DeepSeek Harness: Local & Cloud Deployment Guide (with a Critical Security Warning)

DeepSeek Harness is the official agent development toolkit, written in TypeScript, shipping with a built-in WebUI (default port 3080). This guide covers both local (Windows) and cloud (Linux) deployment, followed by a critical security warning you must read.

Overview

• Stack: TypeScript / pnpm, runs on Node.js
• Default port: WebUI on 3080
• Purpose: a visual workbench for building, debugging and running agents

Windows Local Deployment

1. Install Node.js (LTS recommended) and pnpm.
2. Pull dependencies (use a faster npm mirror if you are in China).
3. Start the WebUI:

npx dsh web

1. Open http://127.0.0.1:3080 in your browser.

Listening only on loopback keeps the local risk low.

Linux Cloud Deployment

1. Install Node.js 22+:

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

1. Install pnpm:

npm install -g pnpm

1. Clone the project and install dependencies (use a mirror if needed).
2. Keep the process alive with pm2:

npm install -g pm2
pm2 start "npx dsh web" --name dsh-web
pm2 save
pm2 startup

1. Open port 3080 in the firewall, or better, put Nginx in front with a domain and HTTPS.

⚠️ Critical Security Warning

The DeepSeek Harness WebUI has no authentication, yet it can execute arbitrary shell commands, read/write files and steal secrets. This means:

• If the WebUI is reachable from the public internet, anyone who can reach the port gains full control of your server;
• They can run arbitrary commands, read/modify files, and exfiltrate secrets from environment variables (DB passwords, cloud AK/SK, payment keys, etc.);
• Public exposure = compromised server;
• Servers in Hong Kong and other overseas regions carry higher operational risk: harder to rely on domestic incident-response and audit processes.

5 Mitigation Steps

1. Never expose port 3080 directly to the public internet (keep inbound closed in the security group / firewall).
2. Access locally via 127.0.0.1, or tunnel over SSH.
3. If remote access is required, put an authenticated reverse proxy in front (e.g. Nginx + Basic Auth, OAuth2 Proxy, or Cloudflare Access).
4. Run it under a low-privilege dedicated system account, never root; keep secrets in restricted env vars or a secret manager.
5. Audit regularly: who can reach 3080, whether env vars leaked, and whether there are suspicious processes or logins.

The tool itself is not dangerous — what is dangerous is exposing an unauthenticated admin panel to the internet. Review the 5 steps above before going live.

Need help planning a secure deployment? Get in touch.