bytedance/deer-flow
An open-source long-horizon SuperAgent harness that researches, codes, and creates. With the help of sandboxes, memories, tools, skill, subagents and message gateway, it handles different levels of tasks that could take minutes to hours.
How deer-flow is put together
DeerFlow 2.0 is an open-source 'super agent harness' that orchestrates LLM sub-agents, long-term memory, and sandboxed execution behind extensible Markdown-defined skills. The backend is a Python 3.12 uv-workspace monorepo: a thin FastAPI application layer (backend/app/gateway) sits on top of the deerflow-harness framework package (backend/packages/harness), which is built on LangGraph/LangChain and exposes a stable public contract via the dependency-free deerflow-extension-api package. A Next.js 16 / React 19 frontend proxies all /api/* traffic through next.config.js rewrites to the gateway (default http://127.0.0.1:8001). Data flow: browser -> Next.js same-origin rewrite -> FastAPI gateway (auth/CSRF middleware) -> harness agents -> LLM providers, search/crawl tools, and sandboxes (E2B/Kubernetes/local); IM channels (Slack, Telegram, DingTalk, Feishu/Lark, Discord, WeCom, WeChat, GitHub, Buzz/Nostr) feed the same pipeline through backend/app/channels.
Languages
Frameworks
Datastores
Infrastructure
Major components
backend/app/gateway
FastAPI application layer exposing the HTTP API (agents, skills, threads, runs, memory, MCP, artifacts, uploads) with auth, CSRF, authorization, tracing, and pagination middleware.
backend/packages/harness (deerflow-harness)
The core agent harness framework: LangGraph-based agents, model providers (OpenAI, Anthropic, DeepSeek, Google, vLLM, Ollama), tools/search, memory, checkpoints, sandbox providers, TUI entrypoint (`deerflow`).
backend/packages/extension-api (deerflow-extension-api)
Import-light, stdlib-only public contract package defining the stable extension interface (extension principal resolver, provenance key set) that extensions declare ranges against.
backend/app/channels
Inbound/outbound IM channel integrations (Slack, Telegram, DingTalk, Feishu, Discord, WeCom, WeChat, GitHub, Buzz/Nostr) with run policies, dedupe stores, connection identity, and a message bus/manager.
backend/app/scheduler + app/mcp_tasks + app/subagent_batches
Cron-driven scheduled task service, MCP task service, and batched sub-agent run orchestration services layered on the gateway.
frontend (Next.js app)
React 19 chat/workbench UI with CodeMirror editors, streaming markdown rendering (streamdown/rehype-sanitize), TanStack Query, and same-origin /api/* proxying to the gateway; includes Better Auth-based login/setup pages.
skills/public + contracts/
Markdown-defined extensible agent skills (deep-research, data-analysis, image-generation, etc.) and JSON-schema contracts governing run event streams, slash skills, subagent status, and skill review.
docker/ + deploy/helm
Deployment packaging: multi-variant docker-compose stacks, backend/frontend Dockerfiles, nginx reverse-proxy configs, Lark CLI broker/init sidecars, and a Helm chart for Kubernetes.
The team added read-only RAGFlow knowledge retrieval, branched conversation support, and a unified capacity system for managed subagents, alongside a broad sweep of stability fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
The team added read-only RAGFlow knowledge retrieval, branched conversation support, and a unified capacity system for managed subagents, alongside a broad sweep of stability fixes.
Week of 2026-08-17
A large week focused on durability and integrations: deterministic tool receipts, per-user MCP credentials, a hybrid memory eviction policy, and the OpenSandbox provider all landed.
Week of 2026-08-10
The busiest week brought a Honcho user-model memory backend, durable MCP task drivers, gateway extension points, and extensive resource-bounding fixes across sandboxes and channels.
Week of 2026-08-03
Integrations and foundations dominated: Lark credential switching, a new Buzz (Nostr) channel connector, durable MCP task runtime groundwork, and a middleware plugin foundation.
Week of 2026-07-27
A massive 100-commit week delivered authorization enforcement at the gateway, inline artifact editing, real-time context window usage display, and dozens of fixes across memory, sandboxes, and the frontend.
Over the past month, DeerFlow's development has centered on making the agent platform more robust and multi-user ready: durable background task execution, managed subagents with delegation scopes, and new memory backends (Honcho) and sandbox providers (OpenSandbox). A parallel thread of work hardened the system for real-world deployments — authorization enforcement at the gateway, Docker startup resilience, bounded resource use on E2B sandboxes, and many fixes to streaming, artifacts, and channel connectors (Buzz/Nostr, Lark, DingTalk, Discord). The most recent week shifted toward knowledge retrieval (read-only RAGFlow), branched conversations, and unified subagent capacity management.
Week by week
2026-08-24The team added read-only RAGFlow knowledge retrieval, branched conversation support, and a unified capacity system for managed subagents, alongside a broad sweep of stability fixes.latest6 changes
Feature
Read-only RAGFlow retrieval
The knowledge feature can now pull information from RAGFlow in read-only mode, expanding the external knowledge sources the agent can search.
Feature
Branched conversations
Threads can now be distinguished when conversations branch off from earlier points, so side explorations stay organized.
Feature
Unified subagent capacity and batch execution
Managed subagents now share a single capacity limit and can run reliably in durable batches, preventing overload.
Fix
Docker starts without .env file
Starting the app with Docker no longer aborts just because an environment configuration file is missing.
Fix
Exact history attribution preserved
Chat history now correctly attributes messages to their authors even when the conversation exceeds page-size limits.
Fix
Scheduled tasks queue instead of dropping
Scheduled runs that fire while busy are now enqueued rather than lost.
2026-08-17A large week focused on durability and integrations: deterministic tool receipts, per-user MCP credentials, a hybrid memory eviction policy, and the OpenSandbox provider all landed.6 changes
Feature
Deterministic tool receipts ledger
Every tool call now produces a verifiable receipt recorded in a model-visible ledger, so results can't silently change between steps.
Feature
Per-user MCP credential injection
Shared MCP servers can now inject each user's own credentials, keeping access personal even on shared tools.
Feature
Hybrid fact eviction policy for memory
Long-term memory now uses a smarter policy to decide which stored facts to drop when space runs out.
Feature
OpenSandbox provider
A new sandbox provider option lets deployments run code in OpenSandbox environments as an alternative to existing providers.
Fix
Summarization keeps current user message
Conversation summarization no longer compresses away the user's latest message, so the agent always sees what was just asked.
Fix
MiniMax Code as native ACP agent
MiniMax Code is now integrated as a first-class agent option in the harness.
2026-08-10The busiest week brought a Honcho user-model memory backend, durable MCP task drivers, gateway extension points, and extensive resource-bounding fixes across sandboxes and channels.6 changes
Feature
Honcho memory backend
A new memory provider called Honcho stores a model of each user, letting the agent remember preferences and context across sessions.
Feature
Gateway extension contribution points
Extensions can now plug into the gateway and be packaged and managed directly by the platform.
Feature
Ordinary durable MCP task driver
Long-running MCP tasks gained a durable driver so they survive interruptions and report status reliably.
Fix
Safe multi-instance scheduler recovery
Running multiple scheduler instances is now safe — recovery won't double-launch or corrupt scheduled work.
Fix
Bounded E2B mount uploads
File uploads to E2B sandboxes are now capped in resource use, preventing runaway memory or bandwidth consumption.
Refactor
JPEG browser progress frames
Live browser preview frames are encoded as JPEG, making screen sharing during agent runs lighter and faster.
2026-08-03Integrations and foundations dominated: Lark credential switching, a new Buzz (Nostr) channel connector, durable MCP task runtime groundwork, and a middleware plugin foundation.6 changes
Feature
Lark app credential switching
Teams using Lark can now switch between different app credentials without redeploying.
Feature
Buzz (Nostr) channel connector
DeerFlow agents can now chat through the decentralized Nostr network via a new connector called Buzz.
Feature
Middleware plugin foundation
A new extension point lets plugins intercept and modify how the agent processes requests.
Feature
Browser Live in custom agent chats
Custom agent chats now support live browser viewing, matching capabilities previously limited to other surfaces.
Refactor
Official OpenViking adapter
Memory storage switched to the officially supported OpenViking adapter for better long-term compatibility.
Fix
Dependency security bumps
Several backend and frontend libraries (cryptography, aiohttp, postcss, h2) were upgraded to patch security issues.
2026-07-27A massive 100-commit week delivered authorization enforcement at the gateway, inline artifact editing, real-time context window usage display, and dozens of fixes across memory, sandboxes, and the frontend.6 changes
Feature
Model authorization enforced end-to-end
The platform now checks permissions on which AI models each request may use, both at the API gateway and inside the runtime.
Feature
Inline artifact editing
Text documents produced by the agent can now be edited directly in the side panel instead of only being viewed.
Feature
Real-time context window usage
Users can now see how much of the AI's context window is being consumed as a conversation grows.
Feature
Per-server MCP tool name prefixes
When multiple MCP servers offer similarly named tools, each server's tools get distinct prefixes to avoid collisions.
Fix
Deployment-wide E2B capacity limits
E2B sandbox usage is now capped across the whole deployment rather than per-request, protecting infrastructure from overload.
Fix
Loopback-bound Docker port
The published Docker port now binds to localhost by default, closing an accidental public-exposure risk.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required