OPEN SOURCE DEEP DIVE
Deep Agents: an off-the-shelf agent harness reverse-engineered from Claude Code
The README opens by calling itself an off-the-shelf agent harness: MIT licensed, Python (plus deepagents.js), built on LangGraph, so streaming, durability and checkpoints are inherited rather than rewritten. The key to reading it is the acknowledgement - inspired by Claude Code, trying to figure out what makes it general and pushing that further - which makes this a reverse-engineering exercise: take a closed coding agent that is known to work well, open it up, and ask what actually lets it handle long tasks. Its answer is four bundled things: a pluggable-backend file system (the artefacts of long tasks are files, not messages, so context keeps only pointers), sub-agents each with their own window (context isolation and compression, not extra helpers), long-thread summarisation with tool output offloaded to disk, and on-demand Skills. Also sandboxed shell execution, cross-session persistent memory, human-in-the-loop approval/edit/reject before a tool call runs, and any MCP server as a tool. Model agnostic: frontier APIs, open weights hosted on Baseten or Fireworks, and self-hosted Ollama/vLLM/llama.cpp all work, with three lines of create_deep_agent giving you a planning, file-reading-and-writing agent. The security section is unusually blunt - it follows a trust-the-LLM model, boundaries must be enforced at the tool and sandbox layer, and you should not expect the model to restrain itself. 29.7k stars. Not run yet; sub-agent isolation quality and summarisation information loss are unverified, so this is graded as pending reproduction.
What it is
The first line of the Deep Agents README is "the batteries-included agent harness" - an opinionated agent that runs out of the box, where every piece can be extended, overridden or replaced. MIT licensed, Python (with deepagents.js), built on LangGraph, so streaming, persistence and checkpointing are inherited rather than rewritten. Around thirty thousand stars, and one of the few projects in our harness coverage that explicitly names itself a harness.
The acknowledgement is the key to reading it: "Inspired by Claude Code: an attempt to identify what makes it general-purpose, and push that further." So the methodology here was reverse engineering - take a closed, widely respected coding agent apart, ask "which few things are actually responsible for it handling long tasks", and turn that answer into an open, model-agnostic skeleton.
The answer it found: four things bundled in
The README states the three-layer split plainly: LangGraph is the graph runtime, LangChain's create_agent is a minimal harness on top of it, and Deep Agents is "the same building blocks, but with filesystem, sub-agents, context management and skills bundled in". Those four are what it identifies as the source of generality:
| Bundled capability | What it replaces | Why long-horizon work cannot do without it |
|---|---|---|
| Filesystem (pluggable local / sandboxed / remote backends) | Stuffing every intermediate result into context | The output of long work is files, not messages. Once on disk, context holds pointers and the window stops filling with intermediates |
| Sub-agents (each with an isolated context window) | One agent reading everything start to finish | A delegated task is digested in its own window and only the conclusion comes back - that is context isolation and compression, not merely extra helpers |
| Context management (summarise long threads, offload tool outputs to disk) | Truncating when the window limit is hit | Truncation tends to drop precisely the binding constraints; summarise-and-offload is lossy but controlled degradation |
| Skills (reusable behaviours loaded on demand) | Writing the entire process into the system prompt | Capability can be mounted per task instead of every session carrying every instruction |
Also included: shell access in a sandbox of your choosing, persistent cross-session memory via pluggable state and store backends, human-in-the-loop that can approve, edit or reject a tool call before it runs, and tools from your own functions or any MCP server.
Reading that table produces a conclusion: not one of these four makes the model smarter; all four let a finite context carry a longer task. Which is exactly what reverse-engineering Claude Code would yield - generality comes from how context is organised, not from a model capability.
Model agnostic, and open to open weights
The README answers this question directly: any model that supports tool calling works - frontier APIs (OpenAI, Anthropic, Google), open-weight models hosted on Baseten or Fireworks, and self-hosted models via Ollama, vLLM or llama.cpp. The quickstart is create_deep_agent(model=..., tools=[...], system_prompt=...): three lines to an agent that plans, reads and writes files and manages its own context.
That matters for our readers specifically, because this is the most ready-made building block on the path to "a Claude-Code-class harness running on open weights". The README also mentions Deep Agents Code - a pre-built terminal coding agent it compares to Claude Code and Cursor, installed with one curl, driven by any LLM.
Security model: one sentence worth quoting verbatim
The security section is unusually candid: Deep Agents follows a "trust the LLM" model - the agent can do anything its tools allow, so enforce boundaries at the tool and sandbox level, not by expecting the model to self-police. That is the most honest security statement we have seen in a harness project and the one most worth reading before you choose: it tells you the security boundary of this project is not in the prompt, it is in the sandbox you provide.
Boundaries and tradeoffs
- "Opinionated" means the defaults may conflict with your process: it decides how planning works, when context is compacted and at what granularity work is delegated. Every piece is overridable, but you have to read how the defaults behave first.
- It depends on the LangGraph layer: inheriting persistence and streaming means inheriting its conceptual load (state, checkpoints, graphs). Debugging requires being able to drop to the graph layer.
- Security is entirely external: there is no built-in sandbox guarantee; how dangerous shell and filesystem access are depends on the backend you plug in. "Trust the LLM" is an explicit transfer of that responsibility to you.
- Gravitational pull toward the commercial product: first-class tracing, evaluation and deployment go through LangSmith; a self-hosted observability stack has to be wired up separately.
Position on agientry
The harness lines already on this site have different cuts: hermes-agent, deepseek-harness and pi are terminal-form coding agents (finished products for developers), while Orca, herdr, multica and paperclip are the orchestration and leverage layer above agents (managing many agents, many working directories, boards and company-shaped collaboration). Deep Agents sits between the two: it is an embeddable harness library. You can build your own coding agent on it, or pass its compiled graph in as a sub-agent to an upper orchestration layer. It and LangGraph are two layers of one stack, and we list them separately so readers can see that "runtime" and "harness" are not the same thing.
Facts on this page come from the project README (read in full, including the FAQ and security sections) and official documentation links; stars and licence come from the GitHub API. We have not run Deep Agents and have done no benchmarking or reproduction - the effectiveness of sub-agent context isolation, the information loss in long-thread summarisation, and real-world reliability when paired with open-weight models are all unverified by us, so this entry is graded as needing reproduction.