Claude Code vs dsh-superagent (DeepSeek)

Claude Code 82

2.1.302 on 2026-10-16, also the npm latest on 17 October (30). 75 releases between 19 July and 16 October, counted from the dated changelog page (20). A public issue tracker with automatic triage, duplicate detection and labels, but over 5,000 open issues and no visible maintainer replies on the page we read, per the 1 October check, not re-read on 17 October (12). The Python and TypeScript Agent SDKs that run the same loop are current, Python 0.2.168 on 15 October and TypeScript 0.3.302 on 16 October (15). Signed releases and a stable channel, but no public CI for the program (5). 30+20+12+15+5 = 82.

dsh-superagent (DeepSeek) 34

Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm latest is 0.2.1-rc.5 (29 October 2026) (4).

Claude Code 80

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Usage metrics on by default on the Claude API, without code, prompts or file paths, error reports on by default for Pro and Max sign-ins since v2.1.198, and every provider sends WebFetch hostnames to api.anthropic.com for a blocklist check, each with an opt-out. Metrics, error reports and /feedback are off by default on Bedrock, Google Cloud, Foundry and Claude Platform on AWS, while session surveys and the WebFetch check run on every provider. Consumer plans train on data when the user's setting allows it. The data-usage page was re-read on 17 October (18). Six modes, allow, ask and deny rules, protected paths, and managed settings that can disable bypass and auto mode and that nothing else overrides. The sandbox is opt-in and absent on native Windows, and auto mode, a classifier rather than a person, is the starting mode for interactive sessions, all re-read on the permission-modes and sandboxing pages on 17 October (16). The auto-mode classifier blocks named exfiltration patterns, the sandbox proxy denies hosts outside an allowlist that starts empty, and WebFetch checks a blocklist, but since 1 October 2026 a mod can approve a call a deny rule refuses unless managed settings or a Team or Enterprise sign-in hold it (11). Opt-in OpenTelemetry with tool content behind OTEL_LOG_TOOL_CONTENT, local transcripts for 30 days, and cloud sessions logged through a proxy. 2.1.301 adds classifier_verdict and permission_mode to tool_decision events (15). HackerOne bug bounty and SECURITY.md, both unchanged in the repository on 17 October, advisories published with GHSA ids, the newest GHSA-pq7j-f95f-qfcv (High) on 15 October, and anthropic.com's security.txt valid to 31 December 2026, re-read on 17 October (20). 18+16+11+15+20 = 80. SOC 2 isn't scored on the framework reading. Advisories, and the sandbox and permission-rule fixes in 2.1.288 to 2.1.300, count under negative events. The mods held behind deny rules are as described in the sec-default README re-read on 15 October. Judgement call, written by an agent on Claude, and this is the same checklist the other four harnesses got.

dsh-superagent (DeepSeek) 33

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The superagent profile is created from DSH's Web template, and DSH documents that shipped profiles mount session-log-deepseek, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and GH_TOKEN and GITHUB_TOKEN are removed from git (8). Both presets run danger-full-access without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, observe default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).

Claude Code 50

Local-package reading. Official installers for macOS 13+, Windows 10 1809+, Ubuntu 20.04+, Debian 10+ and Alpine 3.19+, signed apt, dnf and apk repositories and a GPG-signed manifest of checksums for every binary, re-read on the setup page on 17 October (20). No public CI or test suite for the program, since the source isn't published, and the repository's workflows on 17 October are still issue triage and tests for mods (0). Over 5,000 open issues and 735 open pull requests, with area, platform and regression labels on new reports but no maintainer replies visible on the first page, per the 1 October check, not re-read on 17 October (10). Every change still ships as a 2.1.x patch. 2.1.299 narrowed MCP allow rules so mcp__a no longer covers a server named a__b, 2.1.300 made two removed claude remote-control flags exit with an error, and 2.1.302 on 16 October changed the starting permission mode of claude -p and Agent SDK sessions again, with no breaking-change heading, though a stable channel skips releases with major regressions (5). 2.1.302 (15). 20+0+10+5+15 = 50. Same reading as Cursor CLI and GitHub Copilot CLI, which are also closed source.

dsh-superagent (DeepSeek) 15

Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (private: true in package.json, and the registry has no dsh-superagent). It installs from a git clone with pnpm install && pnpm build on top of @deepseek-ai/dsh@0.2.1-rc.3, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and pnpm check runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).

Claude Code 81

Closed source with clear terms, LICENSE.md pointing to the Commercial Terms, unchanged on 17 October (15). The data-usage page, re-read on 17 October, states retention per account type (consumer 30 days or 5 years with training on, commercial 30 days, zero retention for qualified Enterprise), 30 days of plaintext local transcripts, 5 years for /feedback reports and 6 months for shared survey transcripts, and these agree with the privacy policy links, but the logging and error-tracking services are named only as third parties. The page doesn't say that since 2.1.300 local transcripts also record each API request's system prompt, tools and parameters. We read that as an omission rather than a contradiction, since it describes the same local files (25). No written deprecation policy. The README still marks npm installs deprecated without a date, while the setup page lists npm without that label. The changelog page dates each release after it ships, and the one dated advance notice found, standalone Claude Design closing by 14 December 2026 in 2.1.302, concerns a separate product (8). Telemetry is documented per provider and per service with an opt-out for each, re-read on 17 October (20). 15+25+8+20 = 68.

dsh-superagent (DeepSeek) 52

MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).

Claude Code 87

Framework reading, adapted to a harness driven by a pipeline. One command (claude -p) runs a task with MCP servers from --mcp-config, and MCP tools can be deferred behind tool search (25). --max-turns, --max-budget-usd and a background-command timeout stop runs (since 2.1.288 the timeout applies only to unattended sessions such as -p, the Agent SDK, CI and cloud), and large MCP results go to a file (20). json and stream-json output, and -p errors name the cause, such as Failed to authenticate (16). --resume, --continue and --fork-session, and one retry limit per model call of at most 14 requests (18). Python and TypeScript Agent SDKs, but the starting permission mode depends on version, plan, provider and telemetry. 2.1.302 on 16 October moved -p and Agent SDK sessions on third-party providers, with telemetry off or on a fresh install, back to default, while the permission-modes page read on 17 October still says auto, so a pipeline has to set it (8). 25+20+16+18+8 = 87.

dsh-superagent (DeepSeek) 67

Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's standard with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of blocked or failed, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix agent/), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).

Claude Code 20

Harness reading of the published rubric. No payment protocol (0). Plan prices and per-token API prices are public without a login, re-read on claude.com/pricing on 17 October, though plan usage limits aren't given as numbers (20). No free route. The free claude.ai plan excludes Claude Code, and the API, Bedrock, Google Cloud and Foundry are paid (0). A person signs in through a browser or creates a key, and there's no supported local-model mode (0). 0+20+0+0 = 20. Judgement call, against Anthropic's own product. The Claude Agent SDK earned 20 for a free package because a framework is the thing you install, whereas a harness is useless without the paid account, so we didn't credit the free download here.

dsh-superagent (DeepSeek) 40

Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run auth login for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.