DeepAgent Code
An open-source AI coding agent with persistent memory and a control plane, keeping long-running engineering work coherent across turns, restarts, and collaborators.
Evidence shows a well-developed safety design: MCP servers default to not-connected with approval gates for write and external-fetch, risk tiers derived from catalog templates rather than user-writable config (anti-injection), credentials in OS secret storage or 0600 files, write-capable subagents in dedicated worktrees with generation fencing against stale workers, and pause/takeover/rollback paths with durable audit trails. However, nearly all of this is self-description in README/SECURITY; no permission-gate or approval implementation appears in the sampled files, so each safety item scores 2 (thoroughly described, only partially verifiable). Dependency security shows only pinned catalogs and a patch list with no audit or vulnerability mitigation evidence — 1. Source attribution is strong: full AGPL-3.0 text, NOTICE referencing opencode/MIT upstream with a no-endorsement disclaimer, but NOTICE itself is not in the sample — 2.
Tests are self-consistent with the docs: connection.test.ts and daemon.test.ts cover transport fallback, Basic-auth health checks, deregistration of unauthenticated servers, and SIGTERM teardown, matching the fixture's stated protocol; Bun 1.3.14 is pinned and catalog versions locked, supporting reproducible setup — 2. Failure messages: assertions for a 'No workspace selected' hint and a fallback warning indicate explicit error paths, but coverage in the sample is narrow — 2.
Targets desktop/terminal, 75+ providers, 38+ LSP servers with an explicit degradation statement ('degrades gracefully to grep/read'), and honest boundary statements (provider overrides 'best-effort, not guaranteed') — 2. But trigger precision for Auto/Loop/Design modes and problem-profile domain-pack activation is narrative only, with no examples or decision criteria — 1.
Repository structure is clear (packages/*, design/, script/) and README/SECURITY/PRIVACY/CONTRIBUTING/CHANGELOG plus concrete install/build/import commands exist, but the npm package is unpublished and the primary install path is a curl | bash pipe (weak supply-chain auditability) — install_notes 1. LICENSE contains full AGPL-3.0 with MIT upstream derivation and package. agrees — 3. Versioning sits on a core-v4.0-beta branch and CHANGELOG is only referenced, not shown — 1. Known limitations are barely disclosed amid heavy capability claims (only provider overrides admitted as non-guaranteed) — 1. Maintenance responsibility: SECURITY states supported branches and backport policy, CI pins actions by SHA — 2.
Output usability design is strong: evidence artifacts keep raw tool output out of model context, summaries with file:line only, byte-stable prompt caching — consistently described — 2. Marginal value over existing agents (including its own upstream opencode) rests on persistent memory and a governed knowledge lifecycle: a genuine differentiator but unverified — 2. Cost-benefit: the README steers users toward the proprietary DeepAgent API platform ('recommended') and quantifies neither self-hosting cost nor token consumption — 1.
Core architecture claims (Session V2, Context Epoch, Expert Panel arbiter) point to design/README.md which is not in the sample, so claim traceability is weak — 1. Cross-source corroboration is decent: daemon/connection tests, fixture comments, and SECURITY's credential-storage statements are mutually consistent — 2. Fact/inference separation: the README mixes tables with marketing phrasing ('Memory you can see'), yet disclaimers like best-effort overrides preserve honest boundaries — 2.
- Primary security claims (approval gates, risk tiers, credential storage, generation fencing) come only from README/SECURITY self-description; no corresponding implementation appears in the sampled files, so treat them as unverified.
- The primary install path is a curl | bash remote script and the npm package is unpublished; prefer building from source or inspecting the script before running it.
- Registry license metadata is NOASSERTION while repository files claim AGPL-3.0-or-later; verify final licensing status before redistribution.
- Extensive capability claims in the README lack in-sample corroboration (design/ docs not provided); hold reservations about persistent memory, Expert Panel, and similar claims.
- No published npm artifact means no available integrity verification (signatures/hashes) for the install path.
What does this agent do, and when should you use it?
DeepAgent Code (GitHub: deepagent-ltd/deepagent-code) is an AI coding workspace for work that outlives a single prompt, delivered as both a desktop app and a terminal experience, licensed AGPL-3.0-or-later and derived from the MIT-licensed opencode. It runs in three collaboration modes: Auto (end-to-end autonomous execution), Loop (maintains an editable goal+plan.md advanced through plan/execute/verify/iterate ticks), and Design (faithfully executes a user-supplied plan). Its key differentiator is persistent, governable, layered memory: project state lives in typed, versioned documents (knowledge, memory, design, worklog, and more), and learning follows a gated lifecycle of evidence, review, and regression/ablation checks. During execution it supports live steering, hot plan editing, pause/resume/takeover/rollback, with autonomy independent of permission level (read-only, approval-required, or full access). Context is assembled from a code graph, knowledge graph, project memory, and document graph via a Session V2 runner, backed by LSP and 38+ language servers. It is provider-agnostic, supporting 75+ model providers plus any OpenAI- or Anthropic-compatible endpoint with your own API keys.
Reads the codebase and builds a code graph (files, symbols, imports, calls, diagnostics, references), querying it by symbol and intent through a built-in AI IDE microservice (e.g. code_intel({ symbol: "AgentGateway.open", intent: "overview" })) on top of 38+ LSP language servers. Executes tasks in Auto/Loop/Design modes: Loop mode writes and advances goal+plan.md through plan→execute→verify→iterate until objective completion criteria are met. Partitions independent work across bounded subagents; write-capable subagents get dedicated worktrees and commits flow through a Reviewer SHA check, a coordinator's serial --no-ff merges, and a Senior Reviewer pass, all generation-fenced so stale workers cannot overwrite newer merges. For high-risk decisions it convenes an Expert Panel: correctness, security, performance, architecture, and reproducibility lenses debate anonymously for up to three rounds before a deterministic arbiter rules, preserving minority opinions and failing closed to human review. Agents can be mentioned in Project IM threads to start scoped runs with streamed progress and inspectable artifacts. Memory learning follows candidate → isolated review → regression/ablation gates → published knowledge snapshot; the Session V2 runner admits context under a durable Context Epoch, writing raw tool output to evidence artifacts and admitting only summaries and file:line snippets into model context.
- An engineer inheriting a long migration: define the goal once in Loop mode and advance it across many plan/execute/verify ticks; state survives restarts.
- Teams maintaining a large unfamiliar codebase: locate endpoints, call chains, and diagnostics via LSP symbol/intent queries instead of guessing file paths.
- A lead parallelizing multi-module changes: delegate isolated subtasks to worktree-isolated subagents with a generation-fenced merge and review pipeline.
- Teams with strict architecture or security review requirements: convene an Expert Panel where multiple lenses debate anonymously and an arbiter produces an auditable verdict.
- Users who care what the agent 'learned': browse, search, and trace knowledge lineage in the Repo & Wiki view and reject patterns that should not repeat.
- Developers avoiding vendor lock-in: connect 75+ providers or any OpenAI/Anthropic-compatible gateway with their own API keys.
What are this agent's strengths and limitations?
- Persistent, governable memory: sessions survive restarts; learning passes an evidence/review/regression-gate lifecycle with durable rejection reasons so bad patterns aren't silently relearned.
- Controllable while running: live steering, hot plan editing, and pause/resume/takeover/rollback all have durable audit trails — active collaboration, not fire-and-forget.
- Engineered multi-agent collaboration: subagents get dedicated worktrees and generation fencing, so a stale worker cannot settle or overwrite newer merges.
- Provider-agnostic: 75+ providers via AI SDK and models.dev, plus any OpenAI/Anthropic-compatible endpoint, with prompt caching kept byte-stable across long runs.
- Symbol-level code understanding via LSP (38+ language servers), including unsaved editor buffers in analysis.
- The npm package is not yet publicly published, so installation depends on the install script or the desktop app; package-manager users must wait or build from source.
- Repository metadata reports the license as NOASSERTION; per the README it is AGPL-3.0-or-later — if you modify and run it as a network service you must make source available, a material constraint for closed-source commercial integration.
- Requires provider API keys at your own cost; custom-endpoint overrides for context/reasoning/temperature are best-effort and not guaranteed to keep a model working.
- Substantial architectural complexity (Session V2, Context Epoch, domain packs, five-layer graphs) raises evaluation and onboarding cost compared with simpler scaffold agents.
- As a fork of opencode, it carries the maintenance cost of tracking upstream divergence on its own.
How do you install or deploy this agent?
Option 1: install the desktop app. Option 2: run the install script on macOS/Linux: curl -fsSL https://deepagent.ltd/install | bash. Note: the deepagent-code npm package is not yet publicly published. To build from source you need Bun 1.3.14: git clone https://github.com/deepagent-ltd/deepagent-code.git && cd deepagent-code && bun install; desktop: bun run dev:desktop, terminal: bun run dev. After installing, run deepagent-code (alias: deepagent), then log in to a model provider with deepagent auth login (a provider API key is required). Configuration lives in ~/.deepagent/code/config.c; official-provider keys are stored separately in ~/.deepagent/code/auth..
How do you use this agent?
One-shot terminal task: deepagent-code run "add rate limiting to /api/users endpoint". The agent locates the endpoint via LSP, checks project memory for existing middleware patterns, activates relevant domain packs, implements per project conventions, runs tests, and proposes a candidate memory. In the desktop app, go to Settings → Providers → DeepAgent → Connect and paste an API key, or add a Custom provider (Base URL + key; the protocol is auto-detected and models are discovered from the endpoint's /models list). While a task runs, send live steering messages (absorbed at the next safe provider-turn boundary), hot-edit goal+plan.md, queue future activities explicitly, or pause/resume/take over/roll back. Import existing history with: bun run --cwd packages/deepagent-code dev import-history --from codex --dry-run.
How does this agent compare with similar options?
The README explicitly states DeepAgent Code is derived from opencode (MIT licensed). Compared with upstream, DeepAgent Code adds persistent layered memory, Loop/Design modes driven by goal+plan.md, live steering and hot plan editing, generation-fenced subagent collaboration with worktree isolation, and an Expert Panel decision mechanism — but under the stronger AGPL-3.0-or-later license instead of MIT.