DeepSeek open-sources its Super-agent prototype. What it does, and how to try it safely

What DeepSeek released

On October 31, 2026, DeepSeek’s Harness team published dsh-superagent-prototype on GitHub under the MIT license, with a design article on WeChat, “Exploring Super-agent Design.” Bloomberg framed it as a challenge to Claude Code. When we checked on November 1, the repository had about 6,900 stars and 693 forks.

The README calls it “a proactive coding agent for one GitHub repository, packaged as a bundle for DeepSeek Harness,” DeepSeek’s open-source agent app. “It listens to GitHub and, optionally, Feishu.” When an allowed person asks for work, “it opens a work item, works on it in its own agent session and directory, and answers in the original conversation, for example with a pull request.” A web panel shows what needs a person.

The idea behind it is one long-running session that takes incoming messages and hands each task to a worker session of its own. The article’s argument is that “one person can usually keep track of only three to five active Sessions at a time,” so the limit on parallel work is human attention. We couldn’t open the WeChat original, which asks for a verification step, so article quotes here are from Offloop’s English translation, and the wording is the translator’s.

DeepSeek is plain about its status. The README opens: “Research prototype for reference only, not an official DeepSeek product.” It says much of the engineering was done by coding agents, that “it may still contain bugs,” and that “some designs discussed in the article are directions for future development and are not implemented in this prototype.” The repository has one commit, and its issues are turned off.

What the reports say, and what the code does

Bloomberg says Super-agent “can proactively monitor group chats among developers for feedback on coding issues and suggest solutions without being summoned.” That describes DeepSeek’s own instance: the article says it set a “silently reproduce and fix” policy in its internal user group, where the agent “delivers the result only after confirming the problem and finding a simple fix.” But the README says the public version “is not identical to our internal version,” and its setup guide starts somewhere much quieter:

What you might expect	What the published setup does	What changes it
It watches group chats	Feishu is optional, and “the bot reads only mentions”	Setting a chat to receive every message
It works without being asked	Accept mode observe, where a good candidate is recorded as “would accept,” and “nothing is accepted”	A written rule, plus accept mode auto
Anyone on the team can use it	Only people you list: “until a list has someone, no request can become a Ticket”	Adding people, or opening a chat to requests
It ships fixes	It opens pull requests, and people merge them	Naming another account’s CLI for merging; the default instructions then allow auto-merge on approved pull requests under 200 changed lines

DeepSeek’s advice is to “begin with a short allowed list and with proactive work only recorded,” then widen both “once what the agent would have done looks right.”

How to try it

It isn’t one command. You need:

• DeepSeek Harness, which is in developer preview. Its README warns: “THERE WILL BE COMPATIBILITY-BREAKING CHANGES.”
• The tools: Node.js 22.19+ or 24+, pnpm, git 2.32+, Python 3.8+, tmux and GitHub CLI 2.48+.
• A repository on github.com. “GitHub Enterprise Server is not supported.”
• A separate GitHub user account for the agent. “A GitHub App cannot be the agent, because dsh-superagent reads the account’s notifications.”
• A model provider, covered below.
• For chat, a Feishu or Lark bot. Those are the only chats it reads. There’s no Slack or Teams support, though the cookbook shows how to write another source.

Then:

1. Let an agent do the setup. Clone the repository and ask your coding agent: “Read SETUP.md in this repository and set up dsh-superagent with me.” The guide tells it to ask one question at a time, show the full plan once, and never ask for a secret in the chat. Read that plan before you confirm it.

2. Or do it by hand, following the deployment guide. The fourth command replaces any existing superagent profile, so run it only on a new installation:

   npm install -g @deepseek-ai/dsh@0.2.1-rc.3
   git clone https://github.com/deepseek-ai/dsh-superagent-prototype dsh-superagent && cd dsh-superagent
   pnpm install && pnpm build
   dsh superagent --from-default-profile web --dump-config > /dev/null
   dsh plugin --profile superagent add "link:$PWD"

   After the machine configuration the guide describes, start it with scripts/dsh-superagent start, and check it with scripts/dsh-superagent status.

3. Give it a first job. From an account on the allowed list, comment @<agent login> <request> on an issue. “A Ticket appears on the overview within about a minute.”

Which model it uses, and what it costs

Super-agent “uses the profile’s default model unless the Eval or Execution settings name another.” Harness’s model guide covers DeepSeek’s API, third-party providers such as anthropic and openai with an API key, and custom endpoints for “a relay, a company gateway, a self-hosted server.” So its docs allow Claude, GPT or a local model, but DeepSeek doesn’t say which it has tested with this prototype. Harness can also hand a task to Claude Code as a subagent, but Super-agent’s docs don’t cover that.

On DeepSeek’s own API, checked November 1, the prices per million tokens are:

	deepseek-flash off-peak	deepseek-flash peak	deepseek-v4-pro off-peak	deepseek-v4-pro peak
Input, cache hit	$0.003	$0.006	$0.022	$0.044
Input, cache miss	$0.15	$0.30	$0.66	$1.32
Output	$0.60	$1.20	$1.98	$3.96

Peak is 01:00 to 04:00 and 06:00 to 10:00 UTC, Monday through Friday. DeepSeek gives no cost per task. The nearest thing is the article’s test: about 300 chat and CI messages per run, about 20 of them work requests, five runs each. By Offloop’s table of the results, Super-agent had a median of 12.4 minutes and a 95th percentile of 15.7. A single session with subagents had 20.4 and 29.5 under a neutral prompt, and 13.8 and 29.0 under one that pushed delegation. Super-agent used more cache-read tokens for that: 23.23 million per run, against 6.05 million and 10.82 million.

Those numbers measure scheduling and nothing else. “Coding work was replaced with a tool that only consumed time,” and DeepSeek says to treat the results “only as preliminary reference points.”

What to check before you run it

1. Isolate the machine. Both of its presets “run with danger-full-access as the operator’s OS user.” A worker “can execute programs by path and read the operator’s home directory,” and its wrappers and directories “establish defaults, not a security boundary.” DeepSeek’s answer is “a dedicated OS account containing only the agent’s credentials.” Harness’s safety notice says it “has not undergone a security audit,” and advises you to “prefer a disposable virtual machine, container, or dedicated environment.”
2. Start on a private repository. This one is our advice. The allowed list controls who can start work, not who can reach it. “Every message on a subscribed Thread reaches its subscribed Tickets as context, including messages from bots and CI,” and an ended Ticket can be resumed by a person’s message on its thread, “regardless of who sent it.” The worker then decides whether the request fits the scope. On a public repository, that puts a stranger’s text in front of a model with a shell. The article itself says the design “increases exposure to untrusted inputs,” and that a Super-agent “will be able to operate only within a small, trusted scope” until that’s solved. ifanr’s report in Chinese carries the same warning.
3. Keep your own login out of its reach. Use the dedicated GitHub account, “never the operator’s own,” and list your personal CLIs as blocked commands, remembering that blocking isn’t a boundary.
4. Enforce merging on GitHub. The merge rules are prompts: “These instructions govern the agent, not GitHub’s merge rules.” Require approvals in branch protection.
5. Decide where your code goes. Code and messages go to whichever model provider you configure. An independent test also found that DeepSeek V4.1 Flash, the model behind deepseek-flash, sometimes broke a rule that stood between it and finishing a task, which matters more when nothing asks for approval.
6. Check your contracts if you work with the US government. A DHS order requires “removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” It covers federal civilian agencies and, in BleepingComputer’s words, “is not a general ban on private or consumer use.”

Should you switch from Claude Code or Codex?

No. As Digital Trends put it, it’s “not a reason to uninstall Claude Code or Codex just yet.” We found no published comparison of the code it writes, and it does a different job: it sits over one repository and takes requests from a team, instead of working beside you. Try it if you can spare a machine, you want to study how a team-wide agent behaves, and you’re prepared to do what the README asks: “Review and adapt it before using it in your own environment.”

If you want something else from it, there are shorter ways:

• DeepSeek’s models in a coding agent. OpenCode uses the providers you set up in it, and DeepSeek publishes a guide to pointing Claude Code at its API.
• Fewer sessions to watch. Enjoy doesn’t run DeepSeek Harness or this bundle, and it doesn’t listen to a GitHub repository or a chat for requests. But the problem DeepSeek starts from is what JOY is for: it keeps an eye on your projects, and you can ask it what needs you, catch up on what your agents did, or start work in any project, with agents running in parallel on the plans you already have. You start the work, and scheduled workflows run only while your computer is awake with Enjoy open.

What DeepSeek hasn’t said

• How good the code is. It has published no test of code quality, and no comparison with Claude Code or Codex.
• Which model to use. The prototype’s docs name no recommended or tested model.
• What a task costs, in tokens or dollars, on real work.
• Which parts of the article aren’t in the prototype. The README says some aren’t, without listing them.
• What comes next. It hasn’t said whether Super-agent will become a product, or whether this repository will keep being updated.

We’ll update this memo when DeepSeek fills these in.