DeepCode

DeepCode runs as the local user and narrows that authority only a little. File tools refuse a short list of credential locations, MCP servers and external sub-agent CLIs get only the environment they are configured with, and a project configuration cannot redirect the user's provider keys. The agent's own shell, code mode and hooks still receive the full parent environment, including provider keys, unless the operator opts into scrubbing, and the agent's own tools are not prevented from changing settings that govern later turns.

New sessions default to an Ask preset: read-only tools run freely and every other built-in, MCP and sub-agent tool call stops for a durable approval that the user can grant once, for the session, or deny. Denials and approver errors fail closed, and the local service only accepts approvals from authenticated clients. In the TUI the prompt shows the tool name and reason with the command clipped to the terminal width and no file diff, a session grant covers every later call of that tool, MCP tools that call themselves read-only and the URL fetcher are never gated, and approval settings can be loosened without an explicit operator decision.

Write, edit and patch tools resolve paths and refuse anything outside the workspace, and the URL fetcher only reaches public addresses on ports 80 and 443 and rechecks every redirect. The shell tool is a raw command string, the read tool accepts any path on the machine, and MCP tools get no shared argument validation. The default tool set includes write, shell and network tools.

Shell commands and code-mode programs run under bubblewrap on Linux or a deny-by-default Seatbelt profile on macOS, with writes limited to the workspace and temporary directories. Network stays open, the whole filesystem is readable and the full environment is passed in. Hooks and MCP stdio servers run directly on the host, commands run unsandboxed when no backend is installed, and sandbox settings can be loosened without an explicit operator decision.

Fetched pages and memory notes are wrapped in labels that mark them as untrusted, and every write, shell or unknown tool waits for approval whatever the agent has read. Nothing tracks what the session has read: reading local files outside the credential denylist and fetching any public URL stay unattended, and the UI shows fetched URLs without their query string. A hijacked session can therefore read local data and send it out without a human, while irreversible changes still need approval.

The memory tool needs approval for every action in the default preset, and the MEMORY.md index is injected inside an untrusted-data boundary that escapes forged tags. Instruction files (AGENTS.md, DEEPCODE.md, CLAUDE.md) from the repository load silently as standing guidance, and project MCP servers, hooks, skills and settings apply once the folder is trusted through a folder-trust prompt. Memory has no expiry or versioning, and poisoned project files persist into every later session in that folder.

No third-party extension is enabled by default: bundled MCP presets are copied in disabled, and project MCP servers load only after the folder is trusted. When enabled, several presets launch unpinned `@latest` packages through npx or uvx, and nothing pins, hashes or re-approves an extension when its code or tool definitions change. MCP stdio servers run on the host with only the environment their configuration names.

Saved provider keys live in a 0600 file in ~/.deepcode (keychain reads are opt-in), the UI never reads them back, configuration views mask credential fields, and provider error messages strip echoed keys. No analytics or crash-reporting SDK is present. The agent's shell and hooks receive every provider key in the environment by default, the LLM log keeps request and response previews, and the MCP log can hold credential arguments, which the project itself notes.

Every tool call is stored as a structured item with its arguments and status in a local SQLite database under ~/.deepcode, outside the workspace, along with approval requests and decisions, and sub-agent transcripts are recorded. Records are written per action in transactions and the session can be replayed. There is no separate actor attribution, no tamper evidence for tool records (an optional hash chain covers only LLM calls) and no standard export.

Ordinary turns have no step limit by default; an iteration cap and Goal token budgets exist but are opt-in. Shell commands time out (120 seconds by default, but the model can choose a longer value), model requests have timeouts, sub-agents are limited to one level and five at once, and stopping a turn kills whole process groups. Repeated identical calls only trigger reminders, and there is no spend cap.