Deuz SDK
A zero-dependency TypeScript agent framework for production: durable execution, long-term memory, hybrid RAG, MCP tool calling, and human-in-the-loop approval.
Evidence shows tool-level approval (needsApproval, deny-by-default, HMAC expiring tokens), depth guards, cost/step budgets and checkpoint resume, with tests proving approval inheritance and denial paths. However, data-flow transparency and sensitive-data claims ('keys never reach a log') are README prose without source corroboration, so those score 1. Zero-runtime-deps claim is credible but dev deps use ranges. Trusted publishing + provenance in release.yml is a plus.
Tests show high self-consistency: synchronous return, typed error streams, ContextOverflowError mapping, sub-agent usage folding all asserted; error messages are specific. Dependency availability gets 2: CI runs check across OS/Node versions, but no lockfile or dependency-health evidence appears in the reviewed files.
The 'What this is not' section enumerates capability boundaries item by item (Gemini native wire, DeepSeek V4 structured output, Redis without MULTI, etc.) — full marks. Multi-runtime claims and engines Node>=22 support environment_fit, but only asserted, so 2.
Strong information architecture: 54-subpath map, docs/skills/exports all gated by verify-docs and verify:api; limitations are candid; MIT consistent across root, LICENSE and badge. Changesets plus tag-match verification exist, but the CHANGELOG body is not in evidence. Maintenance rests on a single author — low bus factor, score 1.
Streaming API, resumable UI, observability and durable execution combine into differentiated value; tests prove usable API shape (textStream, usage, finishReason). Cost-benefit is moderate: breadth without verified production maturity, and the README itself concedes the ecosystem gap versus Vercel AI SDK.
A self-built verification chain (verify:api locking 242 exports, skills freshness gate, docs reference lint) materially improves traceability; but this static review can only see README and a test subset mutually corroborating (approval, usage folding) — headline numbers (1,892 tests, 28 providers) cannot be cross-confirmed, so cross_source_corroboration is 1.
- Static review only; no code was executed. Headline numbers (1,892 tests, 28 providers) are claims, not independently verified.
- Privacy and key-handling claims ('opt-in capture, keys never reach a log/span') have no source evidence in the supplied files; audit /observe and logging paths before adoption.
- Publisher is registry-unverified and the project is single-maintainer; update and security-response cadence is uncertain.
- Re-test against live endpoints before production: the README admits speech/transcription/video are mock-tested only.
- Outward-facing capabilities (MCP, browser, workspace) carry external side effects; configure needsApproval per tool before deployment.
What does this agent do, and when should you use it?
Deuz SDK (Deuz-AI/Deuz-SDK) is a TypeScript framework built around @deuz-sdk/core, positioned as 'a runtime for agents that have to survive production', released under the MIT license. Its headline features are the two things it claims most SDKs don't ship: a long-term memory pipeline that extracts durable facts, reconciles them (add/update/delete, never blind appends), scores importance, expires them, and recalls relevant ones across sessions; and automatic compaction that keeps long runs alive by pruning stale tool output and folding early turns into a single running summary, force-compacting and retrying when a provider still rejects a request as too long. Its execution model is built on zero runtime dependencies and no ambient state — clock, randomness, fetch, keys and logging are injected through a single Dependencies seam, so the same code runs on Node, Bun, Deno and the edge, and tests stay deterministic. The API surface includes streamChat, generateText, generateObject, embed, createAgent, handoff, 28 chat provider adapters, MCP with OAuth 2.0, HMAC-signed expiring human-approval tokens, step checkpoints stored in your own database, guardrails, and OpenTelemetry-based observability. The author also ships two Agent Skills (deuz-sdk and migrate-from-ai-sdk) that are validated against the real export table and compiled examples, installable for Claude Code via npx skills add.
After installing @deuz-sdk/core, developers construct model instances via 28 provider adapters such as createAnthropic and call streamChat (returns synchronously, never throws — failures arrive as typed stream parts) or generateText for tool-loop conversations. generateText supports maxSteps, parallel tool calls, self-healing errors, cost and token budgets, and sub-agents; the memory option plugs into a vector store, Postgres, or an Obsidian vault for cross-session facts; compaction: 'auto' compresses the window on overflow. handoff() moves history, tools and the model to another agent; mcp: [{ url }] connects an MCP server in one line (OAuth 2.0, reconnect, sampling, roots); needsApproval triggers human approval at any depth with HMAC-signed expiring tokens where a missing verdict denies; the durable module writes step checkpoints in your database and supports resumeFromCheckpoint; guardrails such as promptInjectionGuardrail and maxOutputLength pass/block/rewrite input, every tool call and the final answer. An optional @deuz-sdk/react package provides useChat, useObject and ToolApprovalCard. Running npm run check executes 1,892 tests, a dual build, publint, an edge bundle with no Node leaks, and a locked list of 242 public exports.
- Product developers building assistants that must remember user preferences across sessions and turns, using the memory pipeline instead of hand-rolled message arrays.
- Authors of long-running autonomous tasks (research, data pipelines) who need crash recovery via checkpoints without a workflow vendor.
- Agents performing irreversible actions (payments, deletions, external sends) that require HMAC-signed, expiring human approval gates.
- Teams connecting external tool servers via MCP who want OAuth 2.0, reconnect and namespacing handled for them.
- Teams needing one streaming API across Claude, GPT, Gemini, Grok, Mistral and DeepSeek with the freedom to switch providers.
- Teams migrating from the Vercel AI SDK, using the verified migrate-from-ai-sdk skill for a name-by-name port.
What are this agent's strengths and limitations?
- Zero runtime dependencies and no ambient state: clock, randomness, fetch and logging are injected, so the same code runs on Node, Bun, Deno and the edge and tests stay deterministic.
- Durability without a workflow vendor: checkpoints and journals live in your process and your database, with resumeFromCheckpoint.
- A strict release gate: npm run check covers 1,892 tests, publint, an edge bundle with no Node leaks, and a locked list of 242 public exports — removing an export fails the release, not your build.
- A separate live test suite calls real provider endpoints and has caught real edge cases like Gemini's finishReason: STOP and thinking models' usage envelopes.
- Agent Skills are validated against the export table on every commit and every example is compiled, preventing coding agents from inventing nonexistent APIs.
- The ecosystem is smaller than the Vercel AI SDK — the README explicitly acknowledges that gap is not closing this year, so adoption is a deliberate bet.
- Documented gaps: overflow recovery doesn't reach the Gemini native wire; generateObject cannot coerce a DeepSeek V4 model; the Redis pack has no MULTI; token counting is a calibrated heuristic; rerank is the identity reranker; MCP has no WebSocket transport; the Part union has no AudioPart.
- Speech, transcription and video are covered by mocked tests but have not been run against a live endpoint.
- Core lint bans Date.now() and Math.random(), so teams must adapt to dependency-injection style development.
- Advanced behaviors like memory write policies and compaction require learning the seams abstraction — a real learning curve.
How do you install or deploy this agent?
Requires Node.js >= 22 or any edge runtime with fetch. Install: npm install @deuz-sdk/core (the runtime); optionally npm install @deuz-sdk/react (useChat, useObject, headless UI). Optional peers are installed only when used: zod, @modelcontextprotocol/sdk, react, pg/redis, unpdf/mammoth/xlsx, playwright, @opentelemetry/api. For contributing: git clone https://github.com/Deuz-AI/Deuz-SDK.git && cd Deuz-SDK && npm install && npm run check. To teach your coding agent: npx skills add Deuz-AI/Deuz-SDK.
How do you use this agent?
Minimal example: import { streamChat } from '@deuz-sdk/core'; import { createAnthropic } from '@deuz-sdk/core/anthropic'; const anthropic = createAnthropic({ apiKey: process.env.ANTHROPIC_API_KEY }); then const res = streamChat({ model: anthropic('claude-opus-4-8'), instructions: '...', prompt: 'Hello!' });, consume the stream with for await (const chunk of res.textStream), and get await res.usage. Advanced: in generateText, configure tools, maxSteps, guardrails, memory.seams (store, embedder, llm), session.store (Postgres/SQLite/Redis packs), mcp: [{ url }], and runtimeContext (tenant context travelling with the call). Full documentation lives in the repository's docs/ directory.