A DeepSeek team has published an open-source coding agent that takes requests on GitHub, works on them in its own sessions and comes back with pull requests. The code went up on 31 October as dsh-superagent-prototype on GitHub, under the MIT license, in a single commit. The catch for anyone tempted to run it at work is in the deployment docs: its workers run with full access to the machine.
What it does
The agent watches one GitHub repository and, optionally, chats in the Feishu workplace app. When someone on an allowed list mentions it, it opens a work item called a Ticket and handles it in a separate session and folder. It then replies in the original thread, often with a pull request, and a web panel lists only what needs a person, according to the project README.
It runs as a bundle for DSH, DeepSeek’s own agent software. The design goal, spelled out in the philosophy document, is to take as little human attention as possible. The agent confirms a request once, stays quiet while it works and writes again only with a result, a question or a failure.
DeepSeek is blunt about maturity. The README calls it a research prototype, not an official product, says much of it was written by coding agents and warns it may contain bugs. It also differs from DeepSeek’s internal version.
Setup takes a dedicated account and an agent
You do not install it by hand. The README tells you to ask your own coding agent to read SETUP.md, which walks through up to nine questions one at a time, shows a plan and then installs everything. Prerequisites include Node.js 22.19 or later, pnpm, tmux, Python 3.8 or later, GitHub CLI 2.48 or later and a model provider.
The agent needs its own GitHub user account with write access. A GitHub App will not work because the agent reads the account’s notifications, and GitHub Enterprise Server is not supported, per the deployment guide. Once it runs, a comment that mentions the agent on an issue should produce a Ticket within about a minute.
The repository lists no price. The code is free, so the running cost is whatever your model provider charges for the sessions it spawns. We have not run it, so we cannot say how long setup takes in practice.
The defaults are careful, the sandbox is not
Proactive work is effectively off at first. The default accept mode, observe, assesses messages nobody addressed to the agent and records “would accept” without acting, according to the authorization rules. The team suggests moving to auto only after reviewing those records.
Merging is also conservative. The agent never turns on auto-merge as its own account. Its default instructions allow auto-merge only for ready pull requests with approvals on the latest commit and fewer than 200 changed lines, per the execution docs. Those are instructions to the agent, so DeepSeek tells teams to enforce approvals with branch protection too.
Isolation is where it breaks. Both the router and worker presets run with full access as the operator’s own OS user, and a worker can read the operator’s home directory. The account wrappers “do not isolate the process,” the deployment guide says, and the execution docs call them “defaults, not a security boundary.” Compare that with AWS letting agents start Step Functions workflows without changing them, where the limits sit outside the agent.
Agent pull requests still need a human willing to merge them. That is what newer tests try to measure, as in our look at how outside coding agent rankings scored Mistral Large 4.
What to do this week
If you want to try it, point it at a throwaway repository and leave accept mode on observe. Run it under a separate OS user that holds only the agent’s credentials, as the deployment guide advises. Read the philosophy and authorization documents first: they are short, and they tell you who can make the agent act.
Sources
Get the weekly email
The week's most useful AI news, a tutorial and an interview.
Anna Jakovleva
Anna Jakovleva is the senior editor for AI tools at AI Observer, leading coverage of agents and automation, design and product, and the site's tutorials. She worked in operations and product teams before joining, so she judges tools by setup time, cost and where they break. Her writing is hands-on and practical.
Spotted a mistake? Tell us on the corrections page.