{ "data": { "a": { "slug": "deepseek-superagent", "name": "dsh-superagent (DeepSeek)", "vendor": "DeepSeek", "vendorUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype", "kind": "harness", "category": "agent-harnesses", "summary": "dsh-superagent is DeepSeek's MIT-licensed research prototype of a proactive coding agent for one GitHub repository, run as a DeepSeek Harness bundle. A main Session admits requests from allowed people and parallel Executor Sessions work them into pull requests.", "url": "https://www.anchorterminal.com/tools/deepseek-superagent", "markdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json", "dns": "deepseek-superagent.grade.anchorterminal.com", "repo": "https://github.com/deepseek-ai/dsh-superagent-prototype", "license": "MIT", "transports": [], "packages": [], "auth": "pat", "authNotes": "No account with the project. The agent acts through a dedicated GitHub user account signed in to a `gh` wrapper with `auth login`, and optionally a Feishu bot through `lark-cli`. DSH needs a model provider key. The local Management API takes no credential and accepts only loopback requests with `x-orchestrator-request: 1`.", "pricing": "free", "pricingNotes": "Free and MIT, with nothing to buy. The operator pays the model provider DSH is set up with, usually DeepSeek's API, for a main Session and one Session per Ticket.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, SETUP.md or docs/000 to 008 (checked 2026-11-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype/tree/main/docs", "capabilities": [ "agent.harness", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "open-source", "mit", "typescript", "local", "free", "no-card", "pre-1.0", "preview", "telemetry-default-on" ], "lastRelease": "2026-10-31", "graded": true, "anchor": { "graded": true, "score": 42.1, "grade": "E", "agentReady": false, "rank": 1108, "ranked": true, "rankOf": 1251, "categoryRank": 41, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "bestFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "strengths": [ "MIT licence, with nine numbered design and operations documents that state each rule, from admission to restart recovery", "Only listed GitHub logins can start work by default, and messages, comments and prompts cannot change the gate, which code enforces", "Proactive work starts in `observe` mode, which records what the agent would have done and accepts nothing", "The agent never enables auto-merge as its own account, and the default merge rule needs approvals and fewer than 200 changed lines", "Setup and worker shells drop environment variables named KEY, PASSWORD, SECRET or TOKEN, and git uses only the agent account's credentials" ], "weaknesses": [ "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory", "The README calls it a research prototype, not an official DeepSeek product, at version 0.1.0 with no tag, release or changelog found", "Not on npm. Installing means a git clone, `pnpm build`, a pinned DSH release candidate, tmux and a dedicated GitHub user account", "The docs don't mention that DSH's shipped profiles upload the session log to DeepSeek with official API requests by default", "No SECURITY.md, security.txt or CI workflow found, and GitHub's issues and pull requests couldn't be read" ], "agentNotes": [ "Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory", "Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code", "Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right", "Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request", "Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.1 } ], "editorialScores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 51 }, "provenanceScore": 52, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @deepseek-ai/dsh@0.2.1-rc.3 \u0026\u0026 git clone https://github.com/deepseek-ai/dsh-superagent-prototype dsh-superagent \u0026\u0026 cd dsh-superagent \u0026\u0026 pnpm install \u0026\u0026 pnpm build \u0026\u0026 dsh superagent --from-default-profile web --dump-config \u003e /dev/null \u0026\u0026 dsh plugin --profile superagent add \"link:$PWD\"" }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/deepseek-superagent" }, "sameCompany": [ "deepseek-harness" ], "area": "frameworks", "provenance": { "legalEntity": "DeepSeek (the LICENSE names the DeepSeek Harness Team; DeepSeek Harness's terms name Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://www.deepseek.com/en/harness/privacy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The repository has no terms or privacy policy of its own. DeepSeek Harness's terms of use and privacy policy (both last updated 20 September 2026) name Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and cover the harness it runs on. The README says the prototype is not an official DeepSeek product.", "package.json names `DeepSeek Harness Team \u003cteam@dsh.dev\u003e` as author. dsh.dev didn't resolve from our network on 1 November 2026.", "No SECURITY.md in the root or .github, and www.deepseek.com/.well-known/security.txt returned 404 on 1 November 2026.", "No CHANGELOG.md, tags or releases found. GitHub's web pages and API weren't reachable, so files were read on raw.githubusercontent.com and the commit history, stars and issues are unchecked." ], "score": 52 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.json" }, "answer": "Qoder CLI scores 59 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. dsh-superagent (DeepSeek) leads on payments \u0026 pricing.", "b": { "slug": "qoder-cli", "name": "Qoder CLI", "vendor": "Qoder (BRIGHT ZENITH PRIVATE LIMITED)", "vendorUrl": "https://qoder.com/cli", "kind": "harness", "category": "agent-harnesses", "summary": "Qoder's terminal coding agent. It reads and edits files, runs commands and calls MCP servers under permission rules, with a `-p` headless mode, an Agent Client Protocol server and a TypeScript and Python Agent SDK. Needs a Qoder account.", "url": "https://www.anchorterminal.com/tools/qoder-cli", "markdownUrl": "https://www.anchorterminal.com/tools/qoder-cli.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/qoder-cli.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/qoder-cli.json", "dns": "qoder-cli.grade.anchorterminal.com", "license": "Proprietary, under the Qoder Terms of Service (BRIGHT ZENITH PRIVATE LIMITED, last updated 29 April 2026). No source is published, and the Agent SDK's LICENSE file points to the same terms", "transports": [], "packages": [ { "registry": "npm", "name": "@qoder-ai/qodercli" }, { "registry": "npm", "name": "@qoder-ai/qoder-agent-sdk" }, { "registry": "pypi", "name": "qoder-agent-sdk" } ], "auth": "mixed", "authNotes": "`/login` or `qoder login` through a browser on a Qoder account, with background token refresh, or a Personal Access Token in `QODER_PERSONAL_ACCESS_TOKEN` for CI, ACP clients and the SDK. A PAT is created at qoder.com/account/integrations with chosen permissions and an expiry, and can be revoked. Organisations can use service accounts with scoped tokens.", "pricing": "freemium", "pricingNotes": "Free gives basic models for a limited number of messages and a 14-day Pro trial with 300 credits. Pro is $20 a month (2,000 credits), Pro+ $60 (6,000) and Ultra $200 (20,000). Credit Packs cost $20 for 1,500 credits and expire after a month. Teams is $40 a seat a month with 3,000 credits, Enterprise $20 a seat with credits bought separately (checked 2026-10-18).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the CLI or SDK docs, the pricing docs or the CLI release notes (checked 2026-10-18).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 4996, "pypiWeekly": null, "asOf": "2026-10-18" }, "docsUrl": "https://docs.qoder.com/cli/overview", "llmsTxt": "https://docs.qoder.com/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "cli", "closed-source", "mcp", "acp", "llms-txt", "telemetry-default-on", "free-tier" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 59, "grade": "C", "agentReady": false, "rank": 660, "ranked": true, "rankOf": 1251, "categoryRank": 24, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 72, "payments": 35, "reliability": 51, "schema": 81, "security": 55, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-18" }, "negative": -3, "negativeNotes": [ "2026-09-19. CLI 1.1.57 fixed \"a security issue where internal Git calls could execute repository configuration commands\", so opening an untrusted repository could run commands from its Git configuration. Fixed within the month and disclosed only as a release-note line, with no advisory, affected versions or CVE found. Inside six months, -2 (https://docs.qoder.com/release-notes/qoder-cli.md)", "2026-07-16. CLI 1.0.47 fixed the PreToolUse hook not taking effect in headless and SDK modes. The permissions page describes that hook as an interception that holds even in YOLO mode, so headless and SDK runs before the fix skipped organisation hooks. Fixed and noted in the release notes. Judgement call, -1 (https://docs.qoder.com/release-notes/qoder-cli.md)" ], "verdict": "A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy.", "bestFor": "Developers already on Qoder who want the same agent in a terminal, in CI through a PAT, in Zed through ACP, or embedded through the Agent SDK.", "strengths": [ "Headless `-p` with text, json and stream-json output, `--max-turns`, and ask turned into deny", "Agent SDK for TypeScript and Python that drives the CLI with approval callbacks, hooks and session control", "Documented exit codes and Result error subtypes for scripts and SDK hosts", "Personal Access Tokens with chosen permissions and expiry, and scoped service accounts for organisations", "74 dated releases in the 90 days to 16 October 2026" ], "weaknesses": [ "No local sandbox is documented, and `auto` mode approves read-only tools on any path", "Usage and AI code statistics are on by default, and content use for improvement depends on the plan", "Closed source with no public CI, issue tracker or security advisories, and the audit log leaves out CLI execution", "No security.txt, disclosure policy or status page found", "Agent SDK release notes stop at 1.0.41 on 15 September while npm has 1.0.53" ], "agentNotes": [ "Set `QODER_PERSONAL_ACCESS_TOKEN` in CI. The browser sign-in can't complete in a headless run", "Pass `--permission-mode` with `--allowed-tools` in headless runs. Every ask is denied, and `--yolo` removes all checks", "Set `--max-turns` on unattended runs, and branch on exit codes 41 (authentication) and 53 (turn limit)", "Set `privacy.usageStatisticsEnabled` and `aiCodeStatistics.enabled` to false in ~/.qoder/settings.json if usage data must stay local", "Don't pass `--model lite`. The Lite tier was removed on 18 September 2026 and headless requests naming it fail" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59 } ], "editorialScores": { "ergonomics": 80, "maintenance": 72, "payments": 35, "reliability": 51, "schema": 81, "security": 55, "transparency": 51 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-10-18", "maintenance": "2026-10-18", "payments": "2026-10-18", "reliability": "2026-10-18", "schema": "2026-10-18", "security": "2026-10-18", "transparency": "2026-10-18" }, "last": "2026-10-18", "lastMoved": "2026-10-30", "oldest": "2026-10-18", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "curl -fsSL https://qoder.com/install | bash", "headless": { "env": { "QODER_PERSONAL_ACCESS_TOKEN": "\u003ctoken\u003e" }, "run": "qoder -p \"Review these changes and list potential issues\" --output-format json --permission-mode accept_edits --max-turns 20" } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/qoder-cli" }, "area": "frameworks", "unitPrices": [ { "item": "Pro plan", "unit": "month", "usd": 20, "note": "2,000 credits a month" }, { "item": "Credit Pack", "unit": "tx", "usd": 20, "note": "1,500 credits, expires after one month, not refundable" }, { "item": "Teams", "unit": "seat-month", "usd": 40, "note": "3,000 credits a seat a month" } ], "provenance": { "legalEntity": "BRIGHT ZENITH PRIVATE LIMITED", "domain": "qoder.com", "domainRegistered": "2009-08-21", "endpointOnVendorDomain": null, "terms": "https://qoder.com/product-service", "privacy": "https://qoder.com/privacy-policy", "statusPage": "", "changelog": "https://docs.qoder.com/release-notes/qoder-cli.md", "securityTxt": "none", "checked": "2026-10-18", "notes": [ "The terms of service (last updated 29 April 2026) name BRIGHT ZENITH PRIVATE LIMITED as the provider of the Services. The privacy policy (last updated 12 May 2026) describes it as a Singapore registered entity, with a DPO at intldpo@qoder.com.", "We didn't name a parent company, because neither the terms nor the privacy policy names one.", "qoder.com/.well-known/security.txt and docs.qoder.com/.well-known/security.txt answered 404 on 18 October 2026.", "No status page was found, and status.qoder.com didn't resolve.", "RDAP (Verisign) gives qoder.com a registration date of 21 August 2009, long before the product.", "qoder.com's robots.txt disallows /pricing, so prices come from docs.qoder.com/account/pricing.md." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/qoder-cli.json", "live": { "slug": "qoder-cli", "versions": [ { "registry": "npm", "name": "@qoder-ai/qoder-agent-sdk", "version": "1.0.58", "seenAt": "2026-10-31T16:20:43.118749792Z" }, { "registry": "npm", "name": "@qoder-ai/qodercli", "version": "1.1.81", "seenAt": "2026-10-31T16:20:42.690765687Z" }, { "registry": "pypi", "name": "qoder-agent-sdk", "version": "1.0.17", "released": "2026-10-27", "seenAt": "2026-10-31T16:20:44.878992296Z" } ], "npmWeekly": 12632, "pypiWeekly": 3047, "securityTxt": { "url": "https://qoder.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-31T15:41:37.4431931Z" }, "llmsTxt": { "url": "https://docs.qoder.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-31T15:11:46.65854928Z" }, "domain": { "domain": "qoder.com", "registered": "2009-08-21", "source": "https://rdap.verisign.com/com/v1/domain/qoder.com", "checkedAt": "2026-10-25T14:02:25.027080624Z" }, "pages": [ { "url": "https://docs.qoder.com/release-notes/qoder-cli.md", "kind": "changelog", "status": 200, "checkedAt": "2026-10-31T06:10:55.380368489Z", "changedAt": "2026-10-30T05:38:24.818997399Z", "fingerprint": "36a5034afb44" }, { "url": "https://docs.qoder.com/release-notes/lite-model-tier-retirement-notice.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-31T06:10:50.729115962Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6c149bbabe94" }, { "url": "https://docs.qoder.com/release-notes/model-consumption-reference-update.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-31T06:10:52.832295848Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "bc85b1b0ed5c" }, { "url": "https://qoder.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-31T06:19:03.056328247Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2117f74023c8" }, { "url": "https://qoder.com/product-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-31T06:19:05.28083433Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b0a4a5ea5693" } ], "updatedAt": "2026-10-31T16:20:44.878992296Z" } }, "edges": [ { "by": 38, "category": "maintenance", "leads": "qoder-cli", "name": "Maintenance \u0026 community", "reasons": { "a": "Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).", "b": "1.1.73 on 16 October 2026 (30). 74 dated CLI versions between 20 July and 16 October 2026 (20). No public issue tracker. A Discourse forum with bug-report and feature-request categories, where 15 of the 29 bug reports on the first page had no reply when read on 18 October (7). Current official SDKs, `@qoder-ai/qoder-agent-sdk` 1.0.53 on 15 October and `qoder-agent-sdk` 1.0.15 on PyPI on 23 September 2026 (12). No public CI. npm versions carry registry signatures and the install script checks a SHA-256 (3). 30+20+7+12+3 = 72." }, "scores": { "a": 34, "b": 72 } }, { "by": 36, "category": "reliability", "leads": "qoder-cli", "name": "Reliability", "reasons": { "a": "Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).", "b": "Local-package reading, the same as the other closed-source harnesses. An install script for macOS, Linux and Windows on arm64 and amd64 that checks a SHA-256 from a manifest on the same download host, and an npm package with Node.js 20 or later stated (20). No public CI or test suite, since no source is published (0). We found no public issue tracker for the CLI. The forum's bug-reports category, shared by every Qoder product, had 116 new topics in the month to 18 October, and 15 of the 29 topics on its first page had no reply. A few named the CLI (8). Versions are semver-shaped and every release is dated in the release notes, but removals such as `/goal take` in 1.1.11 shipped in patch versions without a breaking-change label (8). 1.0.0 on 20 May 2026, now 1.1.73 (15). 20+0+8+8+15 = 51." }, "scores": { "a": 15, "b": 51 } }, { "by": 22, "category": "security", "leads": "qoder-cli", "name": "Security \u0026 auth", "reasons": { "a": "Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).", "b": "Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Browser sign-in with background refresh, or a PAT created with chosen permissions and an expiry and revocable, plus scoped service accounts for organisations. Usage statistics and AI code statistics are on by default with documented opt-outs, and the privacy policy lets users turn off Share \u0026 Improve depending on the plan, without saying which plans or the default (18). Five permission modes, deny over ask over allow across seven rule layers, ask turned into deny in headless runs, a `dont_ask` mode, trusted directories, protected paths and an administrator switch that disables YOLO. No local sandbox is documented, and `auto` mode lets an AI classifier decide and approves read-only tools on any path (14). Workspace files can't add auto-mode rules, protected paths stop the agent changing shell startup files or .mcp.json without approval, and network paths always ask on Windows. A project's .qoder/settings.json is still one of the rule layers, and nothing contains a command once approved (9). The enterprise audit log records administrative and configuration events for administrators and says it leaves out prompts, terminal commands, MCP call parameters and CLI execution, and individuals have local session history only (5). qoder.com/enterprise says Qoder is certified to ISO/IEC 27001 and has completed a SOC 2 Type II audit. No security.txt, disclosure policy or bug bounty was found, and fixes appear as one-line release notes without advisories (9). 18+14+9+5+9 = 55." }, "scores": { "a": 33, "b": 55 } }, { "by": 20, "category": "schema", "leads": "qoder-cli", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).", "b": "Framework reading. A CLI reference with types and defaults for every flag, a settings reference with types and defaults, TypeScript declaration files and a Python reference for the SDK, and Result and error-code tables. No schema for the stream-json events was found (16). docs.qoder.com/llms.txt indexes every page with a Markdown twin, and robots.txt allows both (10). The permissions page states what each mode does and is best for, what headless runs do with ask, and which actions skip the auto classifier (17). Permission modes and output formats are enums and rules have a fixed syntax (12). CI examples, an SDK error page with exit codes 0, 1, 41, 42, 44, 52, 53, 54 and 130, Result subtypes and a troubleshooting index. Code 44 names a sandbox the docs don't describe (14). Dated release notes for the CLI and the SDK, though the SDK notes stop at 1.0.41 on 15 September while npm has 1.0.53, and the CLI reference still names the removed `lite` model (12). 16+10+17+12+14+12 = 81." }, "scores": { "a": 61, "b": 81 } }, { "by": 13, "category": "ergonomics", "leads": "qoder-cli", "name": "Agent ergonomics", "reasons": { "a": "Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's `standard` with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of `blocked` or `failed`, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix `agent/`), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).", "b": "Framework reading, adapted to a harness driven by a pipeline. `--tools`, `--allowed-tools` and `--disallowed-tools` restrict built-in tools, and `--strict-mcp-config` with `--allowed-mcp-server-names` limits MCP servers. Nothing on deferred MCP tool loading was found (18). text, json and stream-json output, `--max-turns`, `--max-output-tokens` and `--no-session-persistence` (16). Distinct exit codes for authentication, input, configuration, turn-limit and tool failures, and SDK Result subtypes with error codes (16). `--continue`, `--resume`, `--session-id`, `--fork-session`, SDK checkpoints with rewind, and `--max-model-request-retries` (15). Official SDKs in TypeScript and Python, an ACP server, and headless runs that need only a PAT and a permission flag (15). 18+16+16+15+15 = 80." }, "scores": { "a": 67, "b": 80 } }, { "by": 9, "category": "transparency", "leads": "qoder-cli", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).", "b": "Proprietary, with clear terms from BRIGHT ZENITH PRIVATE LIMITED under Singapore law, and the SDK's LICENSE points to the same terms (15). The privacy policy lists purposes with retention for each (mostly for as long as the account exists), names storage in the United States, Singapore and Japan and names model providers. The terms let the operator use User Content to improve the Services unless Share \u0026 Improve is turned off, and the policy says the opt-out depends on the plan. No subprocessor list or DPA was found (14). Dated notices with two weeks' warning for the Lite tier removal (4 to 18 September 2026) and for the credit factor change on 21 September, but no stated deprecation policy (8). Usage statistics and AI code statistics are disclosed as settings with an opt-out, both on by default, and the installer's telemetry isn't described (14). 15+14+8+14 = 51." }, "scores": { "a": 52, "b": 61 } } ], "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "DeepSeek", "b": "Qoder (BRIGHT ZENITH PRIVATE LIMITED)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "Token", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Proprietary, under the Qoder Terms of Service (BRIGHT ZENITH PRIVATE LIMITED, last updated 29 April 2026). No source is published, and the Agent SDK's LICENSE file points to the same terms", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-31", "b": "2026-10-16", "name": "Last release" }, { "a": "no document linked", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2026-09-20", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "5k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Qoder CLI scores 59 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. dsh-superagent (DeepSeek) leads on payments \u0026 pricing.", "question": "Which is better for AI agents, dsh-superagent (DeepSeek) or Qoder CLI?" }, { "answer": "dsh-superagent (DeepSeek) is open source (MIT). No open-source release is listed for Qoder CLI.", "question": "Are dsh-superagent (DeepSeek) and Qoder CLI open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 40 against 35" ], "also": [ "Free to start without a card", "Open source", "No incidents deducted, where Qoder CLI loses 3 points for them" ], "goodFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "slug": "deepseek-superagent", "watchFor": "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory" }, { "aheadOn": [ "Reliability, 51 against 15", "Schema \u0026 documentation, 81 against 61", "Agent ergonomics, 80 against 67", "Security \u0026 auth, 55 against 33", "Maintenance \u0026 community, 72 against 34", "Transparency \u0026 trust, 61 against 52" ], "also": null, "goodFor": "Developers already on Qoder who want the same agent in a terminal, in CI through a PAT, in Zed through ACP, or embedded through the Agent SDK.", "slug": "qoder-cli", "watchFor": "No local sandbox is documented, and `auto` mode approves read-only tools on any path" } ], "history": { "deepseek-superagent": null, "qoder-cli": [ { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.4, "from": 59.4, "fromGrade": "C", "to": 59, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.1, "from": 59.3, "fromGrade": "C", "to": 59.4, "toGrade": "C" } ] }, "job": { "capability": "agent.harness", "name": "Agent harnesses" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.json", "title": "Agent Zero vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-qoder-cli.json", "title": "Agent Zero vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.json", "title": "Aider vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-qoder-cli.json", "title": "Aider vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/aider-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.json", "title": "Amp vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-qoder-cli.json", "title": "Amp vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/amp-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.json", "title": "Antigravity CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-qoder-cli.json", "title": "Antigravity CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.json", "title": "Auggie CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-qoder-cli.json", "title": "Auggie CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/auggie-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.json", "title": "Claude Code vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-qoder-cli.json", "title": "Claude Code vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/claude-code-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.json", "title": "Cline vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-qoder-cli.json", "title": "Cline vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/cline-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.json", "title": "Crush vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-qoder-cli.json", "title": "Crush vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/crush-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.json", "title": "Cursor CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-qoder-cli.json", "title": "Cursor CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.json", "title": "DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-qoder-cli.json", "title": "DeepSeek Harness (dsh) vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.json", "title": "dsh-superagent (DeepSeek) vs Devin", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.json", "title": "dsh-superagent (DeepSeek) vs Droid CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.json", "title": "dsh-superagent (DeepSeek) vs Pi", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.json", "title": "dsh-superagent (DeepSeek) vs Gemini CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.json", "title": "dsh-superagent (DeepSeek) vs GitHub Copilot CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.json", "title": "dsh-superagent (DeepSeek) vs goose", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.json", "title": "dsh-superagent (DeepSeek) vs Harness²", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.json", "title": "dsh-superagent (DeepSeek) vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.json", "title": "dsh-superagent (DeepSeek) vs Jules", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.json", "title": "dsh-superagent (DeepSeek) vs Junie CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.json", "title": "dsh-superagent (DeepSeek) vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.json", "title": "dsh-superagent (DeepSeek) vs mini-swe-agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.json", "title": "dsh-superagent (DeepSeek) vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.json", "title": "dsh-superagent (DeepSeek) vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.json", "title": "dsh-superagent (DeepSeek) vs Muse Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.json", "title": "dsh-superagent (DeepSeek) vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.json", "title": "dsh-superagent (DeepSeek) vs OpenCode", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.json", "title": "dsh-superagent (DeepSeek) vs OpenHands", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.json", "title": "dsh-superagent (DeepSeek) vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.json", "title": "dsh-superagent (DeepSeek) vs Prime Agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.json", "title": "dsh-superagent (DeepSeek) vs Qwen Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.json", "title": "dsh-superagent (DeepSeek) vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.json", "title": "dsh-superagent (DeepSeek) vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.json", "title": "dsh-superagent (DeepSeek) vs Unstoppable", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.json", "title": "dsh-superagent (DeepSeek) vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.json", "title": "dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/devin-vs-qoder-cli.json", "title": "Devin vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/devin-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/droid-cli-vs-qoder-cli.json", "title": "Droid CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/droid-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/earendil-pi-vs-qoder-cli.json", "title": "Pi vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/earendil-pi-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-qoder-cli.json", "title": "Gemini CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-qoder-cli.json", "title": "GitHub Copilot CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-qoder-cli.json", "title": "goose vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/harness2-vs-qoder-cli.json", "title": "Harness² vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/harness2-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/harnessrouter-vs-qoder-cli.json", "title": "HarnessRouter vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/harnessrouter-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/jules-vs-qoder-cli.json", "title": "Jules vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/jules-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/junie-vs-qoder-cli.json", "title": "Junie CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/junie-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-qoder-cli.json", "title": "Kilo Code CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-qoder-cli.json", "title": "Kimi Code CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/kiro-cli-vs-qoder-cli.json", "title": "Kiro CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/kiro-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-qoder-cli.json", "title": "mini-swe-agent vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/minimax-code-vs-qoder-cli.json", "title": "MiniMax Code vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/minimax-code-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.json", "title": "Mistral Vibe CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/muse-code-vs-qoder-cli.json", "title": "Muse Code vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/muse-code-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/openai-codex-vs-qoder-cli.json", "title": "OpenAI Codex vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/openai-codex-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/opencode-vs-qoder-cli.json", "title": "OpenCode vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/opencode-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/openhands-vs-qoder-cli.json", "title": "OpenHands vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/openhands-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/prime-agent-vs-qoder-cli.json", "title": "Prime Agent vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/prime-agent-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-qwen-code.json", "title": "Qoder CLI vs Qwen Code", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-reflection-mirror.json", "title": "Qoder CLI vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-rovo-dev-cli.json", "title": "Qoder CLI vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-unstoppable.json", "title": "Qoder CLI vs Unstoppable", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading.json", "title": "Qoder CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-warp.json", "title": "Qoder CLI vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.json", "title": "Clawboo vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.json", "title": "Clawboo vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.json", "title": "CLI Manager vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-qoder-cli.json", "title": "CLI Manager vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.json", "title": "dsh-superagent (DeepSeek) vs Harness", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.json", "title": "dsh-superagent (DeepSeek) vs Paperclip", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.json", "title": "dsh-superagent (DeepSeek) vs Parallax", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents" }, { "json": "https://www.anchorterminal.com/compare/harness-autonomous-vs-qoder-cli.json", "title": "Harness vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/harness-autonomous-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/openmausbot-vs-qoder-cli.json", "title": "OpenMausBot vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/openmausbot-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/paperclip-vs-qoder-cli.json", "title": "Paperclip vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/paperclip-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/parallax-agents-vs-qoder-cli.json", "title": "Parallax vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/parallax-agents-vs-qoder-cli" } ], "panel": null, "scores": [ { "by": 36, "deepseek-superagent": 15, "edge": "qoder-cli", "key": "reliability", "name": "Reliability", "qoder-cli": 51, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 20, "deepseek-superagent": 61, "edge": "qoder-cli", "key": "schema", "name": "Schema \u0026 documentation", "qoder-cli": 81, "weight": 13 }, { "by": 13, "deepseek-superagent": 67, "edge": "qoder-cli", "key": "ergonomics", "name": "Agent ergonomics", "qoder-cli": 80, "weight": 13 }, { "by": 22, "deepseek-superagent": 33, "edge": "qoder-cli", "key": "security", "name": "Security \u0026 auth", "qoder-cli": 55, "weight": 14 }, { "by": 5, "deepseek-superagent": 40, "edge": "deepseek-superagent", "key": "payments", "name": "Payments \u0026 pricing", "qoder-cli": 35, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 38, "deepseek-superagent": 34, "edge": "qoder-cli", "key": "maintenance", "name": "Maintenance \u0026 community", "qoder-cli": 72, "weight": 7 }, { "by": 9, "deepseek-superagent": 52, "edge": "qoder-cli", "key": "transparency", "name": "Transparency \u0026 trust", "qoder-cli": 61, "weight": 7 } ], "summary": "Qoder CLI scores 59 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. dsh-superagent (DeepSeek) leads on payments \u0026 pricing. Both do agent harnesses.", "tasks": null, "tutorials": [], "verdicts": { "deepseek-superagent": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "qoder-cli": "A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli", "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.min.md" }, "markdown": "Qoder CLI scores 59 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. dsh-superagent (DeepSeek) leads on payments \u0026 pricing. Both do agent harnesses.\n\n- dsh-superagent (DeepSeek): grade E, 42.1/100, rank #1108 of 1251. Markdown https://www.anchorterminal.com/tools/deepseek-superagent.md · JSON https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json\n- Qoder CLI: grade C, 59/100, rank #660 of 1251. Markdown https://www.anchorterminal.com/tools/qoder-cli.md · JSON https://www.anchorterminal.com/api/v1/tools/qoder-cli.json\n- Best agent harnesses and coding agents: https://www.anchorterminal.com/best/agent-harnesses/index.md\n- All 955 harnesses comparisons: https://www.anchorterminal.com/compare/agent-harnesses/index.md\n\n## Which one, for what\n\n### dsh-superagent (DeepSeek) (E)\n\nGood for: Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.\n\nAhead on:\n- Payments \u0026 pricing, 40 against 35\n\nAlso in its favour:\n- Free to start without a card\n- Open source\n- No incidents deducted, where Qoder CLI loses 3 points for them\n\nWatch for: Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory\n\n### Qoder CLI (C)\n\nGood for: Developers already on Qoder who want the same agent in a terminal, in CI through a PAT, in Zed through ACP, or embedded through the Agent SDK.\n\nAhead on:\n- Reliability, 51 against 15\n- Schema \u0026 documentation, 81 against 61\n- Agent ergonomics, 80 against 67\n- Security \u0026 auth, 55 against 33\n- Maintenance \u0026 community, 72 against 34\n- Transparency \u0026 trust, 61 against 52\n\nWatch for: No local sandbox is documented, and `auto` mode approves read-only tools on any path\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Qoder CLI +38\n\n- dsh-superagent (DeepSeek) (34): Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).\n- Qoder CLI (72): 1.1.73 on 16 October 2026 (30). 74 dated CLI versions between 20 July and 16 October 2026 (20). No public issue tracker. A Discourse forum with bug-report and feature-request categories, where 15 of the 29 bug reports on the first page had no reply when read on 18 October (7). Current official SDKs, `@qoder-ai/qoder-agent-sdk` 1.0.53 on 15 October and `qoder-agent-sdk` 1.0.15 on PyPI on 23 September 2026 (12). No public CI. npm versions carry registry signatures and the install script checks a SHA-256 (3). 30+20+7+12+3 = 72.\n\n### Reliability: Qoder CLI +36\n\n- dsh-superagent (DeepSeek) (15): Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).\n- Qoder CLI (51): Local-package reading, the same as the other closed-source harnesses. An install script for macOS, Linux and Windows on arm64 and amd64 that checks a SHA-256 from a manifest on the same download host, and an npm package with Node.js 20 or later stated (20). No public CI or test suite, since no source is published (0). We found no public issue tracker for the CLI. The forum's bug-reports category, shared by every Qoder product, had 116 new topics in the month to 18 October, and 15 of the 29 topics on its first page had no reply. A few named the CLI (8). Versions are semver-shaped and every release is dated in the release notes, but removals such as `/goal take` in 1.1.11 shipped in patch versions without a breaking-change label (8). 1.0.0 on 20 May 2026, now 1.1.73 (15). 20+0+8+8+15 = 51.\n\n### Security \u0026 auth: Qoder CLI +22\n\n- dsh-superagent (DeepSeek) (33): Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).\n- Qoder CLI (55): Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Browser sign-in with background refresh, or a PAT created with chosen permissions and an expiry and revocable, plus scoped service accounts for organisations. Usage statistics and AI code statistics are on by default with documented opt-outs, and the privacy policy lets users turn off Share \u0026 Improve depending on the plan, without saying which plans or the default (18). Five permission modes, deny over ask over allow across seven rule layers, ask turned into deny in headless runs, a `dont_ask` mode, trusted directories, protected paths and an administrator switch that disables YOLO. No local sandbox is documented, and `auto` mode lets an AI classifier decide and approves read-only tools on any path (14). Workspace files can't add auto-mode rules, protected paths stop the agent changing shell startup files or .mcp.json without approval, and network paths always ask on Windows. A project's .qoder/settings.json is still one of the rule layers, and nothing contains a command once approved (9). The enterprise audit log records administrative and configuration events for administrators and says it leaves out prompts, terminal commands, MCP call parameters and CLI execution, and individuals have local session history only (5). qoder.com/enterprise says Qoder is certified to ISO/IEC 27001 and has completed a SOC 2 Type II audit. No security.txt, disclosure policy or bug bounty was found, and fixes appear as one-line release notes without advisories (9). 18+14+9+5+9 = 55.\n\n### Schema \u0026 documentation: Qoder CLI +20\n\n- dsh-superagent (DeepSeek) (61): Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).\n- Qoder CLI (81): Framework reading. A CLI reference with types and defaults for every flag, a settings reference with types and defaults, TypeScript declaration files and a Python reference for the SDK, and Result and error-code tables. No schema for the stream-json events was found (16). docs.qoder.com/llms.txt indexes every page with a Markdown twin, and robots.txt allows both (10). The permissions page states what each mode does and is best for, what headless runs do with ask, and which actions skip the auto classifier (17). Permission modes and output formats are enums and rules have a fixed syntax (12). CI examples, an SDK error page with exit codes 0, 1, 41, 42, 44, 52, 53, 54 and 130, Result subtypes and a troubleshooting index. Code 44 names a sandbox the docs don't describe (14). Dated release notes for the CLI and the SDK, though the SDK notes stop at 1.0.41 on 15 September while npm has 1.0.53, and the CLI reference still names the removed `lite` model (12). 16+10+17+12+14+12 = 81.\n\n### Agent ergonomics: Qoder CLI +13\n\n- dsh-superagent (DeepSeek) (67): Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's `standard` with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of `blocked` or `failed`, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix `agent/`), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).\n- Qoder CLI (80): Framework reading, adapted to a harness driven by a pipeline. `--tools`, `--allowed-tools` and `--disallowed-tools` restrict built-in tools, and `--strict-mcp-config` with `--allowed-mcp-server-names` limits MCP servers. Nothing on deferred MCP tool loading was found (18). text, json and stream-json output, `--max-turns`, `--max-output-tokens` and `--no-session-persistence` (16). Distinct exit codes for authentication, input, configuration, turn-limit and tool failures, and SDK Result subtypes with error codes (16). `--continue`, `--resume`, `--session-id`, `--fork-session`, SDK checkpoints with rewind, and `--max-model-request-retries` (15). Official SDKs in TypeScript and Python, an ACP server, and headless runs that need only a PAT and a permission flag (15). 18+16+16+15+15 = 80.\n\n### Transparency \u0026 trust: Qoder CLI +9\n\n- dsh-superagent (DeepSeek) (52): MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).\n- Qoder CLI (61): Proprietary, with clear terms from BRIGHT ZENITH PRIVATE LIMITED under Singapore law, and the SDK's LICENSE points to the same terms (15). The privacy policy lists purposes with retention for each (mostly for as long as the account exists), names storage in the United States, Singapore and Japan and names model providers. The terms let the operator use User Content to improve the Services unless Share \u0026 Improve is turned off, and the policy says the opt-out depends on the plan. No subprocessor list or DPA was found (14). Dated notices with two weeks' warning for the Lite tier removal (4 to 18 September 2026) and for the credit factor change on 21 September, but no stated deprecation policy (8). Usage statistics and AI code statistics are disclosed as settings with an opt-out, both on by default, and the installer's telemetry isn't described (14). 15+14+8+14 = 51.\n\n## Score by category\n\n| Category | Weight | dsh-superagent (DeepSeek) | Qoder CLI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 51 | Qoder CLI +36 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 81 | Qoder CLI +20 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 80 | Qoder CLI +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 33 | 55 | Qoder CLI +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 35 | dsh-superagent (DeepSeek) +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 34 | 72 | Qoder CLI +38 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 61 | Qoder CLI +9 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **42.1 · E** | **59 · C** | |\n\n## Facts side by side\n\n| Fact | dsh-superagent (DeepSeek) | Qoder CLI |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | DeepSeek | Qoder (BRIGHT ZENITH PRIVATE LIMITED) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | Token | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Proprietary, under the Qoder Terms of Service (BRIGHT ZENITH PRIVATE LIMITED, last updated 29 April 2026). No source is published, and the Agent SDK's LICENSE file points to the same terms |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-31 | 2026-10-16 |\n| Terms last updated | no document linked | couldn't be read |\n| Privacy policy last updated | 2026-09-20 | couldn't be read |\n| Customer content may train models | not read yet | couldn't be read |\n| Terms restrict automated access | not read yet | couldn't be read |\n| Terms restrict benchmarking | not read yet | couldn't be read |\n| Terms or service can change without notice | not read yet | couldn't be read |\n| Arbitration or class-action waiver | not read yet | couldn't be read |\n| Popularity | none | 5k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### dsh-superagent (DeepSeek)\n\nNo score change since it was listed.\n\n### Qoder CLI\n\n- -0.4 on 30 October 2026: checklist\n- +0.1 on 27 October 2026: new evidence\n\n## Verdicts\n\n**dsh-superagent (DeepSeek).** The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.\n\n**Qoder CLI.** A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy.\n\n## Before you call either\n\n### dsh-superagent (DeepSeek)\n\n1. Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory\n2. Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code\n3. Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right\n4. Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request\n5. Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409\n\n### Qoder CLI\n\n1. Set `QODER_PERSONAL_ACCESS_TOKEN` in CI. The browser sign-in can't complete in a headless run\n2. Pass `--permission-mode` with `--allowed-tools` in headless runs. Every ask is denied, and `--yolo` removes all checks\n3. Set `--max-turns` on unattended runs, and branch on exit codes 41 (authentication) and 53 (turn limit)\n4. Set `privacy.usageStatisticsEnabled` and `aiCodeStatistics.enabled` to false in ~/.qoder/settings.json if usage data must stay local\n5. Don't pass `--model lite`. The Lite tier was removed on 18 September 2026 and headless requests naming it fail\n\n## Questions\n\n### Which is better for AI agents, dsh-superagent (DeepSeek) or Qoder CLI?\n\nQoder CLI scores 59 (C) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. dsh-superagent (DeepSeek) leads on payments \u0026 pricing.\n\n### Are dsh-superagent (DeepSeek) and Qoder CLI open source?\n\ndsh-superagent (DeepSeek) is open source (MIT). No open-source release is listed for Qoder CLI.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.json, and with the fewest tokens: https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"deepseek-superagent\", \"b\": \"qoder-cli\"}`. From a terminal: `anchor compare deepseek-superagent qoder-cli`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json and https://www.anchorterminal.com/api/v1/tools/qoder-cli.json\n\n## Other comparisons with dsh-superagent (DeepSeek) or Qoder CLI\n\n- [Agent Zero vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.md)\n- [Agent Zero vs Qoder CLI](https://www.anchorterminal.com/compare/agent-zero-vs-qoder-cli.md)\n- [Aider vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.md)\n- [Aider vs Qoder CLI](https://www.anchorterminal.com/compare/aider-vs-qoder-cli.md)\n- [Amp vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.md)\n- [Amp vs Qoder CLI](https://www.anchorterminal.com/compare/amp-vs-qoder-cli.md)\n- [Antigravity CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.md)\n- [Antigravity CLI vs Qoder CLI](https://www.anchorterminal.com/compare/antigravity-cli-vs-qoder-cli.md)\n- [Auggie CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.md)\n- [Auggie CLI vs Qoder CLI](https://www.anchorterminal.com/compare/auggie-vs-qoder-cli.md)\n- [Claude Code vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.md)\n- [Claude Code vs Qoder CLI](https://www.anchorterminal.com/compare/claude-code-vs-qoder-cli.md)\n- [Cline vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.md)\n- [Cline vs Qoder CLI](https://www.anchorterminal.com/compare/cline-vs-qoder-cli.md)\n- [Crush vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.md)\n- [Crush vs Qoder CLI](https://www.anchorterminal.com/compare/crush-vs-qoder-cli.md)\n- [Cursor CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.md)\n- [Cursor CLI vs Qoder CLI](https://www.anchorterminal.com/compare/cursor-cli-vs-qoder-cli.md)\n- [DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.md)\n- [DeepSeek Harness (dsh) vs Qoder CLI](https://www.anchorterminal.com/compare/deepseek-harness-vs-qoder-cli.md)\n- [dsh-superagent (DeepSeek) vs Devin](https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.md)\n- [dsh-superagent (DeepSeek) vs Droid CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.md)\n- [dsh-superagent (DeepSeek) vs Pi](https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.md)\n- [dsh-superagent (DeepSeek) vs Gemini CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.md)\n- [dsh-superagent (DeepSeek) vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.md)\n- [dsh-superagent (DeepSeek) vs goose](https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.md)\n- [dsh-superagent (DeepSeek) vs Harness²](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.md)\n- [dsh-superagent (DeepSeek) vs HarnessRouter](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.md)\n- [dsh-superagent (DeepSeek) vs Jules](https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.md)\n- [dsh-superagent (DeepSeek) vs Junie CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.md)\n- [dsh-superagent (DeepSeek) vs Kilo Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kimi Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kiro CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.md)\n- [dsh-superagent (DeepSeek) vs mini-swe-agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.md)\n- [dsh-superagent (DeepSeek) vs MiniMax Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.md)\n- [dsh-superagent (DeepSeek) vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.md)\n- [dsh-superagent (DeepSeek) vs Muse Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.md)\n- [dsh-superagent (DeepSeek) vs OpenAI Codex](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.md)\n- [dsh-superagent (DeepSeek) vs OpenCode](https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.md)\n- [dsh-superagent (DeepSeek) vs OpenHands](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.md)\n- [dsh-superagent (DeepSeek) vs OpenMausBot](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.md)\n- [dsh-superagent (DeepSeek) vs Prime Agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.md)\n- [dsh-superagent (DeepSeek) vs Qwen Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.md)\n- [dsh-superagent (DeepSeek) vs Mirror CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.md)\n- [dsh-superagent (DeepSeek) vs Rovo Dev CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.md)\n- [dsh-superagent (DeepSeek) vs Unstoppable](https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.md)\n- [dsh-superagent (DeepSeek) vs Vibe-Trading](https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.md)\n- [dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.md)\n- [Devin vs Qoder CLI](https://www.anchorterminal.com/compare/devin-vs-qoder-cli.md)\n- [Droid CLI vs Qoder CLI](https://www.anchorterminal.com/compare/droid-cli-vs-qoder-cli.md)\n- [Pi vs Qoder CLI](https://www.anchorterminal.com/compare/earendil-pi-vs-qoder-cli.md)\n- [Gemini CLI vs Qoder CLI](https://www.anchorterminal.com/compare/gemini-cli-vs-qoder-cli.md)\n- [GitHub Copilot CLI vs Qoder CLI](https://www.anchorterminal.com/compare/github-copilot-cli-vs-qoder-cli.md)\n- [goose vs Qoder CLI](https://www.anchorterminal.com/compare/goose-vs-qoder-cli.md)\n- [Harness² vs Qoder CLI](https://www.anchorterminal.com/compare/harness2-vs-qoder-cli.md)\n- [HarnessRouter vs Qoder CLI](https://www.anchorterminal.com/compare/harnessrouter-vs-qoder-cli.md)\n- [Jules vs Qoder CLI](https://www.anchorterminal.com/compare/jules-vs-qoder-cli.md)\n- [Junie CLI vs Qoder CLI](https://www.anchorterminal.com/compare/junie-vs-qoder-cli.md)\n- [Kilo Code CLI vs Qoder CLI](https://www.anchorterminal.com/compare/kilo-code-cli-vs-qoder-cli.md)\n- [Kimi Code CLI vs Qoder CLI](https://www.anchorterminal.com/compare/kimi-code-cli-vs-qoder-cli.md)\n- [Kiro CLI vs Qoder CLI](https://www.anchorterminal.com/compare/kiro-cli-vs-qoder-cli.md)\n- [mini-swe-agent vs Qoder CLI](https://www.anchorterminal.com/compare/mini-swe-agent-vs-qoder-cli.md)\n- [MiniMax Code vs Qoder CLI](https://www.anchorterminal.com/compare/minimax-code-vs-qoder-cli.md)\n- [Mistral Vibe CLI vs Qoder CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.md)\n- [Muse Code vs Qoder CLI](https://www.anchorterminal.com/compare/muse-code-vs-qoder-cli.md)\n- [OpenAI Codex vs Qoder CLI](https://www.anchorterminal.com/compare/openai-codex-vs-qoder-cli.md)\n- [OpenCode vs Qoder CLI](https://www.anchorterminal.com/compare/opencode-vs-qoder-cli.md)\n- [OpenHands vs Qoder CLI](https://www.anchorterminal.com/compare/openhands-vs-qoder-cli.md)\n- [Prime Agent vs Qoder CLI](https://www.anchorterminal.com/compare/prime-agent-vs-qoder-cli.md)\n- [Qoder CLI vs Qwen Code](https://www.anchorterminal.com/compare/qoder-cli-vs-qwen-code.md)\n- [Qoder CLI vs Mirror CLI](https://www.anchorterminal.com/compare/qoder-cli-vs-reflection-mirror.md)\n- [Qoder CLI vs Rovo Dev CLI](https://www.anchorterminal.com/compare/qoder-cli-vs-rovo-dev-cli.md)\n- [Qoder CLI vs Unstoppable](https://www.anchorterminal.com/compare/qoder-cli-vs-unstoppable.md)\n- [Qoder CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading.md)\n- [Qoder CLI vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/qoder-cli-vs-warp.md)\n- [Clawboo vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.md)\n- [Clawboo vs Qoder CLI](https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.md)\n- [CLI Manager vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.md)\n- [CLI Manager vs Qoder CLI](https://www.anchorterminal.com/compare/cli-manager-vs-qoder-cli.md)\n- [dsh-superagent (DeepSeek) vs Harness](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.md)\n- [dsh-superagent (DeepSeek) vs Paperclip](https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.md)\n- [dsh-superagent (DeepSeek) vs Parallax](https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.md)\n- [Harness vs Qoder CLI](https://www.anchorterminal.com/compare/harness-autonomous-vs-qoder-cli.md)\n- [OpenMausBot vs Qoder CLI](https://www.anchorterminal.com/compare/openmausbot-vs-qoder-cli.md)\n- [Paperclip vs Qoder CLI](https://www.anchorterminal.com/compare/paperclip-vs-qoder-cli.md)\n- [Parallax vs Qoder CLI](https://www.anchorterminal.com/compare/parallax-agents-vs-qoder-cli.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dsh-superagent (DeepSeek) vs Qoder CLI", "url": "" } ], "description": "Qoder CLI scores 59 (C) to dsh-superagent's 42.1 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dsh-superagent (DeepSeek) E 42.1", "Qoder CLI C 59", "scores" ], "h1": "dsh-superagent (DeepSeek) vs Qoder CLI", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/deepseek-superagent-vs-qoder-cli", "published": "2026-10-01", "section": "tools", "title": "dsh-superagent vs Qoder CLI for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli" }, "tokens": { "markdown": 7400, "slim": 3830 }, "version": 1 }