Apache-2.0 自托管 Agent 运行平台，兼容 Claude Managed Agents API，提供会话、沙箱、记忆库与 MCP 工具；README 未记载 DeepSeek Harness 专属集成。
DSH 适配
生态相关
自动推断
安全审计
未审计
最后核验
2026-08-21
许可证
Apache-2.0
01它能帮你完成什么？
Self-host a managed-agent runtime that runs agents with durable sessions, sandboxes and built-in tools
A running /v1/agents + /v1/sessions API with Console UI on port 8787 (Docker self-host in ~2 min or Cloudflare Workers deploy), verified via the /health endpoint
Platform and infra engineers who want self-hosted, BYOK agent infrastructure under their own deployment boundary
Automate workflows by publishing agents into Slack, GitHub and Linear
Agents acting as real teammates — assignable on issues, @mentionable, replying in threads — with per-publication capability gates and isolated bot identities
Engineering and product teams that want agent-driven workflow automation inside the tools they already use
Give long-running agents persistent, versioned memory
Memory stores mounted into the sandbox at /mnt/memory/<store_name>/, accessed with standard file tools, with version history, redaction and CAS updates
Builders of long-lived agents that need durable cross-session memory under their own deployment
02如何接入 DeepSeek Harness？
前置条件
- Docker (self-host path) — the README quick start runs `docker compose up -d`
- Two locally generated secrets: BETTER_AUTH_SECRET (openssl rand -hex 32) and PLATFORM_ROOT_SECRET (openssl rand -base64 32)
- Cloudflare path only: Workers Paid plan (required for Durable Objects + Containers)
安装步骤
- 01
$ git clone https://github.com/openma-ai/open-managed-agents.git && cd open-managed-agents && cp .env.example .env
- 02
Set BETTER_AUTH_SECRET and PLATFORM_ROOT_SECRET in .env; optionally ANTHROPIC_API_KEY so the first agent can run without a Model Card
- 03
docker compose up -d (SQLite + LocalSubprocess sandbox, default) — or docker compose -f docker-compose.postgres.yml up -d for the Postgres backend
验证接入成功
- curl localhost:8787/health returns {"status":"ok","backends":{"db":"sqlite ..."}, ...}; the Console UI opens on http://localhost:8787
- Smoke test the harness end-to-end: POST /v1/agents to create an agent, POST /v1/sessions to start a session, then POST a user.message event
03DSH 适配与能力边界
No DeepSeek Harness integration is documented in the README; OMA is a self-hosted, Claude Managed Agents API-compatible meta-harness platform that runs agents and their workflows as standalone infrastructure
Claude Managed Agents-compatible API
existing clients/SDKs of the Claude Managed Agents API→same /v1/agents, /v1/environments, /v1/sessions, /v1/vaults endpoints and event types, drop-in compatible
Built-in agent toolset (agent_toolset_20260401)
an agent configured with the built-in toolset→bash, read, write, edit, glob, grep, web_fetch, web_search, cron-style scheduling, and opt-in headless browser
bash executes commands in the sandbox; web_fetch and web_search make outbound network requests (web_search requires TAVILY_API_KEY)Encrypted vaults with outbound credential injection
vaults holding static_bearer / mcp_oauth / cap_cli credentials bound to request hosts→real credentials injected at the network layer on matching outbound requests — tokens never enter the sandbox
credentials are AES-GCM encrypted at rest under PLATFORM_ROOT_SECRET; each forward emits a structured op:"mcp_proxy.forward" logMCP server registry
up to 20 MCP servers per agent — HTTP/SSE (hosted) or stdio (npm/PyPI packages)→upstream tools surfaced to the model as mcp__<server>__<tool>
stdio servers are spawned inside the sandbox container (talks to 127.0.0.1:port/sse)
04适合谁？何时不该用？
适合
- Platform and infra engineers who want self-hosted, BYOK agent infrastructure under their own deployment boundary
- Engineering and product teams that want agent-driven workflow automation inside the tools they already use
- Builders of long-lived agents that need durable cross-session memory under their own deployment
不适合
- PLATFORM_ROOT_SECRET is mandatory to boot and encrypts all credentials, model-card API keys and integration tokens at rest — losing it makes every encrypted row unreadable, so it must be backed up.
- The Cloudflare deployment path requires a Workers Paid plan because it relies on Durable Objects + Containers; the free self-host (Docker/Node) path is the alternative.
- The default sandbox provider is subprocess with no isolation; an isolated backend (litebox, daytona, e2b or boxrun) should be used when running untrusted agents.
05兼容性、维护与安全提示
- PLATFORM_ROOT_SECRET is mandatory to boot and encrypts all credentials, model-card API keys and integration tokens at rest — losing it makes every encrypted row unreadable, so it must be backed up.
- The Cloudflare deployment path requires a Workers Paid plan because it relies on Durable Objects + Containers; the free self-host (Docker/Node) path is the alternative.
- The default sandbox provider is subprocess with no isolation; an isolated backend (litebox, daytona, e2b or boxrun) should be used when running untrusted agents.
Apache-2.0 · actively maintained (last push 2026-08-19, latest release @openma/cli@0.5.0)
06常见问题
它和 DeepSeek Harness 是什么关系？如何接入？
README 未记载与 DeepSeek Harness 的直接集成。OMA 本身是运行 harness 的平台：用 SDK 的 defineHarness 编写 harness，通过 `oma deploy --harness my-harness.ts --agent <id>` 部署，平台负责提供会话、沙箱、工具、事件日志与崩溃恢复。
自托管需要什么前置条件？
需要 Docker，以及两个本地生成的密钥：BETTER_AUTH_SECRET（签发控制台会话）和 PLATFORM_ROOT_SECRET（静态加密凭据，务必备份）。Cloudflare 部署路径还需要 Workers 付费计划（Durable Objects + Containers）。
如何验证安装成功？
运行 `curl localhost:8787/health`，返回 `{"status":"ok",...}` 即成功，控制台 UI 同在 8787 端口。README 还提供端到端冒烟测试：POST /v1/agents 创建 Agent、POST /v1/sessions 开启会话、再发送一条 user.message 事件。
凭据和密钥存放在哪里？
凭据在 PLATFORM_ROOT_SECRET 之下以 AES-GCM 加密静态存储；令牌永不进入沙箱，由出站解析器在网络层剥离入站认证头并注入真实凭据。丢失 PLATFORM_ROOT_SECRET 会导致所有加密数据不可读。
支持 MCP 工具吗？
支持。每个 Agent 最多注册 20 个 MCP 服务器（HTTP/SSE 托管式或 stdio 包，stdio 在沙箱容器内启动），上游工具以 `mcp__<server>__<tool>` 形式暴露给模型。
07相关的 DSH 工作流
archify
作者 tt-a1i
为编码智能体生成美观可验证的架构图、时序图与数据流图，输出自包含 HTML，支持动效与清晰导出。
openviking
作者 volcengine
为 AI 智能体打造的自进化上下文数据库，统一智能体记忆、知识 RAG 与技能。
nocobase
作者 nocobase
开源的 AI + 无代码应用搭建平台：AI 在久经生产验证的底层基础设施与所见即所得的无代码界面之上工作，帮你快速构建 CRM、ERP 等业务系统，兼顾速度与可靠性。
learn-harness-engineering
作者 walkinglabs
Harness 工程新手教程，从 0 到 1 系统学习智能体工作流框架。
08数据与来源
**Open-source alternative to Claude Managed Agents** — and a foundation for open-source, self-hosted Claude Tag-style ag…
Drop-in compatible with the Claude Managed Agents API; runs on Cloudflare Workers + Durable Objects, or `docker compose…
页面基于项目公开文档、仓库元数据和 DSH Plugins 的结构化解析生成；最后核验于 2026-08-21。发现错误？提交更正。
最佳 DeepSeek Harness 插件
从全目录挑出的 12 个值得优先安装的插件，覆盖各个分类。