Devo Desktop Coding Agent
A model-neutral Rust coding agent runtime with a Desktop app and terminal TUI/CLI for private and intranet environments, connecting DeepSeek, Qwen, Kimi, GLM, or any compatible model endpoint.
README claims permission review, sandbox crates (linux/windows-sandbox, execpolicy, network-proxy), and backup/restore tests, but this review sees only claims and crate names — no permission model or confirmation flow details, so least_privilege and user_confirmation score 1. Sensitive-data handling is concrete (auth. separation, keyring-store, redacted-preview test): 2. Dependencies are mostly versioned crates.io pins, but git patches and vendored crates exist: 2. Rollback is backed by full backup/restore tests: 2. MIT LICENSE names the copyright holder but the publisher is unverified: source_attribution 1.
CI runs check/test/fmt/clippy/doc with -D warnings, and desktop tests cover backup and migration, so self_consistency gets 2. However crossterm/ratatui are patched to a personal git branch and nucleo is pinned to a rev — supply-chain availability risk: dependency_availability 1. Clear error messages in tests and docs: failure_messages 2.
README clearly targets enterprise/private deployment with model-neutral connections, offline install, and Kylin OS: audience_and_scenarios 3. FAQ states pre-1.0 status and API instability: capability_boundaries 2. Tool trigger precision and approval granularity are only mentioned in passing: trigger_precision 1. Broad build matrix (macOS/Linux/Windows, musl/ARM): environment_fit 2.
Multi-language README, linked docs, structured configuration guidance: information_architecture 2. Detailed dual-form install notes including unsigned macOS handling: install_notes 2. Consistent devo-* crate naming: naming_stability 2. FAQ answers real questions: examples_and_faq 2. Pre-1.0 and unsigned-build limitations stated: known_limitations 2. Full LICENSE: 3. Workspace version 0.1.39 conflicts with the README's upgrade example (v0.1.12→v0.1.15) and no CHANGELOG exists: versioning_changelog 1. Sound CI/release pipeline and contribution guidance: maintenance_responsibility 2.
Resumable sessions, token/cost visibility, TUI and Desktop surfaces: output_usability 2. Differentiated by model neutrality, local code search, enterprise/offline scenarios: marginal_value 2. Single Rust binary, optional components off by default: cost_benefit 2.
README capability claims (MCP, Skills, permissions) lack directly checkable config/code in this evidence set: claim_traceability 1. CI config, Cargo manifest, and tests partially corroborate README claims (e.g., code_search off by default matches installer defaults): cross_source_corroboration 1. The project distinguishes tested/supported/roadmap clearly (HarmonyOS explicitly marked on-roadmap): fact_inference_separation 2.
- macOS desktop builds are unsigned and require a manual xattr quarantine removal — verify the binary's provenance before doing so.
- crossterm and ratatui are patched to a third-party personal git branch and nucleo is pinned to a rev, introducing supply-chain and upgrade-stability risk.
- The project is pre-1.0; public APIs and configuration may change. Workspace version (0.1.39) is inconsistent with the README upgrade example version.
- Permission-approval and sandboxing capabilities are only described declaratively; this review could not verify their implementation. Audit crates/execpolicy, crates/sandbox, and confirmation code before deployment.
- The 'verified model' badges in the README are static assertions without reproducible evaluation evidence.
- The online installer uses a curl | sh pattern; read install.sh before executing it.
What does this agent do, and when should you use it?
Devo (GitHub repo 7df-lab/devo) is an open-source coding agent comprising a Desktop app, a terminal TUI/CLI, and a model-neutral Rust runtime. Through provider/model Connections it reaches OpenAI-compatible Chat Completions, OpenAI-compatible Responses, and Anthropic Messages protocols as well as DeepSeek, Qwen, Kimi, GLM, and MiniMax endpoints, supporting offline and intranet deployment without depending on any hosted agent service. The runtime ships MCP server management, reusable Skills, long-running task context management, multi-agent support, Plan Mode, parallel tool calls, and permissioned execution. An optional local semantic code search MCP (code_search) combines dense retrieval with BM25 keyword matching. MIT-licensed and pre-1.0, it is suited for local evaluation and contributor participation.
Devo performs coding tasks inside a local repository: devo onboard writes provider connections and the model catalog to providers. and stores API keys in user-scoped auth.; models are called via the wire_api setting (openai_chat_completions, openai_responses, or anthropic_messages). The devo command starts the interactive TUI, and devo resume <session-id> resumes sessions. The runtime manages context across multi-turn work, breaks tasks into Plan Mode multi-step plans, runs independent tool calls in parallel, and requests permission approval before sensitive tool calls touch the workspace. Sessions record model output, tool calls, approvals, token usage, and history for inspection and resumption. MCP servers are managed via devo mcp add|list|enable|disable|remove; the optional code_search MCP (devo-code-search-mcp) runs a local CPU code-embedding model combining dense retrieval with BM25 for semantic code search. The Desktop app adds graphical session browsing, a project sidebar, and model controls.
- Enterprise teams needing a coding agent inside intranet or offline environments, pointing Devo at internal model gateways without any hosted agent dependency.
- Developers using DeepSeek, Qwen, Kimi, or GLM APIs, who plug in through the built-in model catalog while keeping endpoints swappable.
- Terminal-first engineers using the TUI/CLI for automation, remote shells, and scriptable workflows.
- Teams that need auditable model output, tool calls, and token costs, using resumable session history for review.
- Chinese enterprise users on domestic OSes, deploying across macOS, Linux, Windows, and Kylin OS.
- Advanced users extending the agent with MCP tools and reusable Agent Skills to package repeatable workflows.
What are this agent's strengths and limitations?
- Model-neutral: Connections support three wire APIs (OpenAI-compatible Chat Completions/Responses and Anthropic Messages), letting you switch between DeepSeek, Qwen, Kimi, GLM, MiniMax, OpenRouter, or local endpoints without vendor lock-in.
- Local-first deployment: a single low-overhead Rust binary with offline install support and intranet endpoints; Desktop and terminal share the same local runtime.
- Runtime-level extensibility: MCP servers, reusable Skills, multi-agent flows, permission approvals, and auditable sessions are built-in runtime features, not one-off prompts.
- Optional local semantic code search: the code_search MCP runs a local CPU embedding model with dense retrieval plus BM25, reducing context versus grep/find-only agents.
- The project is pre-1.0 with actively changing public APIs and configuration, creating migration risk for production adoption.
- Current macOS Desktop builds are unsigned, requiring a manual quarantine removal command before first launch.
- The code_search MCP and its Hugging Face model are not installed by default, requiring an explicit --with-code-search install and manual enable.
- Provider responses have no application-level timeout, so slow or local models may take arbitrarily long; cancellation is manual.
- Deeper ecosystem targets such as HarmonyOS remain on the roadmap with no released support yet.
How do you install or deploy this agent?
Desktop app: download the installer for your OS from GitHub Releases (macOS .dmg/.zip, Windows .exe, Linux .AppImage/.deb/.rpm). Current macOS builds are unsigned, so after installing run: sudo xattr -dr com.apple.quarantine /Applications/Devo.appTerminal TUI/CLI: on Linux/macOS run curl -fsSL https://raw.githubusercontent.com/7df-lab/devo/main/install.sh | sh; on Windows run irm 'https://raw.githubusercontent.com/7df-lab/devo/main/install.ps1' | iex. The installer places devo under the Devo home directory and installs the rg sidecar for repository search; it does not install the code_search MCP or its local model by default — add --with-code-search (or set DEVO_INSTALL_CODE_SEARCH=1 on Windows) if you want them. Upgrade an existing install with devo upgrade. For air-gapped installs see docs/offline-installation.md.
How do you use this agent?
- Configure a provider: cd /path/to/your/repo && devo onboard — this writes provider connections to providers. and your API key to user-scoped auth..
- Or configure manually: define provider.<id>.models.<model-id> in providers., store the key in DEVO_HOME/auth. and reference it via provider.<id>.credential (never put the API key in providers.), and set wire_api to openai_chat_completions, openai_responses, or anthropic_messages.
- Run devo to start the interactive TUI in the current repo; use devo resume <session-id> to resume sessions.
- Manage MCP servers with devo mcp add|list|enable|disable|remove; enable code search with devo mcp enable code_search or /mcps in the TUI.
How does this agent compare with similar options?
The README positions Devo for teams needing a coding agent outside a single hosted model ecosystem, making it a counterpoint to agents bound to a specific vendor's hosted service (e.g., tools dependent on OpenAI or Anthropic proprietary endpoints); the differentiator is bringing your own model endpoint while running the entire runtime locally.