DeerFlow: ByteDance's Open-Source Super Agent for Research and Code (GitHub, Scanned)

DeerFlow started as a deep research tool and, with version 2.0, became what ByteDance calls a super agent harness: a lead agent that plans a long task, hands pieces to sub-agents, runs code and shell commands in a sandbox, keeps long-term memory, and reaches for skills when a job calls for them. You give it a goal such as a market report, a slide deck, a small web app or a data analysis, and it works through it in a web interface on localhost, with the files it produced left in a workspace you can download.

Around that core it has a lot of the plumbing people otherwise build themselves: web search through several providers, browser control, MCP servers, a RAGFlow connector for private documents, scheduled tasks, projects with their own instructions, a terminal interface, and bots for Slack, Telegram, Feishu and other chat apps. It works with any OpenAI-compatible model; the README recommends long-context models with strong tool use and points to ByteDance's own Doubao models, DeepSeek and Kimi.

Version 2.0 was a ground-up rewrite that took the top spot on GitHub Trending in February 2026, and the project has kept up a very fast pace since: about 84,100 stars, 573 contributors and release v2.1.0 when scanned. It is MIT-licensed, Python on the back end and Next.js on the front.

• Repository: github.com/bytedance/deer-flow
• Licence: MIT (MIT License)
• Language: Python. Stars: 84.1K. Forks: 11.7K. Last push: Oct 19, 2026.
• Scan: safe, Oct 19, 2026, commit fee0cd0

Who it is for

Developers and technical teams who want a self-hosted agent for multi-step research, analysis and building tasks, and who are comfortable running Docker and supplying their own model API keys.

Getting started

1. Clone the repository

git clone https://github.com/bytedance/deer-flow.git && cd deer-flow

2. Run the setup wizard (model provider, search, sandbox and safety choices)

make setup

3. Start it with Docker (recommended)

make docker-init && make docker-start

4. Open the web interface

open http://localhost:2026

Needs Docker, or Python 3.12+ and Node.js 22+ for a local run, plus at least 4 CPU cores and 8 GB of RAM. The wizard writes your API keys to a local .env file. The README's suggestion to hand setup to a coding agent works too, but the make commands above are the same steps done by hand.

Safety scan

We cloned bytedance/deer-flow at commit fee0cd0 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The 26 secret hits are fake Slack, GitHub and private-key values in backend tests for its chat-bot credential handling. No committed binaries across 4,139 files and about 1.17 million lines.
• The 50 pattern hits (pipe-to-shell, /dev/tcp, Telegram hosts) are almost all the opposite of a problem: they are the rules in DeerFlow's own sandbox audit middleware and skill scanner, which block commands such as curl | bash, and the tests for those rules. The rest are setup hints printing the uv installer command and a regex that redacts Telegram bot tokens from logs.
• By its own README, DeerFlow can execute system commands and read and write files, and an admin can register MCP servers that run commands on the host. It binds to 127.0.0.1 out of the box and warns against exposing it without an IP allowlist and an authenticating proxy. Leave that default alone unless you know why you are changing it.
• 99 known advisories, none critical: 93 in the Next.js front end's lockfile, mostly build and test tooling (brace-expansion, minimatch, Vite, js-yaml), and 6 moderate ones in the Python back end. None is in Next.js itself.
• The bundled vercel-deploy skill uploads a project to Vercel's claimable-deployment endpoint when you ask it to deploy, the same mechanism as Vercel's own skill. The README also carries a sponsored pitch for ByteDance's Volcengine coding plan; nothing in the code requires it.
• 19 workflows; the one pull_request_target workflow (triage) only labels PRs with github-script and never checks out PR code. 24 of 38 third-party actions are pinned to commits. Licence, security policy, contributing guide and code of conduct present; no Dependabot.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 810.1K, TypeScript 191.6K, Markdown 118.4K, JSON 21.2K, YAML 9,310, HTML 6,150.

Questions

Is DeerFlow free?

Yes. DeerFlow is MIT-licensed and free to self-host. What costs money is the model behind it: you bring an API key for an OpenAI-compatible provider, or point it at a local model, and long agent runs can use a lot of tokens.

How is DeerFlow 2.0 different from the original?

2.0 shares no code with 1.x. The original was a deep research framework; 2.0 is a general agent harness with sub-agents, sandboxes, memory and skills. The 1.x branch is still in the repository for anyone who wants the old research tool.

Can I run DeerFlow with a local model?

It works with any OpenAI-compatible endpoint, so a local server such as Ollama or vLLM can stand in. The README recommends models with long context windows, reasoning and reliable tool calling, which in practice means large models; small local ones tend to struggle with long multi-step tasks.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.