# dsh-superagent (DeepSeek) vs GitHub Copilot CLI (slim)

> GitHub Copilot CLI scores 58.4 (C) to dsh-superagent's 42.1 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.md (~7,450 tokens) · this version ~3,680 tokens · JSON https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.json · canonical https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-01
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GitHub Copilot CLI scores 58.4 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. Both do agent harnesses.

- dsh-superagent (DeepSeek): E 42.1, rank #1108 of 1251 · https://www.anchorterminal.com/tools/deepseek-superagent.min.md
- GitHub Copilot CLI: C 58.4, rank #686 of 1251 · https://www.anchorterminal.com/tools/github-copilot-cli.min.md
- dsh-superagent (DeepSeek), good for Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account. Also Open source; No incidents deducted, where GitHub Copilot CLI loses 5 points for them.
- GitHub Copilot CLI, good for Developers and teams already on GitHub and Copilot who want an agent that knows their repositories and issues, and a cloud agent that opens pull requests. Ahead on Reliability, 55 against 15; Schema & documentation, 72 against 61; Agent ergonomics, 72 against 67; Security & auth, 63 against 33; Maintenance & community, 77 against 34; Transparency & trust, 71 against 52.

| Category | dsh-superagent (DeepSeek) | GitHub Copilot CLI |
| --- | --- | --- |
| Reliability (16%) | 15 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 61 | 72 |
| Agent ergonomics (13%) | 67 | 72 |
| Security & auth (14%) | 33 | 63 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 34 | 77 |
| Transparency & trust (7%) | 52 | 71 |

| Fact (where they differ) | dsh-superagent (DeepSeek) | GitHub Copilot CLI |
| --- | --- | --- |
| Vendor | DeepSeek | GitHub |
| Auth | Token | OAuth or key |
| Pricing | Free | Freemium |
| Licence | MIT | Proprietary, under the licence in the repository's `LICENSE.md`. Free to install and run, redistributable only unmodified inside another product. The repository holds the README, changelog and install script, not the source |
| llms.txt | no | yes |
| Last release | 2026-10-31 | 2026-10-14 |
| Terms last updated | no document linked | 2026-04-27 |
| Privacy policy last updated | 2026-09-20 | 2026-04-27 |
| Customer content may train models | not read yet | yes, with an opt-out |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 11k stars |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Maintenance & community, GitHub Copilot CLI +43: dsh-superagent (DeepSeek) 34 (Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).); GitHub Copilot CLI 77 (1.0.98 on 2026-10-14 (30). 26 releases between 20 July and 14 October (20). Issues are labelled and triaged, with automation for stale and unanswered reports, though about 1,900 stay open, per the 1 October check (14). An SDK the changelog keeps updating (session APIs, MCP management, OAuth tokens), languages unchecked (10). Closed source and a bundled npm build, so no CI or dependency health to read (3). 30+20+14+10+3 = 77.)
- Reliability, GitHub Copilot CLI +40: dsh-superagent (DeepSeek) 15 (Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install && pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).); GitHub Copilot CLI 55 (Local-package reading. npm, Homebrew, WinGet and an install script for Linux, macOS and Windows, with PowerShell 6 or newer named for Windows, though the npm package declares no engines (20). No public CI or test suite, since the source isn't published, and the repository holds only the README, licence, changelog and install script (0). About 1,900 open issues and 28 open pull requests, labelled by area and platform with a triage label and no-response automation, per the 1 October check, not re-read on 17 October (12). A dated changelog for every release, with breaking changes marked BREAKING, though they ship in 1.0.x patch versions (8). 1.0 since March 2026, and npm `latest` (1.0.98) now matches the changelog (15). Same reading as Claude Code and Cursor CLI, which are also closed source. 20+0+12+8+15 = 55.)
- Security & auth, GitHub Copilot CLI +30: dsh-superagent (DeepSeek) 33 (Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).); GitHub Copilot CLI 63 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. The CLI sends product telemetry (the 1.0.91 changelog flushes it on exit) and we found no opt-out in the docs or the command reference on 17 October. Since 24 April 2026 Free, Pro, Pro+ and Max interactions train GitHub's models by default, with an opt-out, and Business and Enterprise data is excluded. A fine-grained token with only the Copilot Requests permission works for CI (14). Asks before the first use of each modifying tool, deny rules that beat `--allow-all-tools`, URL and path permissions, trusted directories and enterprise managed settings. Local sandboxing has been available to all users since 1.0.93 (7 October 2026), and GitHub calls it generally available. It is off by default, enterprises can require it and make sessions fail closed where it can't be enforced, and `permissions.limitTo` sets managed network boundaries. Built-in file tools honour the sandbox policy on a best-effort basis, and the CLI still can't enforce two organisation MCP policies (17). The sandbox proxy filters hosts, sandboxed shells withhold `GITHUB_TOKEN` since 1.0.92, and content exclusion applies, but we found no prompt-injection guidance for the CLI (9). OpenTelemetry export with GenAI spans, opt-in, with enterprise capture controls since 12 October, and session logs (13). Two advisories with CVEs published in 2026 and none since, but no SECURITY.md in the repository and an expired security.txt on github.com per the 26 September check, which github.com didn't let us re-read on 17 October. We didn't check GitHub's bug bounty (10). SOC 2 isn't scored on the framework reading. 14+17+9+13+10 = 63.)
- Transparency & trust, GitHub Copilot CLI +19: dsh-superagent (DeepSeek) 52 (MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).); GitHub Copilot CLI 71 (Proprietary licence with clear terms for running and redistributing (15). The data-use page dates the training change (24 April 2026), says which plans it covers and how to opt out, and says Business and Enterprise data isn't used, but we didn't find retention periods for CLI sessions (18). On 15 October 2026 GitHub gave dated notice that Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave all Copilot experiences on 16 November 2026, 32 days later, with a named alternative for each. Breaking changes are marked in a dated changelog. There's no written deprecation policy or notice period, the same reading as openai-codex and gemini-cli (15). OpenTelemetry export is documented, but the product telemetry the CLI sends isn't described and we found no switch for it (6). 15+18+15+6 = 54.)
- Schema & documentation, GitHub Copilot CLI +11: dsh-superagent (DeepSeek) 61 (Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).); GitHub Copilot CLI 72 (Framework reading. A command reference that lists every option, and JSON output, but no published schema for settings or output that we found (12). docs.github.com/llms.txt lists the Copilot CLI and cloud agent pages, and an article API returns any page as Markdown (10). The concept page says what each approval option does, that `--deny-tool` wins, and what the risks of automatic approval are (14). Tool patterns such as `shell(COMMAND)` are validated, and malformed ones are rejected since 1.0.x (10). Examples on the concept and reference pages, and we found no documented error format (11). A dated changelog per release with breaking changes marked (15).)
- Agent ergonomics, GitHub Copilot CLI +5: dsh-superagent (DeepSeek) 67 (Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's `standard` with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of `blocked` or `failed`, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix `agent/`), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).); GitHub Copilot CLI 72 (Framework reading, adapted to a harness driven by a pipeline. `--available-tools` and `--excluded-tools` shape the tool list and `--deny-tool` removes tools, and MCP tool discovery recovers without a restart (20). `--max-autopilot-continues` caps autopilot, and a turn timeout applies to background work in `-p` (15). JSON output, and a 2026 release replaced a misleading auth error with the real cause (12). `--resume` and `--continue`, and permission prompts survive a resumed session (15). An SDK exists, per the changelog, but we didn't check its languages, and a headless run needs explicit allow flags to do anything (10).)