Agent Zero vs dsh-superagent (DeepSeek)

Agent Zero 57

Read with the local-software lines, as software the owner runs. Installs from the agent0ai/agent-zero Docker image, an install script, or a desktop Launcher with builds for macOS, Linux and Windows on x86 and ARM64. The README says it runs wherever Docker runs. The image registry page was not read (17 of 20). The repository holds 191 test files, and its only two workflows publish Docker images and close inactive issues, so no public CI run shows the tests passing (5 of 25). 139 open issues and pull requests on 12 October 2026. Open reports from September include a crash of run_ui after a failed memory consolidation (#1909), a browser worker that hangs the agent turn (#1923) and truncated backups (#1904), each with no reply or one, and a workflow closes anything inactive for 90 days (11 of 25). Release notes for v2.11, v2.12 and v2.13 carry a Breaking Changes section, but breaking changes ship in minor versions, so the numbering is not semver (9 of 15). v2.13, past 1.0 (15).

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Agent Zero 75

v2.13 was published on 23 September 2026, 19 days before this check (30). Nine releases since 14 July 2026, v2.5 to v2.13 (20). Of the 40 newest open items read on 12 October, 16 are issues and 14 of those have no comment. Three security reports filed as issues were closed as completed, one in five days and two after three months (10 of 25). The Docker image, the desktop Launcher, the install scripts and the A0 CLI connector come from the same organisation, and the README links Launcher 1.8 (10 of 15). A Docker publish workflow builds images from tags, and the v2.0 notes record a LiteLLM upgrade past a patched CVE floor. No public test CI (5 of 10).

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Agent Zero 54

Harness reading of the framework checklist, the one the Goose calibration dossier uses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No usage telemetry was found in the source. An update check, on by default, posts the version and a 20-character hash of the instance id to api.agent-zero.ai, and one setting turns it off. The reviewed docs do not describe what it sends (22). The agent works inside a Docker container built on Kali Linux and runs as root there. Tool Access can block tools by project or profile and defaults to allow, host access through the A0 CLI is scoped by read, write and execute permissions, and no approval step was found before a shell command, a file deletion or an outgoing message. The web interface has no login until a username is set (10). Infection Check audits the agent's reasoning with a second model before each tool call and ships disabled. Scanners check plugins, skills and MCP servers before install. The channel allow-lists accept every sender when empty, and the email filter matches the claimed From address only, which the plugin README states (7). Chat logs, visible tool steps and Time Travel snapshots, with no per-call audit log. Per-process log files were removed in v2.5 (9). No SECURITY.md, security.txt answered 404, and the repository has no published advisory, while NVD lists five CVEs since March 2026. A security-review ledger in the repository records two findings, and the v2.12 notes name both fixes (6).

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Agent Zero 60

Read with the self-hosted rule. No payment protocol in the source (0). Free under MIT with nothing to buy for the software, so 20, 20 and 20 on the last three lines. It starts with one Docker command and no account. Model usage is billed by whichever provider the owner configures, or costs nothing with a local model. The vendor's site also describes a beta LLM API whose daily quota depends on staking its A0T token. That is separate from the software and not scored.

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.

Agent Zero 59

MIT, copyright Agent Zero, s.r.o. (30). No privacy policy for the software was found. The site's cookie notice covers the website, and its terms cover the community platform. The docs say where data lives (chats, memory, secrets and settings under /a0/usr) and warn that model providers see what is sent to them only in general terms, with no retention statement (8 of 30). Release notes list breaking changes and removals with the release date, and one deprecated alias is named. No deprecation policy or notice period was found (8 of 20). No telemetry was found, and the update check has an off switch in settings, but what it sends is not described in the reviewed docs (10 of 20).

dsh-superagent (DeepSeek) 52

MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).

Agent Zero 62

Harness reading, scored on what a person or program driving it must supply. Skills load on demand, blocked tools are removed from the prompt, chats can be compacted, and the v2.12 notes report Codex input falling from about 16.4K to 11.3K tokens, a vendor figure (18 of 25). An MCP tool timeout of 120 seconds, a limit of five consecutive unusable responses and context-window handling are set by default. No turn or spend limit was found in the reviewed docs (11 of 20). Other programs reach it through POST /api_message, an optional MCP server, A2A and an ACP bridge, with request and response shapes left to the source (11 of 20). An error-retry plugin, saved chats, a message queue, backups and Time Travel snapshots with diff and revert (14 of 20). One Docker command starts it and a wizard sets the model, but there is no SDK and the default has no login (8 of 15).

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).