Deep Agents: LangChain's Open Agent Harness Layer

Audio overview

Listen to the audio overview

A 5-minute audio overview of this article, narrated by our robot.

15 15

0:00 / 0:00

Speed 1× 1.25× 1.5× 2×

The viral version of LangChain Deep Agents is irresistible: LangChain just open-sourced the blueprint for building your own Claude Code.

There are two problems with that sentence. Deep Agents was first open sourced in July 2025, not 2026. And the package that exists today is more general than a coding-agent clone.¹

The original comparison was not invented by social media. LangChain said the project was inspired by Claude Code, Manus, and Deep Research. Its first design bundled a planning tool, subagents, a virtual filesystem, and a detailed system prompt. Those were LangChain’s attempt to extract the architecture behind effective long-running agents.¹

More than a year later, the interesting story is what that bundle became, and what LangChain deleted from it. Deep Agents now sits above LangChain’s agent framework and LangGraph’s runtime as a model-agnostic harness. In version 0.7, LangChain removed the default planning middleware and most of the default prompt footprint after evaluation found that the extra machinery did not deliver a clear accuracy benefit.²³

That evolution supports a larger idea: the agent harness is becoming its own optimization surface between a model and an application. It also shows why “best practice” is a dangerous label for agent scaffolding that has not been measured.

What Deep Agents actually is

An agent needs more than a model that can call tools. Something must decide which instructions and files enter context, how tool results are stored, when the loop continues, when work moves to a subagent, what survives across sessions, and which actions require approval.

That coordinating layer is the harness.

LangChain’s current taxonomy calls LangChain the agent framework, LangGraph the orchestration runtime, and Deep Agents the harness.⁴ The boundaries overlap in implementation, but the responsibilities are distinguishable:

• LangChain provides model and tool integrations, middleware, and the core agent abstraction.
• LangGraph supplies state transitions, streaming, checkpoints, interrupts, persistence, and durable resume.
• Deep Agents assembles opinions about context, filesystem tools, subagents, skills, memory, model profiles, approval hooks, and execution backends.
• Deep Agents Code, installed as dcode, is the terminal coding application built on that harness.
• Managed Deep Agents is a separate LangSmith service for hosted deployment, durable threads, persistence, sandbox lifecycle, identity, and tracing.⁵⁶

At the August 25 evidence cutoff, the core Python package was version 0.7.8 and marked Beta, while deepagents-code was 0.1.61. Both live in the MIT-licensed repository. The coding app evolved from an October 2025 Deep Agents CLI and split into its current package in April and May 2026.⁷

View full size

Open asset Close

The harness coordinates behavior. Tools, sandboxes, identity systems, and infrastructure enforce different boundaries below and across it.

This explains why Deep Agents is not a new runtime. Its agent is a LangChain agent with middleware, running on LangGraph. The harness is valuable because it packages a reusable policy for how those lower-level parts work together.

From Claude Code patterns to a general harness

The 2025 release treated four features as foundational. One was a todo tool based on Claude Code’s TodoWrite. The tool itself did not execute a plan; it placed an explicit checklist into the agent’s context. Subagents handled bounded work in isolated context windows. A virtual filesystem in LangGraph state gave the model somewhere to offload results. A long system prompt explained how to use the whole arrangement.¹

The current package keeps the architectural goals while changing the mechanisms. Its filesystem surface can use thread-scoped LangGraph state, cross-thread stores, host directories, composite mounts, or remote sandbox backends. Large tool results can be offloaded into files, and conversations can be summarized as the context window fills. Skills use progressive disclosure, loading detailed instructions only when needed. Long-term memory is represented as files backed by a durable store. MCP tools enter through LangChain adapters, while a separate ACP package connects agents to compatible editors.⁸⁹

Two patterns deserve special attention.

First, the filesystem acts as external working memory. Instead of carrying every search result and intermediate artifact in the prompt, the harness can keep an index in context and fetch details from files when needed. This is context engineering, not merely file I/O.

Second, subagents are a form of context isolation. A research subagent can receive a narrow task, work in its own window, and return a compressed result. Delegation can preserve the main agent’s attention, although bad instructions or poisoned output can still travel across that boundary.

Provider independence is real at the interface, but it needs a qualifier. Deep Agents accepts LangChain chat models that support tool calling, and current documentation provides examples for OpenAI, Anthropic, Google, OpenRouter, Fireworks, Baseten, and Ollama. LangChain also maintains model-specific harness profiles because models differ in prompting and tool conventions.¹⁰ Replaceable does not mean interchangeable at equal quality.

Version 0.7 removed two original pillars

Deep Agents 0.7, released July 29, 2026, is the strongest evidence for treating the harness as something that should be evaluated independently.²

LangChain removed its authored base system prompt by default. It also shortened built-in tool descriptions from 4,005 to 2,302 tokens, a 43 percent reduction, and made the todo middleware opt-in. On a reference gpt-5.5 “hello” turn, those changes cut the built-in input footprint from 5,395 to 1,895 tokens, about 65 percent.³

That is a base-overhead measurement, not a promise that every agent run uses 65 percent fewer tokens. Real tasks add conversation history, retrieved context, tool results, and repeated turns.

The performance claim needs similar care. LangChain compared v0.6.12 and a v0.7 beta across 36 tasks, three rollouts per task, and four models. Every reward confidence interval crossed zero, so the evaluation detected no statistically clear reward change. Token reductions were statistically clear for two models, cost fell clearly for one, and one Claude Sonnet run showed a significant cost increase driven largely by two hard autonomous tasks.²³

The todo decision came from a separate three-model experiment. LangChain tested GPT-5.6 Terra, Claude Opus 4.8, and GLM 5.2 and reported no statistically significant accuracy improvement from the middleware. Token use increased for two of the three. Cost results were mixed, including one model where the todo version was cheaper.¹¹

The safe conclusion is not that planning is useless. Models can still plan in natural language, and LangChain keeps the middleware for long multi-step work, weaker models, or interfaces where a visible plan helps the user. The experiment says this particular planning tool did not justify being a universal default on the tested models and tasks.

That reversal matters. The todo list and detailed prompt were launch-era pillars. A year later, stronger models and better evaluation made them optional or unnecessary. Agent architecture is not a fixed recipe. A harness should earn its complexity.

The harness is not the security boundary

Deep Agents can expose a host filesystem and a local shell. It can also run against remote sandboxes. Those configurations are not equivalent.

The default state backend keeps files in LangGraph state and does not provide shell execution. FilesystemBackend reads and writes host files. LocalShellBackend runs commands on the host with the current user’s permissions and explicitly provides no sandboxing. Sandbox backends add an isolated execution environment, but their filesystem, process, network, and credential boundaries depend on the selected provider and configuration.¹²

Builders should separate four controls that agent marketing often blends together:

1. Approval decides whether a proposed action should run now.
2. Authorization decides which principal may access a resource or operation.
3. Isolation limits what executing code can technically reach.
4. Observability records what happened for debugging and audit.

Human-in-the-loop middleware can pause a tool call and let a reviewer approve, edit, reject, or respond. LangGraph checkpoints make that pause durable. Approval does not contain an approved shell command, scope an API token, or block network exfiltration.¹³

Deep Agents’ built-in filesystem permissions also have a documented scope: they do not govern custom tools, MCP tools, or arbitrary shell execution. Persistent memory creates another integrity boundary. If one user can write instructions that another user’s agent later loads, memory becomes a delayed prompt-injection channel. LangChain recommends per-user namespaces, read-only shared policy memory, validation or approval for sensitive writes, tightly scoped credentials, and restricted network access.¹²¹⁴¹⁵

The practical rule is simple: treat the model as capable of exercising every permission it receives. Put enforcement in tools, identity systems, credential brokers, network policy, and real execution isolation. Use the harness to coordinate those controls, not to replace them.

An emerging layer, not a settled standard

Deep Agents is not alone. Anthropic’s Claude Agent SDK exposes the tools, agent loop, and context management behind Claude Code, including subagents, MCP, permissions, sessions, skills, memory, and checkpointing. It is a reusable harness, but it remains centered on Claude and the Claude Code process model.¹⁶

OpenAI now describes Codex in similar terms: an open agent harness that manages context, tools, boundaries, approvals, streaming, and state across its CLI, IDE, and app surfaces.¹⁷ That weakens any claim that LangChain invented or uniquely owns the category. It strengthens the broader observation that vendors are exposing this layer as a product and integration surface.

Deep Agents’ distinctive bet is composability. A builder can swap models, storage backends, sandbox providers, tools, and deployment choices while keeping a recognizable harness interface. The cost is that real performance and safety still depend on model-specific tuning and correctly assembled infrastructure. Vertically integrated agents can co-design the model, prompt, tools, sandbox, and UX in ways a general harness cannot automatically reproduce.

So is “open-source Claude Code” technically fair? As a description of inspiration, yes. As a description of today’s SDK, no. dcode is the closer product comparison. Deep Agents is the reusable layer underneath it.

The more consequential version of the story is that the industry is beginning to standardize the space between the model and the work. The standards are not settled, and the boundaries remain blurry. But the harness is now visible enough to version, benchmark, secure, replace, and argue about on its own.

For builders, that is the part worth watching.

Footnotes

1. LangChain. “Deep Agents.” July 30, 2025. langchain.com ↩ ↩² ↩³

2. LangChain. “Deep Agents v0.7.” July 29, 2026. langchain.com ↩ ↩² ↩³

3. LangChain. “Trim default tool descriptions.” Pull request #5009, merged July 24, 2026. GitHub ↩ ↩² ↩³

4. LangChain. “Deep Agents vs LangChain vs LangGraph.” August 6, 2026. langchain.com ↩

5. LangChain. “Deep Agents Code overview.” Accessed August 25, 2026. LangChain Docs ↩

6. LangChain. “Managed Deep Agents is now in public beta.” August 7, 2026. langchain.com ↩

7. LangChain. “Deep Agents changelogs, package metadata, and license.” Accessed August 25, 2026. SDK changelog, Code changelog, PyPI, MIT license ↩

8. LangChain. “Deep Agents overview.” Accessed August 25, 2026. LangChain Docs ↩

9. LangChain. “Context engineering.” Accessed August 25, 2026. LangChain Docs ↩

10. LangChain. “Models.” Accessed August 25, 2026. LangChain Docs ↩

11. LangChain. “Make TodoListMiddleware opt-in by default.” Pull request #4929, merged July 23, 2026. GitHub ↩

12. LangChain. “Backends.” Accessed August 25, 2026. LangChain Docs ↩ ↩²

13. LangChain. “Human-in-the-loop.” Accessed August 25, 2026. LangChain Docs ↩

14. LangChain. “Permissions.” Accessed August 25, 2026. LangChain Docs ↩

15. LangChain. “Memory.” Accessed August 25, 2026. LangChain Docs ↩

16. Anthropic. “Claude Agent SDK overview.” Accessed August 25, 2026. Anthropic Docs ↩

17. OpenAI. “Codex as a platform: build on the open agent harness.” August 19, 2026. OpenAI ↩