DeepSeek posts coding agent that opens its own pull requests

DeepSeek says its open-source prototype watches one GitHub repository, takes work from approved people or team rules and can answer with pull requests.

DeepSeek has published code for an AI coding agent that watches a GitHub repository, takes requests from approved team members and replies with pull requests. The project, dsh-superagent, went up Saturday on the company’s GitHub page under the MIT license, which lets anyone use, change and resell the code.

The project’s readme file is blunt about what it is. It calls the code a “research prototype for reference only, not an official DeepSeek product.” It says much of the engineering was done by coding agents, that it “may still contain bugs” and that it differs from DeepSeek’s internal version. Some designs in DeepSeek’s write-up are “not implemented in this prototype,” it says.

How it works

The agent runs as an add-on for DeepSeek Harness, the company’s agent software. It listens to one GitHub repository and, optionally, to Feishu, a workplace chat app. When an approved person asks for work, it opens a work item, does the job in its own session and folder, and answers in the original thread, for example with a pull request. A web panel shows what needs a person.

The stated rule is to “take as little human attention as possible, and give as much value as possible.” The agent acts only when asked or when a rule the team wrote allows it, the readme says.

The authorization docs say comments and quoted documents cannot change the agent’s permissions. Only approved people can make direct requests. Bots on a team’s list can only suggest work.

What it takes to run

The deployment guide asks for a separate GitHub user account for the agent with write access to the repository. It needs Node.js, pnpm, git, Python, tmux and GitHub’s command-line tool, plus a model provider set up in DeepSeek Harness. It works only with repositories on github.com, not GitHub Enterprise Server.

The guide carries a plain warning. The agent’s workers run commands without approval, as the operator’s own computer account, with full access. A worker “can execute programs by path and read the operator’s home directory,” it says. DeepSeek tells operators who want isolation to use a dedicated account holding only the agent’s credentials. Background jobs get at most 30 minutes after each turn before they are killed.

Setup, the readme says, is meant to be done by asking a coding agent to read the setup file and walk through it.

Our read: The design gets the order right. People or written rules start the work, and by default a person still merges the pull request, though teams can set it up to merge on its own. By default, that keeps the maintainer’s review as the last gate, and DeepSeek’s focus on saving human attention shows it knows the real cost of agents is the review queue. But the safety rests on the operator, not the code. By DeepSeek’s own account, the agent runs commands unsupervised with full access to the machine it sits on, and isolation is a setup step, not a default. A prompt hidden in an issue may not change its permissions, but it still reaches a model that can run programs. The pull request is only as safe as the review behind it, and an agent that writes fast can wear down a careful reviewer. DeepSeek calls this research code. Teams should take that label at face value until outside users report how it holds up.