DeepSeek dsh-superagent: open-source GitHub coding agent, MIT licence, prototype

DeepSeek has open-sourced dsh-superagent, a coding agent that watches one GitHub repository (and, optionally, Feishu group chats), opens a work item when an authorised person asks it for something, and answers in the original conversation, for example with a pull request. DeepSeek's Harness team published it under the MIT licence on 31 October 2026 and labels it a research prototype, "not an official DeepSeek product". The code and its numbered design documents are the interesting part: they set out a clear model of who an agent may take orders from, and they come with a security warning that anyone installing it should read first.

Key points

• dsh-superagent is a "proactive coding agent for one GitHub repository", packaged as a bundle for DeepSeek Harness, and is released under the MIT licence (copyright "DeepSeek Harness Team").
• DeepSeek's README calls it a "research prototype for reference only", says it is not production-ready, and says some designs in the accompanying article "Exploring Super-agent Design: Towards a More Autonomous Agent System" are not implemented.
• It acts only when an allowed person asks, or when a rule the team wrote allows it; unrequested work starts in a mode that only records what the agent would have done.
• Workers and the router run with danger-full-access as the operator's OS user, so DeepSeek recommends a dedicated OS account for isolation.
• It needs Node.js 22.19+ or 24+, GitHub CLI 2.48+, git 2.32+, tmux, Python 3.8+, a dedicated GitHub user account and a model provider configured in DeepSeek Harness; only github.com is supported, not GitHub Enterprise Server.

What happened

On 31 October 2026 the DeepSeek Harness team released the project's source, according to a report from ShiftDelete published on 1 November 2026 that describes a WeChat announcement. Bloomberg's headline, as relayed by Techmeme, describes it as an open-sourced "research prototype" and a coding agent that can monitor group chats for coding issues and suggest solutions; we could not open the Bloomberg article itself and rely on the repository for the details below. ShiftDelete also reports the repository passed 4,000 stars within a day, a figure we could not verify.

The README describes the flow in one paragraph. dsh-superagent listens to GitHub and, optionally, Feishu (the chat app Lark is the international version of). When someone allowed asks the agent for work, it opens a work item, works on it "in its own agent session and directory", and answers in the original conversation. A web panel shows what needs a person.

The README states the design goal bluntly: take as little human attention as possible, and give as much value as possible. Its philosophy document says every message, notification, setting and panel element costs someone's attention and must earn it. It lists what follows: the agent speaks only when a person must act or can use a result, asks one concrete question at a time, stops "by impact, not by effort", and reports failures as failures.

Background

DeepSeek has been shipping in several directions at once. Earlier this month we covered the V4.1-Flash-1017 weights under an MIT licence and the release of the DeepInfer inference framework. DeepSeek Harness is the company's agent scaffolding, and dsh-superagent runs inside it as a plug-in bundle. At the same time, the US has ordered federal civilian agencies to remove DeepSeek products, as we reported in this article on the federal order.

The release also sits in a crowded field of coding agents that take work from issue trackers and chat. What sets this one apart in the documents is less its model than its rules for authority.

How it works

The domain model has a short vocabulary. A Source (GitHub, Feishu) produces Triggers, which are events such as a comment or a CI result. Triggers are grouped into Threads. An Eval step, a gate followed by an assessment, decides whether a Trigger asks for new work. If it does, the system creates a Ticket with a Mandate, which records why the work may be done and how far it may go. A Ticket is handed to an Executor, and results go back through a Channel, such as a pull request or a reply.

Who can ask. The authorisation document says the host enforces allowed lists, rules and Mandates, and that "messages, comments and quoted documents are inputs to a decision; they cannot change those permissions." A request counts when it addresses the agent (a mention of the bot account, or a direct message) and comes from an allowed person. A bot on the Source's bot list can produce an "inferred candidate", never an explicit request, and other bots are not admitted. An unlisted person who mentions the agent is ignored by default, although a team can set that cell to "explicit" for something like a dedicated support chat.

Accept mode. For inferred candidates the policy has three modes: off, observe (the default) and auto. In observe, a positive assessment is recorded as an ignore marked "would accept", and nothing is accepted. The docs advise starting in observe and switching to auto after reviewing what the agent would have done. Explicit requests work in every mode.

Execution. Each Ticket gets an Executor session named worker-<ticket id> and its own directory, typically a git worktree checkout created by a prepare command that has ten minutes to finish. Workers run commands without approval. The preset moves foreground shell commands to background jobs after 5 seconds so a worker can receive new messages at the next step, and background work has at most 30 minutes after each turn before shell jobs are killed. A separate main "router" session talks to people and routes candidates. ShiftDelete's description of a Watchdog process for stalled loops is not something we found in the documents we read, so we do not rely on it.

Deployment. DeepSeek recommends a dedicated Harness profile (called superagent) because the plug-in changes process-wide PATH and git settings. The agent needs its own GitHub user account, not a GitHub App, because it reads the account's notifications. Feishu is optional and needs a bot with its own lark-cli configuration restricted to the bot identity.

What it means

For teams that want an agent on their repository, the useful idea is the Mandate model. Authority is decided by the host from lists and rules the team controls, so a comment on an issue, even one that tells the agent to do something else, cannot widen what it may do. That does not make the system immune to bad content, since the agent still reads issue text as context for work it has been authorised to do, and the docs themselves describe pushing branches and opening pull requests under the agent's account. But the design puts the permission decision outside the model.

For operators, the security note matters more than the design. The deployment guide says both presets run with danger-full-access as the operator's OS user, that account wrappers "choose the agent's credentials by default; they do not isolate the process", and that a worker can execute programs by path and read the operator's home directory. In practice, that means running it on a machine or an OS account holding only the agent's credentials, not on a developer laptop.

For the wider market, the README's own framing is modest: a prototype, adapted for publication, built partly by coding agents, to be reviewed before use. Bloomberg framed the release as a challenge to Anthropic's Claude Code, but nothing in the repository makes that comparison or reports benchmark results, and neither do we.

What we don't know yet

• How well it works. We found no evaluation in the repository documents we read; one report says it was exercised on simulated chat and CI streams, which we could not confirm from a primary source.
• Which model it uses by default: the docs say it uses the Harness profile's default model unless settings name another.
• Which of the designs in the "Exploring Super-agent Design" article are still to come. DeepSeek says only that some are "directions for future development".
• Whether the 4,000-star figure and the funding figures in some coverage are accurate; we could not verify either.

What to watch next

• Independent security reviews of the permission model, and of the Feishu and GitHub source plug-ins.
• Whether DeepSeek turns the prototype into a supported product or documents measured results.
• Adoption of the observe workflow: teams publishing what the agent "would have done" would be the first real evidence of quality.
• How other agent vendors respond on authorisation design, especially for bots and unlisted users.

Sources

• dsh-superagent README (DeepSeek Harness Team)
• 000 Philosophy
• 002 Authorization
• 003 Execution
• 006 Deployment
• ShiftDelete: DeepSeek coding agent Super-agent takes aim at Claude Code
• Bloomberg via Techmeme: DeepSeek drops enhanced coding agent with aim to rival Anthropic