Deep Agents: an off-the-shelf agent harness reverse-engineered from Claude Code

What it is

The first line of the Deep Agents README is "the batteries-included agent harness" - an opinionated agent that runs out of the box, where every piece can be extended, overridden or replaced. MIT licensed, Python (with deepagents.js), built on LangGraph, so streaming, persistence and checkpointing are inherited rather than rewritten. Around thirty thousand stars, and one of the few projects in our harness coverage that explicitly names itself a harness.

The acknowledgement is the key to reading it: "Inspired by Claude Code: an attempt to identify what makes it general-purpose, and push that further." So the methodology here was reverse engineering - take a closed, widely respected coding agent apart, ask "which few things are actually responsible for it handling long tasks", and turn that answer into an open, model-agnostic skeleton.

The answer it found: four things bundled in

The README states the three-layer split plainly: LangGraph is the graph runtime, LangChain's create_agent is a minimal harness on top of it, and Deep Agents is "the same building blocks, but with filesystem, sub-agents, context management and skills bundled in". Those four are what it identifies as the source of generality:

Bundled capability	What it replaces	Why long-horizon work cannot do without it
Filesystem (pluggable local / sandboxed / remote backends)	Stuffing every intermediate result into context	The output of long work is files, not messages. Once on disk, context holds pointers and the window stops filling with intermediates
Sub-agents (each with an isolated context window)	One agent reading everything start to finish	A delegated task is digested in its own window and only the conclusion comes back - that is context isolation and compression, not merely extra helpers
Context management (summarise long threads, offload tool outputs to disk)	Truncating when the window limit is hit	Truncation tends to drop precisely the binding constraints; summarise-and-offload is lossy but controlled degradation
Skills (reusable behaviours loaded on demand)	Writing the entire process into the system prompt	Capability can be mounted per task instead of every session carrying every instruction

Also included: shell access in a sandbox of your choosing, persistent cross-session memory via pluggable state and store backends, human-in-the-loop that can approve, edit or reject a tool call before it runs, and tools from your own functions or any MCP server.

Reading that table produces a conclusion: not one of these four makes the model smarter; all four let a finite context carry a longer task. Which is exactly what reverse-engineering Claude Code would yield - generality comes from how context is organised, not from a model capability.

Model agnostic, and open to open weights

The README answers this question directly: any model that supports tool calling works - frontier APIs (OpenAI, Anthropic, Google), open-weight models hosted on Baseten or Fireworks, and self-hosted models via Ollama, vLLM or llama.cpp. The quickstart is create_deep_agent(model=..., tools=[...], system_prompt=...): three lines to an agent that plans, reads and writes files and manages its own context.

That matters for our readers specifically, because this is the most ready-made building block on the path to "a Claude-Code-class harness running on open weights". The README also mentions Deep Agents Code - a pre-built terminal coding agent it compares to Claude Code and Cursor, installed with one curl, driven by any LLM.

Security model: one sentence worth quoting verbatim

The security section is unusually candid: Deep Agents follows a "trust the LLM" model - the agent can do anything its tools allow, so enforce boundaries at the tool and sandbox level, not by expecting the model to self-police. That is the most honest security statement we have seen in a harness project and the one most worth reading before you choose: it tells you the security boundary of this project is not in the prompt, it is in the sandbox you provide.

Boundaries and tradeoffs

• "Opinionated" means the defaults may conflict with your process: it decides how planning works, when context is compacted and at what granularity work is delegated. Every piece is overridable, but you have to read how the defaults behave first.
• It depends on the LangGraph layer: inheriting persistence and streaming means inheriting its conceptual load (state, checkpoints, graphs). Debugging requires being able to drop to the graph layer.
• Security is entirely external: there is no built-in sandbox guarantee; how dangerous shell and filesystem access are depends on the backend you plug in. "Trust the LLM" is an explicit transfer of that responsibility to you.
• Gravitational pull toward the commercial product: first-class tracing, evaluation and deployment go through LangSmith; a self-hosted observability stack has to be wired up separately.

Position on agientry

The harness lines already on this site have different cuts: hermes-agent, deepseek-harness and pi are terminal-form coding agents (finished products for developers), while Orca, herdr, multica and paperclip are the orchestration and leverage layer above agents (managing many agents, many working directories, boards and company-shaped collaboration). Deep Agents sits between the two: it is an embeddable harness library. You can build your own coding agent on it, or pass its compiled graph in as a sub-agent to an upper orchestration layer. It and LangGraph are two layers of one stack, and we list them separately so readers can see that "runtime" and "harness" are not the same thing.

Facts on this page come from the project README (read in full, including the FAQ and security sections) and official documentation links; stars and licence come from the GitHub API. We have not run Deep Agents and have done no benchmarking or reproduction - the effectiveness of sub-agent context isolation, the information loss in long-thread summarisation, and real-world reliability when paired with open-weight models are all unverified by us, so this entry is graded as needing reproduction.