---
title: "Run DeepSeek Harness on a remote server"
description: "DeepSeek Harness's web app on an always-on exe.dev VM: private behind your exe.dev login, with DeepSeek V4.1 Flash and no API key to paste."
url: https://exe-staging.dev/deploy/deepseek-harness
category: "AI agents"
updated: 2026-10-31
---

# Run DeepSeek Harness on a remote server

DeepSeek's agent in a browser tab, on a computer that never sleeps.

- **Software:** DeepSeek Harness (https://deepseek-harness.github.io/deepseek-harness/)
- **Source:** https://github.com/deepseek-ai/deepseek-harness
- **License:** MIT
- **Time:** 5 minutes
- **Example VM name:** `my-dsh` (yours will differ; on the VM, `hostname` prints it)
- **Machine-readable:** https://exe-staging.dev/deploy/deepseek-harness/manifest.json

## What you get

- DeepSeek Harness's web app at `https://<vm>.exe.xyz:3080/`, behind your exe.dev login and DeepSeek Harness's own sign-in link.
- DeepSeek V4.1 Flash through exe.dev's LLM integration, with no API key to paste.
- A project folder at `~/project` on persistent disk.
- A service that keeps running when you close the tab and comes back after a reboot.

Running on the VM:

- **DeepSeek Harness**: `dsh web`, managed by systemd, port 3080, data in `~/.dsh`
- **Your project**, data in `~/project`
- **DeepSeek V4.1 Flash**: Connected through exe.dev's LLM integration

How it is reached:

- https://my-dsh.exe.xyz:3080/ (private): DeepSeek Harness in your browser, after a one-time sign-in link
- ssh my-dsh.exe.xyz (private): your terminal

## Deploy with Shelley

Open https://exe-staging.dev/new?prompt=Set%20up%20DeepSeek%20Harness%20on%20this%20VM%20by%20following%20the%20exe.dev%20recipe%20at%20https%3A%2F%2Fexe-staging.dev%2Fdeploy%2Fdeepseek-harness.md%20from%20top%20to%20bottom.%0A%0AThe%20recipe%27s%20example%20VM%20name%20is%20my-dsh.%20This%20VM%27s%20name%20is%20the%20output%20of%20%60hostname%60%3A%20use%20it%20wherever%20the%20recipe%20writes%20my-dsh.%20Skip%20the%20step%20that%20creates%20the%20VM%3B%20you%20are%20on%20it.%0A%0AYou%20are%20done%20when%20all%20of%20these%20are%20true.%20Check%20each%20one%20yourself%3A%0A-%20DeepSeek%20Harness%27s%20web%20app%20at%20%60https%3A%2F%2F%3Cvm%3E.exe.xyz%3A3080%2F%60%2C%20behind%20your%20exe.dev%20login%20and%20DeepSeek%20Harness%27s%20own%20sign-in%20link.%0A-%20DeepSeek%20V4.1%20Flash%20through%20exe.dev%27s%20LLM%20integration%2C%20with%20no%20API%20key%20to%20paste.%0A-%20A%20project%20folder%20at%20%60~%2Fproject%60%20on%20persistent%20disk.%0A-%20A%20service%20that%20keeps%20running%20when%20you%20close%20the%20tab%20and%20comes%20back%20after%20a%20reboot.%0A%0ARun%20the%20VM-side%20commands%20in%20%22Start%20DeepSeek%20Harness%22%20and%20%22Open%20it%20in%0Ayour%20browser%22.%20If%20~%2F.dsh%2Fprofiles%2Fweb%2Fcordis.patch.yml%20already%20holds%0Amore%20than%20%60%5B%5D%60%2C%20add%20the%20two%20rows%20to%20it%20instead%20of%20replacing%20it%3B%20same%20for%0A~%2F.dsh%2F.env.%20Keep%20%60dsh%20web%60%20on%20its%20default%20127.0.0.1%20address%20and%20never%0Arun%20share%20set-public.%20Verify%20with%20the%20%60dsh%20headless%60%20command%2C%20check%20that%0A%60systemctl%20is-enabled%20dsh-web%60%20prints%20enabled%20and%20%60systemctl%20is-active%0Adsh-web%60%20prints%20active.%20Skip%20the%20optional%20sections%20%28own%20DeepSeek%20key%2C%0Asuperagent%29%20unless%20the%20owner%20asks.%20Finish%20with%20the%20sign-in%20link%20from%0Athe%20journal%20command%20in%20%22Open%20it%20in%20your%20browser%22%3B%20this%20conversation%20is%0Aprivate%20to%20the%20owner.%0A%0AFinish%20with%20the%20URLs%20I%20should%20open.%0A to create a VM whose agent, Shelley, follows this recipe. From a terminal:

```sh
curl -fsSL https://exe-staging.dev/deploy/deepseek-harness/prompt.txt | ssh exe.dev new --prompt=/dev/stdin
```

Or follow the steps below by hand.

[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`)
is DeepSeek's open-source agent: it reads and edits files, runs commands,
and works through long tasks in a desktop app, a terminal, or a web app.

This guide runs the web app, `dsh web`, on an exe.dev VM that stays on.
exe.dev's [HTTPS proxy](/docs/proxy) keeps it private to your exe.dev
account, so there's no tunnel to set up, and DeepSeek V4.1 Flash comes
through exe.dev's [LLM integration](/docs/integrations-llm) with no key on
the VM. DeepSeek Harness is a developer preview, so expect changes.

## Start DeepSeek Harness

On your computer, create a VM and connect. Pick any free name; if you've
already clicked Deploy or have a VM, skip the first command and use its name:

```bash
ssh exe.dev new --name=my-dsh
ssh my-dsh.exe.xyz
```

On the VM, install Node.js 24 and DeepSeek Harness:

```bash
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
sudo npm install -g @deepseek-ai/dsh@0.2.1-rc.5
```

Point DeepSeek Harness at exe.dev's LLM gateway, which serves DeepSeek V4.1
Flash through Fireworks. The gateway needs no key, but DeepSeek Harness
wants one set, so `EXE_LLM_KEY` is a placeholder:

```bash
mkdir -p ~/.dsh/profiles/web ~/project
echo 'EXE_LLM_KEY=not-a-secret' >> ~/.dsh/.env
cat > ~/.dsh/profiles/web/cordis.patch.yml <<'EOF'
# DeepSeek V4.1 Flash through exe.dev's LLM integration: no API key on the VM.
- id: llm-pi-ai
  config:
    providers:
      exe-llm:
        displayName: exe.dev
        api: openai-completions
        baseURL: https://llm.int.exe.xyz/fireworks/inference/v1
        apiKeyEnv: EXE_LLM_KEY
        models:
          - id: accounts/fireworks/models/deepseek-v4p1-flash-1017
            name: DeepSeek V4.1 Flash 1017
            contextWindow: 1048576
            input: [ text, image ]
            compat:
              thinkingFormat: deepseek
            reasoningEfforts:
              off:
              high: high
              max: max
          - id: accounts/fireworks/models/deepseek-v4p1-flash
            name: DeepSeek V4.1 Flash
            contextWindow: 1048576
            input: [ text, image ]
            compat:
              thinkingFormat: deepseek
            reasoningEfforts:
              off:
              high: high
              max: max
- id: agent-default-model
  config:
    provider: exe-llm
    model: accounts/fireworks/models/deepseek-v4p1-flash-1017
EOF
```

Check that a model answers. `dsh headless` uses its own profile, so pass the
web profile's settings:

```bash
cd ~/project
dsh headless --patch ~/.dsh/profiles/web/cordis.patch.yml "Reply with exactly: OK"
```

## Open it in your browser

Run `dsh web` as a service, so it keeps going when you disconnect and starts
again after a reboot. It stays on its default address, 127.0.0.1:3080, and
exe.dev's proxy brings it to `https://my-dsh.exe.xyz:3080/`, behind your
exe.dev login. `--trusted-host` lets that address through DeepSeek Harness's
own host check:

```bash
sudo tee /etc/systemd/system/dsh-web.service >/dev/null <<'EOF'
[Unit]
Description=DeepSeek Harness Web UI
After=network-online.target
Wants=network-online.target

[Service]
User=exedev
WorkingDirectory=/home/exedev/project
ExecStart=/bin/bash -lc 'exec dsh web --no-open --trusted-host "$(hostname).exe.xyz" --public-url "https://$(hostname).exe.xyz:3080/"'
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now dsh-web
```

Print the sign-in link:

```bash
journalctl -u dsh-web -o cat | grep 'dsh web:' | tail -1
```

Open it. The token in the link signs your browser in for 30 days, and works
until the service restarts; after that, print the new one the same way.
Accept the preview notice, open the `project` folder as your workspace, and
give it a task, such as "Write index.html for a one-page website for a bakery
that only sells sourdough."

<img src="https://exe-staging.dev/deploy/deepseek-harness/web.png" alt="DeepSeek Harness in the browser: a finished task that wrote index.html for a sourdough bakery, with DeepSeek V4.1 Flash 1017 as the default model" width="1280" height="720" loading="lazy">

Close the tab whenever you like; running tasks keep going on the VM.

## Use your own DeepSeek key

Optional. DeepSeek V4-Pro and DeepSeek's own API need a
[DeepSeek API key](https://platform.deepseek.com/). Keep it off the VM with
an [HTTP proxy integration](/docs/integrations-http-proxy) that adds it to
every request. On your computer:

```bash
ssh exe.dev integrations add http-proxy --name deepseek --target https://api.deepseek.com --header x-api-key:YOUR_DEEPSEEK_KEY --attach vm:my-dsh
```

On the VM, send DeepSeek Harness's DeepSeek provider through it, with a
placeholder key, and restart:

```bash
echo 'DEEPSEEK_API_KEY=not-a-secret' >> ~/.dsh/.env
cat >> ~/.dsh/profiles/web/cordis.patch.yml <<'EOF'
- id: llm-deepseek
  config:
    baseURL: https://deepseek.int.exe.xyz/anthropic
EOF
sudo systemctl restart dsh-web
```

DeepSeek-V4.1-Flash and DeepSeek-V4-Pro then show up under **DeepSeek** in
the model picker. We checked that DeepSeek Harness sends its requests and
key header this way, but haven't run it with a real DeepSeek key.

## Add the superagent

Optional, and early. On Oct 31, DeepSeek published
[dsh-superagent](https://github.com/deepseek-ai/dsh-superagent-prototype), a
service that watches GitHub notifications for a dedicated agent account and
answers issues and mentions with comments and pull requests. Its README calls
it a research prototype, not an official DeepSeek product. It needs a
separate GitHub user account (not an app) on github.com.

It runs as a second DeepSeek Harness profile on port 3082. On the VM,
install pnpm and build it:

```bash
sudo npm install -g pnpm@11
git clone https://github.com/deepseek-ai/dsh-superagent-prototype.git ~/dsh-superagent
cd ~/dsh-superagent
pnpm install && pnpm build
dsh superagent --from-default-profile web --dump-config > /dev/null
dsh plugin --profile superagent add "link:$PWD"
```

Give the new profile the same model settings, and the port and state folder
from its
[deployment guide](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/docs/006-deployment.md):

```bash
mkdir -p ~/.dsh/state/superagent
{ cat ~/.dsh/profiles/web/cordis.patch.yml; cat <<EOF
- id: webserver
  config:
    host: 127.0.0.1
    port: 3082
- id: dsh-superagent
  config:
    stateDir: $HOME/.dsh/state/superagent
EOF
} > ~/.dsh/profiles/superagent/cordis.patch.yml
```

Its `scripts/dsh-superagent` helper finds the service by process name, and
Node.js 24 names it `MainThread`, so `status` reports a running service as
down. Until that's fixed upstream, patch your copy:

```bash
sed -i "s/('node', 'dsh')/('node', 'dsh', 'MainThread')/" scripts/dsh-superagent
```

The rest is accounts and settings, which its
[SETUP.md](https://github.com/deepseek-ai/dsh-superagent-prototype/blob/main/SETUP.md)
has an agent walk you through one step at a time. Ask DeepSeek Harness (or
[Shelley](/docs/shelley)) on the VM: "Read SETUP.md in ~/dsh-superagent and
set up dsh-superagent with me." It has you create the agent's GitHub account
and sign it in with `gh`, starts the service in tmux, and sets up an hourly
check that restarts it.

Its settings panel only accepts requests to localhost, so open it through an
SSH tunnel. On your computer:

```bash
ssh -L 3082:localhost:3082 my-dsh.exe.xyz
```

In that session, print its sign-in link and open it on your computer:

```bash
grep -h 'dsh web:' ~/dsh-superagent/.artifacts/*.log | tail -1
```

We built and started the service on a VM and it waited for setup as
expected; we didn't create a GitHub account for it, so we haven't seen it
answer an issue.

## Frequently asked questions

### Is DeepSeek Harness ready for real work?

It's a developer preview: DeepSeek warns of breaking changes, and its [safety notes](https://github.com/deepseek-ai/deepseek-harness/blob/main/SAFETY.md) say the agent runs model-generated commands and recommend a disposable machine. An exe.dev VM is one: keep secrets you care about off it, and copy it with `ssh exe.dev cp my-dsh my-dsh-backup` before big changes.

### What does it cost?

Your [VM plan](https://exe.dev/pricing) plus model usage, billed through the [LLM integration](/docs/integrations-llm). With your own DeepSeek key, DeepSeek bills you for those models instead.

### Can I use the desktop or phone apps?

Harness Desktop runs on your own computer, not on a VM, and we haven't tested it against one. The web app works in any browser, phones included, once you've opened the sign-in link there.

### How do I update DeepSeek Harness?

On the VM, run `sudo npm install -g @deepseek-ai/dsh@latest`, then `sudo systemctl restart dsh-web`. Read the [releases](https://github.com/deepseek-ai/deepseek-harness/releases) first: preview releases can change settings. Your sessions and settings in `~/.dsh` stay put.

### Something's not working. Where do I look?

`journalctl -u dsh-web -e` shows the service's log. `No API key for provider: exe-llm` means `~/.dsh/.env` is missing `EXE_LLM_KEY`. A blank page or `403` usually means the address you opened isn't the one in `--trusted-host`; open the link the journal prints.

### How do I back up my work?

Commit and push your code. Sessions and settings live in `~/.dsh`. For a copy of the whole VM, run `ssh exe.dev cp my-dsh my-dsh-backup` on your computer.


## Related

- [Run OpenCode on a remote server](https://exe-staging.dev/deploy/opencode.md): Every model, one VM, and an agent that works while your laptop sleeps.
- [Self-host Hermes Agent](https://exe-staging.dev/deploy/hermes-agent.md): An agent that remembers you, on a computer that never sleeps.
- [Run the Pi coding agent on a remote server](https://exe-staging.dev/deploy/pi.md): An agent that doesn't ask first, on a computer that can take it.
- [Run Codex on a remote server](https://exe-staging.dev/deploy/codex.md): A computer for Codex. An early night for your laptop.
- [Run Claude Code on a remote server](https://exe-staging.dev/deploy/claude-code.md): A computer for Claude. A breather for your laptop.
- [Host OpenClaw](https://exe-staging.dev/deploy/openclaw.md): An AI sidekick with its own computer. Your laptop can take a nap.