{ "data": { "a": { "slug": "deepseek-superagent", "name": "dsh-superagent (DeepSeek)", "vendor": "DeepSeek", "vendorUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype", "kind": "harness", "category": "agent-harnesses", "summary": "dsh-superagent is DeepSeek's MIT-licensed research prototype of a proactive coding agent for one GitHub repository, run as a DeepSeek Harness bundle. A main Session admits requests from allowed people and parallel Executor Sessions work them into pull requests.", "url": "https://www.anchorterminal.com/tools/deepseek-superagent", "markdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json", "dns": "deepseek-superagent.grade.anchorterminal.com", "repo": "https://github.com/deepseek-ai/dsh-superagent-prototype", "license": "MIT", "transports": [], "packages": [], "auth": "pat", "authNotes": "No account with the project. The agent acts through a dedicated GitHub user account signed in to a `gh` wrapper with `auth login`, and optionally a Feishu bot through `lark-cli`. DSH needs a model provider key. The local Management API takes no credential and accepts only loopback requests with `x-orchestrator-request: 1`.", "pricing": "free", "pricingNotes": "Free and MIT, with nothing to buy. The operator pays the model provider DSH is set up with, usually DeepSeek's API, for a main Session and one Session per Ticket.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, SETUP.md or docs/000 to 008 (checked 2026-11-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype/tree/main/docs", "capabilities": [ "agent.harness", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "open-source", "mit", "typescript", "local", "free", "no-card", "pre-1.0", "preview", "telemetry-default-on" ], "lastRelease": "2026-10-31", "graded": true, "anchor": { "graded": true, "score": 42.1, "grade": "E", "agentReady": false, "rank": 1108, "ranked": true, "rankOf": 1251, "categoryRank": 41, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "bestFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "strengths": [ "MIT licence, with nine numbered design and operations documents that state each rule, from admission to restart recovery", "Only listed GitHub logins can start work by default, and messages, comments and prompts cannot change the gate, which code enforces", "Proactive work starts in `observe` mode, which records what the agent would have done and accepts nothing", "The agent never enables auto-merge as its own account, and the default merge rule needs approvals and fewer than 200 changed lines", "Setup and worker shells drop environment variables named KEY, PASSWORD, SECRET or TOKEN, and git uses only the agent account's credentials" ], "weaknesses": [ "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory", "The README calls it a research prototype, not an official DeepSeek product, at version 0.1.0 with no tag, release or changelog found", "Not on npm. Installing means a git clone, `pnpm build`, a pinned DSH release candidate, tmux and a dedicated GitHub user account", "The docs don't mention that DSH's shipped profiles upload the session log to DeepSeek with official API requests by default", "No SECURITY.md, security.txt or CI workflow found, and GitHub's issues and pull requests couldn't be read" ], "agentNotes": [ "Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory", "Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code", "Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right", "Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request", "Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.1 } ], "editorialScores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 51 }, "provenanceScore": 52, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @deepseek-ai/dsh@0.2.1-rc.3 \u0026\u0026 git clone https://github.com/deepseek-ai/dsh-superagent-prototype dsh-superagent \u0026\u0026 cd dsh-superagent \u0026\u0026 pnpm install \u0026\u0026 pnpm build \u0026\u0026 dsh superagent --from-default-profile web --dump-config \u003e /dev/null \u0026\u0026 dsh plugin --profile superagent add \"link:$PWD\"" }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/deepseek-superagent" }, "sameCompany": [ "deepseek-harness" ], "area": "frameworks", "provenance": { "legalEntity": "DeepSeek (the LICENSE names the DeepSeek Harness Team; DeepSeek Harness's terms name Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://www.deepseek.com/en/harness/privacy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The repository has no terms or privacy policy of its own. DeepSeek Harness's terms of use and privacy policy (both last updated 20 September 2026) name Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and cover the harness it runs on. The README says the prototype is not an official DeepSeek product.", "package.json names `DeepSeek Harness Team \u003cteam@dsh.dev\u003e` as author. dsh.dev didn't resolve from our network on 1 November 2026.", "No SECURITY.md in the root or .github, and www.deepseek.com/.well-known/security.txt returned 404 on 1 November 2026.", "No CHANGELOG.md, tags or releases found. GitHub's web pages and API weren't reachable, so files were read on raw.githubusercontent.com and the commit history, stars and issues are unchecked." ], "score": 52 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.json" }, "answer": "Vibe-Trading scores 62.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories.", "b": { "slug": "vibe-trading", "name": "Vibe-Trading", "vendor": "HKUDS", "vendorUrl": "https://vibetrading.wiki", "kind": "harness", "category": "agent-harnesses", "summary": "Vibe-Trading is an open-source, self-hosted finance research agent from HKUDS. It turns plain-English questions into market data pulls, strategy code and backtests, through a CLI, a web UI, chat apps or its MCP server.", "url": "https://www.anchorterminal.com/tools/vibe-trading", "markdownUrl": "https://www.anchorterminal.com/tools/vibe-trading.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vibe-trading.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vibe-trading.json", "dns": "vibe-trading.grade.anchorterminal.com", "repo": "https://github.com/HKUDS/Vibe-Trading", "license": "MIT", "transports": [ "stdio", "streamable-http", "sse" ], "packages": [ { "registry": "pypi", "name": "vibe-trading-ai" } ], "auth": "none", "authNotes": "No account with the project. The owner supplies a model provider key in `agent/.env`, or uses Ollama, a ChatGPT OAuth sign-in for OpenAI Codex, a GitHub Copilot login or a local Claude Code login. The API server answers loopback clients without a key; any other client needs `API_AUTH_KEY` as `Authorization: Bearer \u003ckey\u003e`. The MCP server's HTTP transport binds 127.0.0.1 with a Host and Origin allow-list and no token. Broker connector credentials are stored in the OS keyring by `vibe-trading connector setup` (https://github.com/HKUDS/Vibe-Trading/blob/main/README.md).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays the model provider, or nothing with a local model through Ollama. 29 market-data sources are built in and most need no key. QVeris, an optional paid data marketplace, is a third party and is reached only in paid mode; the README carries a QVeris referral link and discloses it (checked 2026-10-25).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs or the source at v0.1.18 (checked 2026-10-25).", "endpoints": [] }, "toolCount": 82, "popularity": { "githubStars": 36500, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-25" }, "docsUrl": "https://vibetrading.wiki/docs/", "capabilities": [ "agent.harness", "agent.multi-agent", "agent.mcp-client", "data.markets", "market.crypto", "market.news", "assistant.messaging", "assistant.proactive" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "mit", "mcp", "cli", "harness", "docker", "no-card", "no-sandbox", "pre-1.0", "beta" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 62.8, "grade": "B", "agentReady": false, "rank": 491, "ranked": true, "rankOf": 1251, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 82, "payments": 60, "reliability": 63, "schema": 72, "security": 70, "transparency": 53 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-25" }, "negative": -4, "negativeNotes": [ "2026-10-02. GHSA-v2f8-6655-7grj (CVE-2026-114108, critical). In 0.1.0 to 0.1.6 the API server answered every client without authentication when `API_AUTH_KEY` was unset, the shipped default, with the Docker container running as root on 0.0.0.0:8899, which the advisory chains to remote code execution. Fixed in 0.1.7 of 6 May 2026 and published five months later, -2. https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj", "2026-10-02. GHSA-jqmf-mx4f-hfr6 (CVE-2026-114107, critical). Shell and code injection in the LLM-callable `bash`, `background_run` and backtest tools, and SSRF in `read_url`, reachable through the unauthenticated API or prompt injection in a processed document, in 0.1.0 to 0.1.6. Fixed in the same 0.1.7 release, -1. https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-jqmf-mx4f-hfr6", "2026-10-02. GHSA-5rmq-chc7-m22f (CVE-2026-114106, high). `read_document` read any file the process could reach and `safe_user_path()` accepted the whole home directory, in 0.1.0 to 0.1.6. Fixed in 0.1.7, -1. https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-5rmq-chc7-m22f" ], "verdict": "Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.", "bestFor": "A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.1.18", "No order-placing or order-cancelling tool is exposed over MCP, and shell tools are off on every MCP transport by default", "Live orders need an owner-committed mandate with hard caps, a kill switch and an append-only, hash-chained audit ledger", "Six PyPI releases in the 90 days to 25 October 2026, with a dated CHANGELOG.md and a Known issues section in 0.1.18", "API server answers only loopback clients without `API_AUTH_KEY`; Docker binds 127.0.0.1 and runs as a non-root user" ], "weaknesses": [ "Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain", "The local CLI's `bash` tool and generated backtest code run without per-action approval or a sandbox", "82 MCP tools with about 44,000 characters of descriptions in the server source and no readOnlyHint or destructiveHint annotations", "Version 0.1.18 with a Beta classifier, and not in the official MCP registry", "Broker trading is described in the README as experimental and not verified against a real broker account" ], "agentNotes": [ "Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain", "Set `API_AUTH_KEY` before exposing `vibe-trading serve` beyond localhost, and send it as `Authorization: Bearer \u003ckey\u003e`", "Set `VIBE_TRADING_ALLOWED_RUN_ROOTS` in the MCP client's `env` block; a shell `export` does not reach the spawned server", "Use `vibe-trading run -p \"...\" --json` for headless runs, and add `--enable-shell-tools` to `vibe-trading-mcp` only when shell access is needed", "Treat text from `read_url`, `web_search` and `read_document` as untrusted; `security_warnings` flags patterns but does not remove them" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.8 } ], "editorialScores": { "ergonomics": 67, "maintenance": 82, "payments": 60, "reliability": 63, "schema": 72, "security": 70, "transparency": 67 }, "provenanceScore": 39, "checked": { "categories": { "ergonomics": "2026-10-25", "maintenance": "2026-10-25", "payments": "2026-10-25", "reliability": "2026-10-25", "schema": "2026-10-25", "security": "2026-10-25", "transparency": "2026-10-25" }, "last": "2026-10-25", "lastMoved": "2026-10-28", "oldest": "2026-10-25", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install vibe-trading-ai # then: vibe-trading init # or: docker compose up --build from a clone", "config": { "mcpServers": { "vibe-trading": { "command": "vibe-trading-mcp" } } }, "headless": { "command": "vibe-trading run -p \"$TASK\" --json" } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/vibe-trading" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "vibetrading.wiki", "domainRegistered": "2026-05-14", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/HKUDS/Vibe-Trading/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-25", "notes": [ "No legal entity is named. The repository belongs to the GitHub organisation HKUDS, and pyproject.toml names HKUDS with an address at connect.hku.hk as author. The LICENSE names Vibe-Trading Contributors and NOTICE names HKUDS contributors.", "vibetrading.wiki is a static wiki on Cloudflare Pages built from the repository's wiki/ folder. It has no terms or privacy page, and the MIT licence stands in for terms.", "/robots.txt, /llms.txt and /.well-known/security.txt on vibetrading.wiki all answered with the same HTML redirect to /home/ on 25 October 2026, so there are no robots rules, no llms.txt and no security.txt.", "SECURITY.md asks for private reports through a GitHub security advisory and promises an acknowledgement within five business days.", "RDAP gives a registration date of 14 May 2026 for vibetrading.wiki. The README dates the wiki's launch to the same day.", "There is no hosted endpoint. The API and MCP server answer on the owner's own host." ], "score": 39 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vibe-trading.json", "live": { "slug": "vibe-trading", "versions": [ { "registry": "github", "name": "HKUDS/Vibe-Trading", "version": "v0.1.18", "released": "2026-10-21", "seenAt": "2026-10-31T16:34:34.766090117Z" }, { "registry": "pypi", "name": "vibe-trading-ai", "version": "0.1.18", "released": "2026-10-21", "seenAt": "2026-10-31T16:34:34.578462469Z" } ], "githubStars": 37284, "pypiWeekly": 3103, "securityTxt": { "url": "https://vibetrading.wiki/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-31T15:41:06.409103563Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/HKUDS/Vibe-Trading/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-31T06:19:35.326981477Z", "changedAt": "2026-10-30T05:47:13.484530381Z", "fingerprint": "1aa610d066ca" } ], "github": { "repo": "hkuds/vibe-trading", "checkedAt": "2026-10-26T07:04:43.896464496Z", "stars": 36707, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-25T14:27:19Z", "openIssues": 9, "openPRs": 15, "issuesOpened90d": 239, "issuesClosed90d": 238, "prsMerged90d": 716, "ci": { "branch": "main", "runs": 50, "success": 37, "failure": 2, "other": 11, "latest": "success", "latestAt": "2026-10-25T14:40:31Z" }, "advisories": [ { "ghsa": "GHSA-v2f8-6655-7grj", "severity": "critical", "published": "2026-07-29T12:13:09Z" }, { "ghsa": "GHSA-5rmq-chc7-m22f", "severity": "high", "published": "2026-07-29T12:07:20Z" }, { "ghsa": "GHSA-jqmf-mx4f-hfr6", "severity": "critical", "published": "2026-07-29T12:07:19Z" } ], "replies": { "sampled": 25, "unanswered": 0, "medianDays": 0.7 } }, "updatedAt": "2026-10-31T16:34:34.766090117Z" } }, "edges": [ { "by": 48, "category": "reliability", "leads": "vibe-trading", "name": "Reliability", "reasons": { "a": "Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).", "b": "Read with the local-software lines, as for nanobot and Agent Zero, since the owner runs it. `vibe-trading-ai` installs from PyPI for Python 3.11 or newer, with classifiers for 3.11 to 3.13, and a Docker Compose setup ships in the repository (20). A CI workflow runs the test suite on pushes and pull requests to main, with hash-locked dependency checks on Linux, macOS and Windows, and the repository holds 961 test files. Whether the latest runs on main passed couldn't be read, because GitHub's Actions pages weren't reachable (15 of 25). The repository page showed 7 open issues and 57 open pull requests on 25 October 2026 against 761 commits in the 30 days before, and the 0.1.18 notes list two known issues already fixed on main. Issue threads weren't read (18 of 25). CHANGELOG.md says it follows Semantic Versioning, with dated entries from 0.1.8, a Known issues section and an upgrade note for the LangChain 1.x move in 0.1.10, but on 0.x breaking changes ride in minor versions and there is no Breaking section (10 of 15). Version 0.1.18 with the classifier Development Status 4, Beta (0)." }, "scores": { "a": 15, "b": 63 } }, { "by": 48, "category": "maintenance", "leads": "vibe-trading", "name": "Maintenance \u0026 community", "reasons": { "a": "Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).", "b": "v0.1.18 was published to PyPI on 21 October 2026, four days before this check (30). Six releases in the 90 days to 25 October, 0.1.13 to 0.1.18 (20). 761 commits and 253 merge commits in the last 30 days from more than ten authors, against 7 open issues and 57 open pull requests on the repository page. Issue and pull request threads weren't read, a judgement call (18 of 25). An MCP server that isn't in the official MCP registry (searches for vibe-trading and hkuds on 25 October 2026 found nothing). It is published on PyPI, as a Docker setup and on ClawHub (5 of 15). Hash-locked requirements checked in CI on three operating systems, Dependabot set to monthly, and dependency floors raised for named CVEs, such as `mcp\u003e=1.30.0` for CVE-2026-59951 (9 of 10)." }, "scores": { "a": 34, "b": 82 } }, { "by": 37, "category": "security", "leads": "vibe-trading", "name": "Security \u0026 auth", "reasons": { "a": "Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).", "b": "Harness reading used for nanobot and goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.1.18, and the only call to PyPI is the owner-run `vibe-trading update`. The API answers only loopback clients without `API_AUTH_KEY`, Docker binds 127.0.0.1 and runs as user `vibe`, and the MCP HTTP transport binds 127.0.0.1 with a Host and Origin allow-list against DNS rebinding but no token. Broker keys go to the OS keyring; model keys sit in `agent/.env` in clear text. The docs carry no statement that nothing is collected (24). Live orders need a mandate that only the owner commits through the web UI or API, with hard caps and a kill switch, and an optional TAP mode waits for human approval of each Alpaca write. No order tool is exposed over MCP, and shell tools are off on the API and every MCP transport unless enabled. The local CLI runs `bash` and file writes without asking, and generated backtest code runs as a network-capable subprocess with a narrowed environment and no sandbox (13). Reader and search tools add warning-only `security_warnings` from regex rules, and external MCP tool hints are treated as untrusted in the source. The `claude-cli` provider's tool filters are described as convenience filters, not a boundary (9). A live-action ledger written append-only with a hash-chained copy, run cards with hashed execution records, tool traces and per-run token usage (13). SECURITY.md with private advisory reporting and a five-business-day acknowledgement. Three advisories were published on 2 October 2026 with CVE identifiers, five months after the 0.1.7 fix. No security.txt and no bounty (11)." }, "scores": { "a": 33, "b": 70 } }, { "by": 20, "category": "payments", "leads": "vibe-trading", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run `auth login` for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.", "b": "Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama and needs no sign-up with the project. QVeris paid data, reached through a disclosed referral link, is a third party's product and is not scored." }, "scores": { "a": 40, "b": 60 } }, { "by": 11, "category": "schema", "leads": "vibe-trading", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).", "b": "Harness reading of the lines, as for nanobot. The MCP server's tools take typed JSON Schema inputs generated from Python signatures through FastMCP, with a string output schema, and the API server serves FastAPI's OpenAPI file locally (keyless on loopback, behind the key otherwise). No published OpenAPI file or tool manifest outside the running program (20 of 25). No llms.txt on vibetrading.wiki, where /llms.txt redirects to the home page, and the docs are drawn by script from `content.en.js`. The repository carries Markdown READMEs in seven languages and an agent skill file, `agent/SKILL.md` (5 of 10). Tool descriptions say what each does, its arguments and what to call first, such as `list_skills()` before `load_skill`. The server's own header says every tool is read-only apart from `refresh_strategy_evidence`, while `write_file` is also exposed (14 of 20). Inputs are typed, but many choices are free strings (`protocol`, `risk_tier`, `format`) and several take free dictionaries (8 of 15). Many worked examples in the README and a troubleshooting page that names failure states such as `no_progress` and the 403 from another device; tool errors come back as JSON with an `error_type` (12 of 15). Dated CHANGELOG.md, GitHub release tags and versioned docs, though the docs still name 0.1.16 as latest (13 of 15)." }, "scores": { "a": 61, "b": 72 } } ], "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "DeepSeek", "b": "HKUDS", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "stdio, Streamable HTTP, SSE (legacy)", "name": "Transports" }, { "a": "Token", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT", "name": "Licence" }, { "a": "none", "b": "82", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-31", "b": "2026-10-21", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-09-20", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "none", "b": "37k stars", "name": "Popularity" } ], "faq": [ { "answer": "Vibe-Trading scores 62.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, dsh-superagent (DeepSeek) or Vibe-Trading?" }, { "answer": "Yes. dsh-superagent (DeepSeek) is open source (MIT). Vibe-Trading is open source (MIT).", "question": "Are dsh-superagent (DeepSeek) and Vibe-Trading open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Vibe-Trading loses 4 points for them" ], "goodFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "slug": "deepseek-superagent", "watchFor": "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory" }, { "aheadOn": [ "Reliability, 63 against 15", "Schema \u0026 documentation, 72 against 61", "Security \u0026 auth, 70 against 33", "Payments \u0026 pricing, 60 against 40", "Maintenance \u0026 community, 82 against 34" ], "also": [ "No key needed to call it", "Runs on your own machine" ], "goodFor": "A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.", "slug": "vibe-trading", "watchFor": "Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain" } ], "history": { "deepseek-superagent": null, "vibe-trading": [ { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.4, "from": 62.4, "fromGrade": "B", "to": 62.8, "toGrade": "B" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.2, "from": 62.2, "fromGrade": "B", "to": 62.4, "toGrade": "B" } ] }, "job": { "capability": "agent.harness", "name": "Agent harnesses" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.json", "title": "Agent Zero vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-vibe-trading.json", "title": "Agent Zero vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.json", "title": "Aider vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-vibe-trading.json", "title": "Aider vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/aider-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.json", "title": "Amp vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-vibe-trading.json", "title": "Amp vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/amp-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.json", "title": "Antigravity CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-vibe-trading.json", "title": "Antigravity CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.json", "title": "Auggie CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-vibe-trading.json", "title": "Auggie CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/auggie-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.json", "title": "Claude Code vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-vibe-trading.json", "title": "Claude Code vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/claude-code-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.json", "title": "Cline vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-vibe-trading.json", "title": "Cline vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/cline-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.json", "title": "Crush vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-vibe-trading.json", "title": "Crush vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/crush-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.json", "title": "Cursor CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-vibe-trading.json", "title": "Cursor CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.json", "title": "DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-vibe-trading.json", "title": "DeepSeek Harness (dsh) vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.json", "title": "dsh-superagent (DeepSeek) vs Devin", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.json", "title": "dsh-superagent (DeepSeek) vs Droid CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.json", "title": "dsh-superagent (DeepSeek) vs Pi", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.json", "title": "dsh-superagent (DeepSeek) vs Gemini CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.json", "title": "dsh-superagent (DeepSeek) vs GitHub Copilot CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.json", "title": "dsh-superagent (DeepSeek) vs goose", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.json", "title": "dsh-superagent (DeepSeek) vs Harness²", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.json", "title": "dsh-superagent (DeepSeek) vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.json", "title": "dsh-superagent (DeepSeek) vs Jules", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.json", "title": "dsh-superagent (DeepSeek) vs Junie CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.json", "title": "dsh-superagent (DeepSeek) vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.json", "title": "dsh-superagent (DeepSeek) vs mini-swe-agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.json", "title": "dsh-superagent (DeepSeek) vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.json", "title": "dsh-superagent (DeepSeek) vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.json", "title": "dsh-superagent (DeepSeek) vs Muse Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.json", "title": "dsh-superagent (DeepSeek) vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.json", "title": "dsh-superagent (DeepSeek) vs OpenCode", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.json", "title": "dsh-superagent (DeepSeek) vs OpenHands", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.json", "title": "dsh-superagent (DeepSeek) vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.json", "title": "dsh-superagent (DeepSeek) vs Prime Agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.json", "title": "dsh-superagent (DeepSeek) vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.json", "title": "dsh-superagent (DeepSeek) vs Qwen Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.json", "title": "dsh-superagent (DeepSeek) vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.json", "title": "dsh-superagent (DeepSeek) vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.json", "title": "dsh-superagent (DeepSeek) vs Unstoppable", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.json", "title": "dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/devin-vs-vibe-trading.json", "title": "Devin vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/devin-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/droid-cli-vs-vibe-trading.json", "title": "Droid CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/droid-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/earendil-pi-vs-vibe-trading.json", "title": "Pi vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/earendil-pi-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-vibe-trading.json", "title": "Gemini CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-vibe-trading.json", "title": "GitHub Copilot CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-vibe-trading.json", "title": "goose vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/goose-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/harness2-vs-vibe-trading.json", "title": "Harness² vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/harness2-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/harnessrouter-vs-vibe-trading.json", "title": "HarnessRouter vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/harnessrouter-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/jules-vs-vibe-trading.json", "title": "Jules vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/jules-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/junie-vs-vibe-trading.json", "title": "Junie CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/junie-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-vibe-trading.json", "title": "Kilo Code CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-vibe-trading.json", "title": "Kimi Code CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/kiro-cli-vs-vibe-trading.json", "title": "Kiro CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/kiro-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-vibe-trading.json", "title": "mini-swe-agent vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/minimax-code-vs-vibe-trading.json", "title": "MiniMax Code vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/minimax-code-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.json", "title": "Mistral Vibe CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/muse-code-vs-vibe-trading.json", "title": "Muse Code vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/muse-code-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/openai-codex-vs-vibe-trading.json", "title": "OpenAI Codex vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/openai-codex-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/opencode-vs-vibe-trading.json", "title": "OpenCode vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/opencode-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/openhands-vs-vibe-trading.json", "title": "OpenHands vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/openhands-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/prime-agent-vs-vibe-trading.json", "title": "Prime Agent vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/prime-agent-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading.json", "title": "Qoder CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/qwen-code-vs-vibe-trading.json", "title": "Qwen Code vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/qwen-code-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/reflection-mirror-vs-vibe-trading.json", "title": "Mirror CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/reflection-mirror-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/rovo-dev-cli-vs-vibe-trading.json", "title": "Rovo Dev CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/rovo-dev-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/vibe-trading-vs-warp.json", "title": "Vibe-Trading vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/vibe-trading-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.json", "title": "Clawboo vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.json", "title": "Clawboo vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.json", "title": "CLI Manager vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-vibe-trading.json", "title": "CLI Manager vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.json", "title": "dsh-superagent (DeepSeek) vs Harness", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.json", "title": "dsh-superagent (DeepSeek) vs Paperclip", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.json", "title": "dsh-superagent (DeepSeek) vs Parallax", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents" }, { "json": "https://www.anchorterminal.com/compare/harness-autonomous-vs-vibe-trading.json", "title": "Harness vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/harness-autonomous-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/openmausbot-vs-vibe-trading.json", "title": "OpenMausBot vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/openmausbot-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/paperclip-vs-vibe-trading.json", "title": "Paperclip vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/paperclip-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/parallax-agents-vs-vibe-trading.json", "title": "Parallax vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/parallax-agents-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/unstoppable-vs-vibe-trading.json", "title": "Unstoppable vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/unstoppable-vs-vibe-trading" } ], "panel": null, "scores": [ { "by": 48, "deepseek-superagent": 15, "edge": "vibe-trading", "key": "reliability", "name": "Reliability", "vibe-trading": 63, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 11, "deepseek-superagent": 61, "edge": "vibe-trading", "key": "schema", "name": "Schema \u0026 documentation", "vibe-trading": 72, "weight": 13 }, { "by": 0, "deepseek-superagent": 67, "edge": "", "key": "ergonomics", "name": "Agent ergonomics", "vibe-trading": 67, "weight": 13 }, { "by": 37, "deepseek-superagent": 33, "edge": "vibe-trading", "key": "security", "name": "Security \u0026 auth", "vibe-trading": 70, "weight": 14 }, { "by": 20, "deepseek-superagent": 40, "edge": "vibe-trading", "key": "payments", "name": "Payments \u0026 pricing", "vibe-trading": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 48, "deepseek-superagent": 34, "edge": "vibe-trading", "key": "maintenance", "name": "Maintenance \u0026 community", "vibe-trading": 82, "weight": 7 }, { "by": 1, "deepseek-superagent": 52, "edge": "vibe-trading", "key": "transparency", "name": "Transparency \u0026 trust", "vibe-trading": 53, "weight": 7 } ], "summary": "Vibe-Trading scores 62.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. Both do agent harnesses.", "tasks": null, "tutorials": [], "verdicts": { "deepseek-superagent": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "vibe-trading": "Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading", "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.min.md" }, "markdown": "Vibe-Trading scores 62.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories. Both do agent harnesses.\n\n- dsh-superagent (DeepSeek): grade E, 42.1/100, rank #1108 of 1251. Markdown https://www.anchorterminal.com/tools/deepseek-superagent.md · JSON https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json\n- Vibe-Trading: grade B, 62.8/100, rank #491 of 1251. Markdown https://www.anchorterminal.com/tools/vibe-trading.md · JSON https://www.anchorterminal.com/api/v1/tools/vibe-trading.json\n- Best agent harnesses and coding agents: https://www.anchorterminal.com/best/agent-harnesses/index.md\n- All 955 harnesses comparisons: https://www.anchorterminal.com/compare/agent-harnesses/index.md\n\n## Which one, for what\n\n### dsh-superagent (DeepSeek) (E)\n\nGood for: Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.\n\nAlso in its favour:\n- No incidents deducted, where Vibe-Trading loses 4 points for them\n\nWatch for: Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory\n\n### Vibe-Trading (B)\n\nGood for: A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.\n\nAhead on:\n- Reliability, 63 against 15\n- Schema \u0026 documentation, 72 against 61\n- Security \u0026 auth, 70 against 33\n- Payments \u0026 pricing, 60 against 40\n- Maintenance \u0026 community, 82 against 34\n\nAlso in its favour:\n- No key needed to call it\n- Runs on your own machine\n\nWatch for: Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain\n\n\n## Why the edge\n\n### Reliability: Vibe-Trading +48\n\n- dsh-superagent (DeepSeek) (15): Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).\n- Vibe-Trading (63): Read with the local-software lines, as for nanobot and Agent Zero, since the owner runs it. `vibe-trading-ai` installs from PyPI for Python 3.11 or newer, with classifiers for 3.11 to 3.13, and a Docker Compose setup ships in the repository (20). A CI workflow runs the test suite on pushes and pull requests to main, with hash-locked dependency checks on Linux, macOS and Windows, and the repository holds 961 test files. Whether the latest runs on main passed couldn't be read, because GitHub's Actions pages weren't reachable (15 of 25). The repository page showed 7 open issues and 57 open pull requests on 25 October 2026 against 761 commits in the 30 days before, and the 0.1.18 notes list two known issues already fixed on main. Issue threads weren't read (18 of 25). CHANGELOG.md says it follows Semantic Versioning, with dated entries from 0.1.8, a Known issues section and an upgrade note for the LangChain 1.x move in 0.1.10, but on 0.x breaking changes ride in minor versions and there is no Breaking section (10 of 15). Version 0.1.18 with the classifier Development Status 4, Beta (0).\n\n### Maintenance \u0026 community: Vibe-Trading +48\n\n- dsh-superagent (DeepSeek) (34): Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).\n- Vibe-Trading (82): v0.1.18 was published to PyPI on 21 October 2026, four days before this check (30). Six releases in the 90 days to 25 October, 0.1.13 to 0.1.18 (20). 761 commits and 253 merge commits in the last 30 days from more than ten authors, against 7 open issues and 57 open pull requests on the repository page. Issue and pull request threads weren't read, a judgement call (18 of 25). An MCP server that isn't in the official MCP registry (searches for vibe-trading and hkuds on 25 October 2026 found nothing). It is published on PyPI, as a Docker setup and on ClawHub (5 of 15). Hash-locked requirements checked in CI on three operating systems, Dependabot set to monthly, and dependency floors raised for named CVEs, such as `mcp\u003e=1.30.0` for CVE-2026-59951 (9 of 10).\n\n### Security \u0026 auth: Vibe-Trading +37\n\n- dsh-superagent (DeepSeek) (33): Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).\n- Vibe-Trading (70): Harness reading used for nanobot and goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.1.18, and the only call to PyPI is the owner-run `vibe-trading update`. The API answers only loopback clients without `API_AUTH_KEY`, Docker binds 127.0.0.1 and runs as user `vibe`, and the MCP HTTP transport binds 127.0.0.1 with a Host and Origin allow-list against DNS rebinding but no token. Broker keys go to the OS keyring; model keys sit in `agent/.env` in clear text. The docs carry no statement that nothing is collected (24). Live orders need a mandate that only the owner commits through the web UI or API, with hard caps and a kill switch, and an optional TAP mode waits for human approval of each Alpaca write. No order tool is exposed over MCP, and shell tools are off on the API and every MCP transport unless enabled. The local CLI runs `bash` and file writes without asking, and generated backtest code runs as a network-capable subprocess with a narrowed environment and no sandbox (13). Reader and search tools add warning-only `security_warnings` from regex rules, and external MCP tool hints are treated as untrusted in the source. The `claude-cli` provider's tool filters are described as convenience filters, not a boundary (9). A live-action ledger written append-only with a hash-chained copy, run cards with hashed execution records, tool traces and per-run token usage (13). SECURITY.md with private advisory reporting and a five-business-day acknowledgement. Three advisories were published on 2 October 2026 with CVE identifiers, five months after the 0.1.7 fix. No security.txt and no bounty (11).\n\n### Payments \u0026 pricing: Vibe-Trading +20\n\n- dsh-superagent (DeepSeek) (40): Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run `auth login` for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.\n- Vibe-Trading (60): Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama and needs no sign-up with the project. QVeris paid data, reached through a disclosed referral link, is a third party's product and is not scored.\n\n### Schema \u0026 documentation: Vibe-Trading +11\n\n- dsh-superagent (DeepSeek) (61): Framework reading, as for deepseek-harness. No OpenAPI or JSON Schema is published. docs/006 documents the Management API's routes, fields, block shapes and refusals in tables, and the code validates settings with zod (12). Markdown docs in the repository, readable raw, and a SETUP.md written for a coding agent. No llms.txt (5). Nine numbered documents read in order, each stating purpose, limits and what not to do, such as never rerunning the profile-creation command for an upgrade (17). Closed sets for accept mode (`off`, `observe`, `auto`), admission cells, Source states, health states and `listen` (12). A worked curl example, refusals as 400, 404, 409 and 500 with `issues`, `setup` or `code`, a troubleshooting table and status exit codes 0 to 3 (13). package.json says 0.1.0 and pins an `engines.dsh` range, but no changelog or tags were found (2).\n- Vibe-Trading (72): Harness reading of the lines, as for nanobot. The MCP server's tools take typed JSON Schema inputs generated from Python signatures through FastMCP, with a string output schema, and the API server serves FastAPI's OpenAPI file locally (keyless on loopback, behind the key otherwise). No published OpenAPI file or tool manifest outside the running program (20 of 25). No llms.txt on vibetrading.wiki, where /llms.txt redirects to the home page, and the docs are drawn by script from `content.en.js`. The repository carries Markdown READMEs in seven languages and an agent skill file, `agent/SKILL.md` (5 of 10). Tool descriptions say what each does, its arguments and what to call first, such as `list_skills()` before `load_skill`. The server's own header says every tool is read-only apart from `refresh_strategy_evidence`, while `write_file` is also exposed (14 of 20). Inputs are typed, but many choices are free strings (`protocol`, `risk_tier`, `format`) and several take free dictionaries (8 of 15). Many worked examples in the README and a troubleshooting page that names failure states such as `no_progress` and the 403 from another device; tool errors come back as JSON with an `error_type` (12 of 15). Dated CHANGELOG.md, GitHub release tags and versioned docs, though the docs still name 0.1.16 as latest (13 of 15).\n\n## Score by category\n\n| Category | Weight | dsh-superagent (DeepSeek) | Vibe-Trading | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 63 | Vibe-Trading +48 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 72 | Vibe-Trading +11 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 67 | even |\n| Security \u0026 auth | 14% (17.5 this run) | 33 | 70 | Vibe-Trading +37 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 60 | Vibe-Trading +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 34 | 82 | Vibe-Trading +48 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 53 | Vibe-Trading +1 |\n| Negative events | ≤15 | 0 | -4 | |\n| **Total** | | **42.1 · E** | **62.8 · B** | |\n\n## Facts side by side\n\n| Fact | dsh-superagent (DeepSeek) | Vibe-Trading |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | DeepSeek | HKUDS |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | stdio, Streamable HTTP, SSE (legacy) |\n| Auth | Token | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | MIT |\n| Tools exposed | none | 82 |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| Last release | 2026-10-31 | 2026-10-21 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | 2026-09-20 | no document linked |\n| Popularity | none | 37k stars |\n\n## How the scores have moved\n\n### dsh-superagent (DeepSeek)\n\nNo score change since it was listed.\n\n### Vibe-Trading\n\n- +0.4 on 28 October 2026: new evidence\n- +0.2 on 27 October 2026: new evidence\n\n## Verdicts\n\n**dsh-superagent (DeepSeek).** The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.\n\n**Vibe-Trading.** Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.\n\n## Before you call either\n\n### dsh-superagent (DeepSeek)\n\n1. Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory\n2. Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code\n3. Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right\n4. Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request\n5. Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409\n\n### Vibe-Trading\n\n1. Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain\n2. Set `API_AUTH_KEY` before exposing `vibe-trading serve` beyond localhost, and send it as `Authorization: Bearer \u003ckey\u003e`\n3. Set `VIBE_TRADING_ALLOWED_RUN_ROOTS` in the MCP client's `env` block; a shell `export` does not reach the spawned server\n4. Use `vibe-trading run -p \"...\" --json` for headless runs, and add `--enable-shell-tools` to `vibe-trading-mcp` only when shell access is needed\n5. Treat text from `read_url`, `web_search` and `read_document` as untrusted; `security_warnings` flags patterns but does not remove them\n\n## Questions\n\n### Which is better for AI agents, dsh-superagent (DeepSeek) or Vibe-Trading?\n\nVibe-Trading scores 62.8 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in 6 of 7 scored categories.\n\n### Are dsh-superagent (DeepSeek) and Vibe-Trading open source?\n\nYes. dsh-superagent (DeepSeek) is open source (MIT). Vibe-Trading is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.json, and with the fewest tokens: https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"deepseek-superagent\", \"b\": \"vibe-trading\"}`. From a terminal: `anchor compare deepseek-superagent vibe-trading`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json and https://www.anchorterminal.com/api/v1/tools/vibe-trading.json\n\n## Other comparisons with dsh-superagent (DeepSeek) or Vibe-Trading\n\n- [Agent Zero vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.md)\n- [Agent Zero vs Vibe-Trading](https://www.anchorterminal.com/compare/agent-zero-vs-vibe-trading.md)\n- [Aider vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.md)\n- [Aider vs Vibe-Trading](https://www.anchorterminal.com/compare/aider-vs-vibe-trading.md)\n- [Amp vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.md)\n- [Amp vs Vibe-Trading](https://www.anchorterminal.com/compare/amp-vs-vibe-trading.md)\n- [Antigravity CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.md)\n- [Antigravity CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/antigravity-cli-vs-vibe-trading.md)\n- [Auggie CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.md)\n- [Auggie CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/auggie-vs-vibe-trading.md)\n- [Claude Code vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.md)\n- [Claude Code vs Vibe-Trading](https://www.anchorterminal.com/compare/claude-code-vs-vibe-trading.md)\n- [Cline vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.md)\n- [Cline vs Vibe-Trading](https://www.anchorterminal.com/compare/cline-vs-vibe-trading.md)\n- [Crush vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.md)\n- [Crush vs Vibe-Trading](https://www.anchorterminal.com/compare/crush-vs-vibe-trading.md)\n- [Cursor CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.md)\n- [Cursor CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/cursor-cli-vs-vibe-trading.md)\n- [DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.md)\n- [DeepSeek Harness (dsh) vs Vibe-Trading](https://www.anchorterminal.com/compare/deepseek-harness-vs-vibe-trading.md)\n- [dsh-superagent (DeepSeek) vs Devin](https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.md)\n- [dsh-superagent (DeepSeek) vs Droid CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.md)\n- [dsh-superagent (DeepSeek) vs Pi](https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.md)\n- [dsh-superagent (DeepSeek) vs Gemini CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.md)\n- [dsh-superagent (DeepSeek) vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.md)\n- [dsh-superagent (DeepSeek) vs goose](https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.md)\n- [dsh-superagent (DeepSeek) vs Harness²](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.md)\n- [dsh-superagent (DeepSeek) vs HarnessRouter](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.md)\n- [dsh-superagent (DeepSeek) vs Jules](https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.md)\n- [dsh-superagent (DeepSeek) vs Junie CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.md)\n- [dsh-superagent (DeepSeek) vs Kilo Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kimi Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kiro CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.md)\n- [dsh-superagent (DeepSeek) vs mini-swe-agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.md)\n- [dsh-superagent (DeepSeek) vs MiniMax Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.md)\n- [dsh-superagent (DeepSeek) vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.md)\n- [dsh-superagent (DeepSeek) vs Muse Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.md)\n- [dsh-superagent (DeepSeek) vs OpenAI Codex](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.md)\n- [dsh-superagent (DeepSeek) vs OpenCode](https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.md)\n- [dsh-superagent (DeepSeek) vs OpenHands](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.md)\n- [dsh-superagent (DeepSeek) vs OpenMausBot](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.md)\n- [dsh-superagent (DeepSeek) vs Prime Agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.md)\n- [dsh-superagent (DeepSeek) vs Qoder CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.md)\n- [dsh-superagent (DeepSeek) vs Qwen Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.md)\n- [dsh-superagent (DeepSeek) vs Mirror CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.md)\n- [dsh-superagent (DeepSeek) vs Rovo Dev CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.md)\n- [dsh-superagent (DeepSeek) vs Unstoppable](https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.md)\n- [dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.md)\n- [Devin vs Vibe-Trading](https://www.anchorterminal.com/compare/devin-vs-vibe-trading.md)\n- [Droid CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/droid-cli-vs-vibe-trading.md)\n- [Pi vs Vibe-Trading](https://www.anchorterminal.com/compare/earendil-pi-vs-vibe-trading.md)\n- [Gemini CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/gemini-cli-vs-vibe-trading.md)\n- [GitHub Copilot CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/github-copilot-cli-vs-vibe-trading.md)\n- [goose vs Vibe-Trading](https://www.anchorterminal.com/compare/goose-vs-vibe-trading.md)\n- [Harness² vs Vibe-Trading](https://www.anchorterminal.com/compare/harness2-vs-vibe-trading.md)\n- [HarnessRouter vs Vibe-Trading](https://www.anchorterminal.com/compare/harnessrouter-vs-vibe-trading.md)\n- [Jules vs Vibe-Trading](https://www.anchorterminal.com/compare/jules-vs-vibe-trading.md)\n- [Junie CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/junie-vs-vibe-trading.md)\n- [Kilo Code CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/kilo-code-cli-vs-vibe-trading.md)\n- [Kimi Code CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/kimi-code-cli-vs-vibe-trading.md)\n- [Kiro CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/kiro-cli-vs-vibe-trading.md)\n- [mini-swe-agent vs Vibe-Trading](https://www.anchorterminal.com/compare/mini-swe-agent-vs-vibe-trading.md)\n- [MiniMax Code vs Vibe-Trading](https://www.anchorterminal.com/compare/minimax-code-vs-vibe-trading.md)\n- [Mistral Vibe CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.md)\n- [Muse Code vs Vibe-Trading](https://www.anchorterminal.com/compare/muse-code-vs-vibe-trading.md)\n- [OpenAI Codex vs Vibe-Trading](https://www.anchorterminal.com/compare/openai-codex-vs-vibe-trading.md)\n- [OpenCode vs Vibe-Trading](https://www.anchorterminal.com/compare/opencode-vs-vibe-trading.md)\n- [OpenHands vs Vibe-Trading](https://www.anchorterminal.com/compare/openhands-vs-vibe-trading.md)\n- [Prime Agent vs Vibe-Trading](https://www.anchorterminal.com/compare/prime-agent-vs-vibe-trading.md)\n- [Qoder CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/qoder-cli-vs-vibe-trading.md)\n- [Qwen Code vs Vibe-Trading](https://www.anchorterminal.com/compare/qwen-code-vs-vibe-trading.md)\n- [Mirror CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/reflection-mirror-vs-vibe-trading.md)\n- [Rovo Dev CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/rovo-dev-cli-vs-vibe-trading.md)\n- [Vibe-Trading vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/vibe-trading-vs-warp.md)\n- [Clawboo vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.md)\n- [Clawboo vs Vibe-Trading](https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.md)\n- [CLI Manager vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.md)\n- [CLI Manager vs Vibe-Trading](https://www.anchorterminal.com/compare/cli-manager-vs-vibe-trading.md)\n- [dsh-superagent (DeepSeek) vs Harness](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.md)\n- [dsh-superagent (DeepSeek) vs Paperclip](https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.md)\n- [dsh-superagent (DeepSeek) vs Parallax](https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.md)\n- [Harness vs Vibe-Trading](https://www.anchorterminal.com/compare/harness-autonomous-vs-vibe-trading.md)\n- [OpenMausBot vs Vibe-Trading](https://www.anchorterminal.com/compare/openmausbot-vs-vibe-trading.md)\n- [Paperclip vs Vibe-Trading](https://www.anchorterminal.com/compare/paperclip-vs-vibe-trading.md)\n- [Parallax vs Vibe-Trading](https://www.anchorterminal.com/compare/parallax-agents-vs-vibe-trading.md)\n- [Unstoppable vs Vibe-Trading](https://www.anchorterminal.com/compare/unstoppable-vs-vibe-trading.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dsh-superagent (DeepSeek) vs Vibe-Trading", "url": "" } ], "description": "Vibe-Trading scores 62.8 (B) to dsh-superagent's 42.1 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dsh-superagent (DeepSeek) E 42.1", "Vibe-Trading B 62.8", "scores" ], "h1": "dsh-superagent (DeepSeek) vs Vibe-Trading", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/deepseek-superagent-vs-vibe-trading", "published": "2026-10-01", "section": "tools", "title": "dsh-superagent vs Vibe-Trading for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading" }, "tokens": { "markdown": 6900, "slim": 3180 }, "version": 1 }