# dsh-superagent (DeepSeek) vs OpenCode (slim)

> OpenCode scores 68.8 (B) to dsh-superagent's 42.1 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.md (~7,050 tokens) · this version ~3,530 tokens · JSON https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.json · canonical https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-01
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenCode scores 68.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category. Both do agent harnesses.

- dsh-superagent (DeepSeek): E 42.1, rank #1108 of 1251 · https://www.anchorterminal.com/tools/deepseek-superagent.min.md
- OpenCode: B 68.8, rank #231 of 1251 · https://www.anchorterminal.com/tools/opencode.min.md
- dsh-superagent (DeepSeek), good for Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account. Also No incidents deducted, where OpenCode loses 4 points for them.
- OpenCode, good for Agents and pipelines that need a scriptable coding agent with a JSON event stream, an HTTP server and any model, including keyless free ones. Ahead on Reliability, 72 against 15; Schema & documentation, 88 against 61; Agent ergonomics, 79 against 67; Security & auth, 60 against 33; Payments & pricing, 60 against 40; Maintenance & community, 81 against 34; Transparency & trust, 71 against 52. Also No key needed to call it.

| Category | dsh-superagent (DeepSeek) | OpenCode |
| --- | --- | --- |
| Reliability (16%) | 15 | 72 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 61 | 88 |
| Agent ergonomics (13%) | 67 | 79 |
| Security & auth (14%) | 33 | 60 |
| Payments & pricing (10%) | 40 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 34 | 81 |
| Transparency & trust (7%) | 52 | 71 |

| Fact (where they differ) | dsh-superagent (DeepSeek) | OpenCode |
| --- | --- | --- |
| Vendor | DeepSeek | Anomaly |
| Auth | Token | None |
| Pricing | Free | Freemium |
| Last release | 2026-10-31 | 2026-10-16 |
| Terms last updated | no document linked | 2026-08-15 |
| Privacy policy last updated | 2026-09-20 | 2026-03-06 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 211k stars |
| Agent reviews | none | 2/5 (2) |

Why the edge:
- Reliability, OpenCode +57: dsh-superagent (DeepSeek) 15 (Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install && pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).); OpenCode 72 (Read as a local package, graded on the 1.x line that `npm i -g opencode-ai` and the opencode.ai/install script put on a machine. `opencode-ai` 1.19.3 on npm with native binaries for macOS, Linux and Windows on x64 and arm64, plus Homebrew, Scoop, Chocolatey, Nix and the install script (20). A test workflow runs on the repository. The Actions page loaded on 1 October showed only passing runs from an older release (1.3.10), GitHub pages answered 403 on 17 October, and the current state is unconfirmed (18). About 4,700 open issues and 1,600 open pull requests, handled mostly by scripts that close stale issues daily and flag duplicates, per the 1 October check, not re-read on 17 October (8). Releases come almost daily with notes on GitHub and a changelog page. OpenCode 2's breaking changes (a new plugin API, a new server API and clients, and cli.json in place of tui.json) shipped as a new major on 12 October, opt-in through `opencode upgrade --major`, with a migration guide that names them, while npm's latest and the install script stay on 1.x. The 1.x release notes weren't re-read for a breaking-change section (11). 1.19, stable (15).)
- Maintenance & community, OpenCode +47: dsh-superagent (DeepSeek) 34 (Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).); OpenCode 81 (1.19.3 on npm on 2026-10-16, and v2.0.32 tagged the same day (30). 36 releases on the 1.x line (1.18.4 to 1.19.3) in the 90 days to 17 October, plus the 2.0 tags (20). About 4,700 open issues and 1,600 open pull requests, triaged by scripts and an agent workflow, per the 1 October check, not re-read on 17 October, and we couldn't see reply times (10). npm, Homebrew, Scoop, Chocolatey and Nix builds track releases, npm publishes through GitHub OIDC, and the 1.x install script refuses 2.x so older clients can't replace themselves by accident (14). Typecheck and test workflows exist, with the current CI state unconfirmed (7).)
- Schema & documentation, OpenCode +27: dsh-superagent (DeepSeek) 61 (Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).); OpenCode 88 (A JSON Schema for the config file at opencode.ai/config.json, and an OpenAPI 3.1 spec for the 1.x server (162 paths) on the repository's v1 branch, from which the TypeScript SDK is generated. The dev-branch link the listing carried returned 404 on 17 October, as dev now holds OpenCode 2 (25). The docs site serves a Markdown version of each page, per its source, and V1 and V2 docs now sit side by side, with V2 under opencode.ai/v2/docs (10). Tool pages say when to use each one, such as websearch for discovery and webfetch for a known URL (15). Permission rules take typed allow, ask and deny values with glob patterns, and the config schema covers agents, MCP servers and providers (14). Examples throughout and a troubleshooting page, with server errors described in the spec rather than a separate reference (11). A dated changelog at opencode.ai/changelog and GitHub releases (13).)
- Security & auth, OpenCode +27: dsh-superagent (DeepSeek) 33 (Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).); OpenCode 60 (Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry found in the source or docs, and OpenTelemetry export is opt-in through `experimental.openTelemetry`. It fetches the model list from models.dev and downloads updates at startup by default, both with opt-outs, and with no key configured it sends prompts to free OpenCode Zen models, some of which may use the data to improve the model (22). Allow, ask or deny per tool with glob patterns, `.env` reads denied and paths outside the project asked by default, but most permissions default to allow, `--auto` approves everything not denied, and SECURITY.md says the permission system is not a sandbox (9). SECURITY.md sets out a threat model that puts MCP servers outside the trust boundary, with no prompt-injection guidance (5). Sessions are stored locally and export to JSON, with optional OpenTelemetry (11). GitHub private reporting with an email escalation, three advisories published with fixes, and a ban on AI-generated reports. No security.txt (13). CVE-2026-88624 (published 22 September, CVSS 9.1 in the NVD record) reports that worktree removal deletes any directory it is given. In 1.19.3 `Worktree.remove` still deletes an existing path that isn't a registered worktree. The call needs access to the server API, which SECURITY.md puts out of scope once a user turns server mode on and which can already run shell commands through `POST /session/:id/shell`, so no score moves. OpenCode 2, opt-in and not scored here, allows `external_directory` by default, where 1.x asks.)
- Payments & pricing, OpenCode +20: dsh-superagent (DeepSeek) 40 (Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run `auth login` for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.); OpenCode 60 (No payment protocol (0). Scored on OpenCode Zen and Go. Zen publishes per-million-token prices for every model, and Go is $10 or $40 a month (20). The MIT package and the free Zen models need no card (20). With no key configured it loads the free Zen models with a public key, so an agent can install it and run a task with no signup at all (20).)
- Transparency & trust, OpenCode +19: dsh-superagent (DeepSeek) 52 (MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).); OpenCode 71 (MIT (30). A privacy policy (effective 6 March 2026) and terms (15 August 2026) from Anomaly Innovations, Inc., plus a Zen privacy section saying models are hosted in the US, providers keep nothing and don't train except on named free models, and OpenAI and Anthropic keep requests for 30 days, per the 1 October check, not re-read on 17 October. The general retention line is as long as necessary (22). Zen lists each retired model with its date, and the docs mark deprecated config keys. The V2 migration guide lists the three intentional breaking changes and the V1 fields V2 ignores, but sets no end of support for 1.x (15). There's no product telemetry to disclose, but the docs don't say so in one place, and the free-model data use is on the Zen page rather than shown at first run (15).)