 150 kata.
- Semua angka menyertakan satuan dan periode.
- Simpan hasil ke laporan/ dengan nama YYYY-MM-judul.docx.

Skill names use lowercase and hyphens (kebab-case).

Locations that are read

The .dsh/skills or .agents/skills folder inside the project, the user skills folder in $DSH_HOME, and skills bundled with the app.

Invoked manually or automatically

The agent loads a skill when relevant, and you can invoke it as a command when the skill is marked user-invocable.

Part 7

Adding plugins and MCP servers

There are two ways to extend DeepSeek Harness: plugins (for developers writing TypeScript) and MCP (for users configuring an existing server). Configuration is layered: bundled packages, then your profile, then additional patches.

cordis.patch.yml
# ~/.dsh/profiles/web/cordis.patch.yml
- insert:
    - id: mcp-crm
      name: "@deepseek-ai/dsh-mcp-client"
      config:
        serverName: crm
        transport: stdio
        command: "npx"
        args: ["-y", "@perusahaan/mcp-crm"]
        env:
          CRM_TOKEN: "${CRM_TOKEN}"
# Tool akan muncul sebagai mcp__crm__cari_pelanggan

Replace the server name and command with your own. Tools appear as mcp__<server>__<tool>.

Start with MCP, not plugins

If your goal is simply “connect the agent to an internal system”, MCP is almost always faster. Write a plugin only when you need a truly custom tool or your own UI panel.

Part 8

Subagents and workflows: working in parallel

When work grows large — dozens of files, many sources, several viewpoints — do not pile it all into one conversation. Split it across agents. The simplest route is asking for a subagent; the most powerful is writing a workflow script.

workflow.js
// workflow: audit semua berkas panduan secara paralel
const files = args.files;              // daftar berkas dari argumen
phase("Audit berkas");
const results = await pipeline(
  files,
  (file) => agent(`Periksa ${file}: cari tautan mati dan klaim usang.`, { label: file }),
  (finding, file) => agent(`Verifikasi temuan pada ${file}: ${finding}`, { label: "verifikasi " + file })
);
return results.filter(Boolean);

A workflow script takes a list of items, runs each through stages, and returns structured results.

When to use a subagent or a workflow
SituationChoice
Need one summary from a different angle, quickly.Satu subagent.
The same job repeated across 20–200 items.Workflow dengan pipeline.
Need a final result combining every finding.Workflow dengan tahap penggabungan.
A long command (build, download, migration).Background job.
Part 9

Productive routines and safety rules

Morning routine

Open a fresh session, ask for a summary of changes since yesterday, then set three priorities for the day. A new session keeps context clean.

Before approving

Read the command requesting approval, especially anything changing files outside the project or deleting something.

Always ask for verification

End large tasks by asking for self-verification: running tests, reopening documents or cross-checking numbers.

Save knowledge as skills

Every time you repeat the same explanation, turn it into a skill. Within a month your team has a procedure library the agent can use.

Remember the experimental status

DeepSeek Harness is developer preview software. Changes between versions can break older configuration. Record the version you use, test upgrades in a scratch folder, and never depend on one workflow without a fallback.

Part 10

Troubleshooting common problems

Symptoms and fixes
SymptomLikely causeWhat to do
The agent refuses to write a file.Sandbox mode is still read-only.Raise it to workspace-write if writing is genuinely needed.
The agent only discusses, never acts.The request was too vague or too broad.Name the folder, files and desired output shape.
Answers drift in a long session.Context is saturated.Start a fresh session or split the work into subagents.
Model calls fail.Wrong API key, exhausted quota or network trouble.Check the key in Settings → Models and the provider's status page.
MCP tools do not appear.The configuration was not loaded in the active profile.Confirm the plugin row sits in the correct profile, then reload.

Need help rolling out DeepSeek Harness?

Free consultation with Andi to choose the right setup, prepare a workflow, or review safety before your team adopts it.

Contact Andi — +62 897-6003-363
Call Andi WhatsApp