Apache-2.0 自託管 Agent 執行平台，相容 Claude Managed Agents API，提供工作階段、沙箱、記憶庫與 MCP 工具；README 未記載 DeepSeek Harness 專屬整合。
DSH 整合
生態系相關
自動推斷
安全稽核
未稽核
最後核實
2026-08-21
授權條款
Apache-2.0
01它能幫你完成什麼？
Self-host a managed-agent runtime that runs agents with durable sessions, sandboxes and built-in tools
A running /v1/agents + /v1/sessions API with Console UI on port 8787 (Docker self-host in ~2 min or Cloudflare Workers deploy), verified via the /health endpoint
Platform and infra engineers who want self-hosted, BYOK agent infrastructure under their own deployment boundary
Automate workflows by publishing agents into Slack, GitHub and Linear
Agents acting as real teammates — assignable on issues, @mentionable, replying in threads — with per-publication capability gates and isolated bot identities
Engineering and product teams that want agent-driven workflow automation inside the tools they already use
Give long-running agents persistent, versioned memory
Memory stores mounted into the sandbox at /mnt/memory/<store_name>/, accessed with standard file tools, with version history, redaction and CAS updates
Builders of long-lived agents that need durable cross-session memory under their own deployment
02如何將外掛接入 DeepSeek Harness？
先決條件
- Docker (self-host path) — the README quick start runs `docker compose up -d`
- Two locally generated secrets: BETTER_AUTH_SECRET (openssl rand -hex 32) and PLATFORM_ROOT_SECRET (openssl rand -base64 32)
- Cloudflare path only: Workers Paid plan (required for Durable Objects + Containers)
安裝步驟
- 01
$ git clone https://github.com/openma-ai/open-managed-agents.git && cd open-managed-agents && cp .env.example .env
- 02
Set BETTER_AUTH_SECRET and PLATFORM_ROOT_SECRET in .env; optionally ANTHROPIC_API_KEY so the first agent can run without a Model Card
- 03
docker compose up -d (SQLite + LocalSubprocess sandbox, default) — or docker compose -f docker-compose.postgres.yml up -d for the Postgres backend
驗證整合成功
- curl localhost:8787/health returns {"status":"ok","backends":{"db":"sqlite ..."}, ...}; the Console UI opens on http://localhost:8787
- Smoke test the harness end-to-end: POST /v1/agents to create an agent, POST /v1/sessions to start a session, then POST a user.message event
03DSH 整合程度與能力邊界
No DeepSeek Harness integration is documented in the README; OMA is a self-hosted, Claude Managed Agents API-compatible meta-harness platform that runs agents and their workflows as standalone infrastructure
Claude Managed Agents-compatible API
existing clients/SDKs of the Claude Managed Agents API→same /v1/agents, /v1/environments, /v1/sessions, /v1/vaults endpoints and event types, drop-in compatible
Built-in agent toolset (agent_toolset_20260401)
an agent configured with the built-in toolset→bash, read, write, edit, glob, grep, web_fetch, web_search, cron-style scheduling, and opt-in headless browser
bash executes commands in the sandbox; web_fetch and web_search make outbound network requests (web_search requires TAVILY_API_KEY)Encrypted vaults with outbound credential injection
vaults holding static_bearer / mcp_oauth / cap_cli credentials bound to request hosts→real credentials injected at the network layer on matching outbound requests — tokens never enter the sandbox
credentials are AES-GCM encrypted at rest under PLATFORM_ROOT_SECRET; each forward emits a structured op:"mcp_proxy.forward" logMCP server registry
up to 20 MCP servers per agent — HTTP/SSE (hosted) or stdio (npm/PyPI packages)→upstream tools surfaced to the model as mcp__<server>__<tool>
stdio servers are spawned inside the sandbox container (talks to 127.0.0.1:port/sse)
04適合誰？何時不該用？
適合
- Platform and infra engineers who want self-hosted, BYOK agent infrastructure under their own deployment boundary
- Engineering and product teams that want agent-driven workflow automation inside the tools they already use
- Builders of long-lived agents that need durable cross-session memory under their own deployment
不適合
- PLATFORM_ROOT_SECRET is mandatory to boot and encrypts all credentials, model-card API keys and integration tokens at rest — losing it makes every encrypted row unreadable, so it must be backed up.
- The Cloudflare deployment path requires a Workers Paid plan because it relies on Durable Objects + Containers; the free self-host (Docker/Node) path is the alternative.
- The default sandbox provider is subprocess with no isolation; an isolated backend (litebox, daytona, e2b or boxrun) should be used when running untrusted agents.
05相容性、維護與安全提醒
- PLATFORM_ROOT_SECRET is mandatory to boot and encrypts all credentials, model-card API keys and integration tokens at rest — losing it makes every encrypted row unreadable, so it must be backed up.
- The Cloudflare deployment path requires a Workers Paid plan because it relies on Durable Objects + Containers; the free self-host (Docker/Node) path is the alternative.
- The default sandbox provider is subprocess with no isolation; an isolated backend (litebox, daytona, e2b or boxrun) should be used when running untrusted agents.
Apache-2.0 · actively maintained (last push 2026-08-19, latest release @openma/cli@0.5.0)
06常見問題
它和 DeepSeek Harness 是什麼關係？如何接入？
README 未記載與 DeepSeek Harness 的直接整合。OMA 本身即是執行 harness 的平台：用 SDK 的 defineHarness 撰寫 harness，透過 `oma deploy --harness my-harness.ts --agent <id>` 部署，平台負責提供工作階段、沙箱、工具、事件日誌與故障復原。
自託管需要什麼前置條件？
需要 Docker，以及兩個本機產生的金鑰：BETTER_AUTH_SECRET（簽署主控台工作階段）和 PLATFORM_ROOT_SECRET（靜態加密憑證，務必備份）。Cloudflare 部署路徑則需要 Workers 付費方案（Durable Objects + Containers）。
如何驗證安裝成功？
執行 `curl localhost:8787/health`，回傳 `{"status":"ok",...}` 即成功，主控台 UI 同在 8787 連接埠。README 也提供端到端冒煙測試：POST /v1/agents 建立 Agent、POST /v1/sessions 開啟工作階段，再傳送一則 user.message 事件。
憑證和金鑰存放在哪裡？
憑證在 PLATFORM_ROOT_SECRET 之下以 AES-GCM 加密靜態儲存；權杖永不進入沙箱，由出站解析器在網路層剋除入站認證標頭並注入真實憑證。遺失 PLATFORM_ROOT_SECRET 會導致所有加密資料無法讀取。
支援 MCP 工具嗎？
支援。每個 Agent 最多可註冊 20 個 MCP 伺服器（HTTP/SSE 託管式或 stdio 套件，stdio 於沙箱容器內啟動），上游工具以 `mcp__<server>__<tool>` 形式暴露給模型。
07相關的 DSH 工作流程
openviking
作者 volcengine
為 AI 智慧體打造的自進化上下文資料庫，統一智慧體記憶、知識 RAG 與技能。
colleague-skill
作者 titanwings
將冰冷的離別化為溫暖的 Skill，歡迎加入數字生命1.0！Transforming cold farewells into warm skills? It's giving rebirth era. Welcome to Digital Life 1.0. 🫶
archify
作者 tt-a1i
為編碼智慧體生成美觀可驗證的架構圖、時序圖與資料流圖，輸出自包含 HTML，支援動效與清晰匯出。
learn-harness-engineering
作者 walkinglabs
Harness 工程新手教程，從 0 到 1 系統學習智慧體工作流框架。
08資料與來源
**Open-source alternative to Claude Managed Agents** — and a foundation for open-source, self-hosted Claude Tag-style ag…
Drop-in compatible with the Claude Managed Agents API; runs on Cloudflare Workers + Durable Objects, or `docker compose…
此頁面根據專案公開文件、儲存庫中繼資料與 DSH Plugins 的結構化解析所產生；最後核實於 2026-08-21。發現錯誤？提交更正。