DeerFlow

DeerFlow is ByteDance’s open-source long-horizon SuperAgent harness. DeerFlow 2.0 is no longer only a Deep Research framework; it is positioned as a runtime/harness for agents that can research, code, create, and execute complex tasks with agent-frameworks-cn-im, skills, tools, sub-agents, memory, sandboxing, MCP, and IM gateways.

Key facts

• Repository: bytedance/deer-flow
• License: MIT
• Observed scale on 2026-08-24: ~80.7k stars, ~11.1k forks, 519 open issues, 399 open PRs
• Core architecture: LangGraph / LangChain based lead agent plus Gateway API
• Core capabilities: sandbox execution (Docker, K8s, local, E2B, OpenSandbox), persistent memory, skills, MCP, file system, web browsing/crawling, sub-agents, extensions, and IM channels
• Latest release: v2.0.0 (2026-06-25, 182 merged PRs)
• Next milestone: 2.1.0 (48 open / 558 closed, ~92.1% — nearing completion)
• Future milestone: 2.2.0 (0 open / 0 closed — created, not yet populated)

IM channel support

Evidence from README, config, and code:

Channel	Status	Evidence
Feishu / Lark	✅ Stable	feishu.py + README + config; domain config option added (PR #1535, merged 2026-03-30); thread continuity fix (#3285); card update throttling + thread topic fix (#3810, merged 2026-06-27)
WeCom / 企业微信	✅ Stable	wecom.py + README + config
WeChat / 微信	✅ Merged	wechat.py via Tencent iLink (ClawBot) protocol (PR #1869, merged)
Telegram	✅ Stable	telegram.py + README + config; streaming reply via placeholder editing (#3534, 2.0.0)
Slack	✅ Stable	slack.py + README + config
Discord	✅ Merged	discord.py (PR #1806, merged); mention-only mode, thread routing, typing indicators (#2842, 2.0.0)
DingTalk / 钉钉	✅ Merged	dingtalk.py merged (PR #2628, 2026-04-30); Stream Push SDK (WebSocket), no public IP needed; AI Card streaming; 1364-line test suite
Buzz (Nostr)	✅ Merged	buzz.py (PR #4649, merged 2026-08-05); decentralized Nostr protocol channel connector

2.0.0 addition: User-owned IM channel connections — users can bind their own accounts on top of operator-configured bots across all 7 channels (#3487).

Skills and tools

DeerFlow’s Skills are structured capability modules, usually Markdown files that define workflows, best practices, and references. It supports built-in skills, custom skills, .skill packages via Gateway, and progressive loading. Tooling includes web search, web crawl, file operations, bash execution, MCP Server, and Python-function extension.

Public skills include data-analysis (DuckDB-based), chart-visualization, and others. Security hardening ongoing (sandbox input sanitization PR #1872 merged).

2026-05 update: Skills module refactored to unified SkillStorage abstraction (PR #2613, merged). LocalSkillStorage replaces scattered loader/manager/installer modules with a single filesystem-backed interface. SkillsConfig.use enables backend selection. Path traversal hardening via validate_skill_name(). Singleton respects config reloads.

2.0.0 additions:

• Blocking-IO-guard skill for blocking-IO triage and runtime anchors (#3503)
• Maintainer issue and PR workflow skill (#3554)
• Maintainer orchestrator review workflow skill (#3606)
• MiniMax provider for image/video/podcast skills plus music-generation skill (#3437)

Cron / scheduled execution status

Status: SCHEDULED TASKS MVP MERGED! (PR #3898, merged 2026-07-06-07) — This was the #1 deployment blocker.

PR #3898 (feat: add scheduled tasks MVP by fancyboi999, merged by WillemJiang) adds a first-class scheduled-tasks MVP with:

• Schedule types: once (one-time) and cron (cron expression)
• Execution context modes: fresh_thread_per_run (default) and reuse_thread
• Workspace management page: /workspace/scheduled-tasks in the frontend UI
• Manual actions: create, pause, resume, trigger, delete
• Durable persistence: scheduled task + task-run history via models, repositories, and migrations
• Reuses existing Gateway run lifecycle for scheduled executions
• 9,392 additions, 65 files changed across backend and frontend
• Schedule types: Supports standard cron expressions

The two competing older PRs are now effectively superseded:

• **PR 1092 (custom CronService): Still open (45 comments) — no longer needed, #3898 covers this
• **PR 2624 (APScheduler MVP): Still open (2 comments) — superseded by #3898
• Issue #1651 (Feature: built-in Cron Scheduler) — still open, but functionally addressed by #3898

This unblocks ZoOL’s #1 deployment blocker for scheduled skill execution.

Security / Auth / Governance

Merged in v2.0.0:

• 2.0-rc auth module merged into main: JWT + bcrypt authentication, CSRF middleware, request-scoped user contextvar, storage-layer owner isolation (user_id) across threads, runs, events, and feedback.
• Symlink upload rejection (#2623) + Windows safe upload support (#2794)
• MCP sensitive value masking in API responses (#2667)
• MCP config endpoint hardening against malformed input (#3425)
• Cross-site auth POST rejection (#2740)
• Zip-bomb-style decompression cap (#2963)
• Docker socket scoped to aio (DooD) mode only (#3517)
• Host CLI auth dirs unmounted by default (#3521)

Earlier merged security improvements:

• PR #2633 (2026-04-30): Bind local Docker sandbox ports to loopback only
• PR #2651 (2026-04-30): Allow disabling API docs in production via GATEWAY_ENABLE_DOCS
• PR #2623 (2026-05-02): Reject symlinked upload destinations (path traversal hardening)

Active RFC discussions (not yet implemented):

• RFC #2470 (2026-04-20): Pluggable auth providers with authenticate_request() hook. Proposes TrustedHeaderAuthProvider for SSO/reverse-proxy integration with mandatory CIDR-based trusted_networks validation.
• RFC #2471 (2026-04-20): Multi-replica deployment infrastructure — Redis Stream Bridge, pluggable memory backends (PG/Mongo), thread mapping, model runtime counters.
• RFC #2099: Cryptographic integrity (Ed25519 receipt signing) for persistence layer and MCP config.

Known auth bugs:

• Issue #2902: Service restart on latest main causes persistent 429 errors during login FIXED by PR #2915 (merged 2026-05-16), replaced 429 rate limit with per-IP cached response

Memory architecture

• RFC #1898: Next-generation Memory architecture analysis. Core conclusion: DeerFlow should define a unified Memory Contract and support multiple providers.
• Memory Module Roadmap (Issue #2450, 2026-04-28): 7 critical problems (P1–P7) identified. Proposed 4-wave implementation: Wave 1 (Write Correctness — SQLite backend), Wave 2 (Measurability), Wave 3 (Query-aware scoring), Wave 4 (Normalized fact tables + declarative schema).
• PR #3252 merged: fix(memory): parse wrapped memory update json responses
• 2.0.0 additions: memory.token_counting config to opt out of tiktoken for network-restricted deployments (#3465); memory queued updates isolated by agent (#2941)
• 🚀 2026-08-07: OpenViking adapter merged (#4707) — refactor(memory): use official OpenViking adapter. This is the first implementation of a pluggable memory backend under the unified Memory Contract. OpenViking is the official memory provider; the adapter replaces custom memory handling with the standardized OpenViking interface.
• 🚀 2026-08-12: Honcho backend merged (#4730) — feat(memory): add Honcho backend (user-model memory provider, 用户画像 + 长期偏好建模，+1042 行)。RFC #1898 统一 Memory Contract 的第二个可插拔 backend，在既有 MemoryManager 契约后接入。
• 🚀 2026-08-11: OpenViking tools integration merged (#4745) — feat(mcp): add official OpenViking tools integration。OpenViking 从「memory backend」扩展到「MCP tools」路径（/mcp Streamable HTTP endpoint，owner-bound USER API key，暴露 forget tool）。
• 2026-08-17: hybrid fact eviction policy merged (#4789) — feat(memory): add hybrid fact eviction policy。
• In-progress: cognitiveStyle for collaboration preferences (#3182, XL PR, under review)
• Memory Contract 现已有 2 个可插拔 backend（OpenViking + Honcho）落地 main；多 backend 并行（DeerMem 仍为默认）。

Persistence layer

• Unified SQLite (deerflow.db, WAL mode) or PostgreSQL backend with ORM (SQLAlchemy 2.0)
• Event store, feedback repository, and token tracking
• Storage-layer owner isolation (user_id) across all data entities
• PR #3226 merged: fix(checkpointer): use AsyncConnectionPool for postgres to prevent stale connection errors
• 2.0.0 additions: Cache Base.to_dict column reflection per class (#3654); timezone-aware timestamps from SQLite (#3130); emit timezone-aware timestamps

Embedded client

• DeerFlowClient Python library for in-process access without running HTTP services
• 2.0.0 addition: Hermes-like TUI terminal workbench (deerflow CLI) backed by DeerFlowClient (#3760)

Observability

• Built-in LangSmith and Langfuse tracing support
• 2.0.0 additions: Trace name set to lead_agent for cleaner traces (#3101); subagent spans attributed to parent thread’s Langfuse trace (#3611); session_id and user_id propagated into Langfuse traces (#2944)
• 2026-07: Monocle observability (#4024) — agent observability with Monocle integration added; third tracing backend alongside LangSmith and Langfuse

Milestone progress

v2.0.0 — RELEASED 2026-06-15

Closed with 182 merged PRs since first 2.0 milestone tag.

Breaking change: Run hydration from RunStore; interrupted status persists. Cancellation requires the owning worker; cross-worker cancels return 409 (#2932).

Key highlights:

• Custom agents that update themselves (SOUL.md / config.yaml persistence, per-user isolation) (#2713)
• User-owned IM channel connections across all 7 channels (#3487)
• StepFun reasoning model adapter (#3461), MiMo reasoning support (#3298), MiniMax provider (#3437)
• Brave Search (#3528), SearXNG (#3451), Browserless (#3451), Serper Google Images (#3575)
• Loop detection configurable with per-tool frequency overrides (#2586, #2711)
• Subagent token usage streaming to header (#2882)
• Performance: SQL pushdown for thread metadata (#2865), index runs by thread_id (#3499), index messages (#3531)

2.1.0 milestone — IN PROGRESS (nearing completion)

Date	Completion	Open	Closed	Total
2026-07-13	~77%	61	206	267
2026-08-08	~91.7%	43	474	517
2026-08-24	~92.1%	48	558	606

Recent 2.1.0 merges (since July 13):

• #4707: refactor(memory): use official OpenViking adapter — 🚀 Memory contract implementation
• #4719: feat(frontend): add Browser Live to Custom Agent chats
• #4649: feat(channels): add Buzz (Nostr) channel connector — 8th IM channel
• #4658: fix(docker): set DEER_FLOW_ROOT for log commands
• #4622: perf(frontend): bound delivery, bundles, and long-running UI work
• #4575: fix(sandbox): enforce deployment-wide E2B capacity
• #4398: feat(skill): add first-principles system change workflow
• #4342: fix(run): add run event stream contract
• #4024: feat(trace): add agent observability with Monocle
• #4083: fix: MCP bring-up timeout and externalized tool outputs
• Earlier (already tracked): #3898 (scheduled tasks MVP), #4036 (voice dictation), #4037 (skill review quality gate), #4049 (subagent task cards), #4050 (nightly CI), #4023 (memory tool sets), #4126 (About page version), #4112 (architecture diagrams), #4084 (MCP OAuth priming), #4073 (memory busy-spin fix), #4071 (stream_exists), #4067 (guardrails empty allowlist), #4099 (prompt-injection hardening), #4119 (html-escape injection), #4125 (h3 CVE upgrade), #4096 (disabled skills exposure), #4085 (streaming delta-discard), #4069 (WeCom null quote)

Recent 2.1.0 merges (since Aug 8):

• #4868: feat(mcp): per-user credential injection for shared MCP servers — 🚀 解决 #3322 MCP per-user credential isolation 长期 gap
• #4730: feat(memory): add Honcho backend — 🚀 第 2 个 Memory Contract backend
• #4745: feat(mcp): add official OpenViking tools integration — OpenViking 扩展到 tools 路径
• #4877: feat(sandbox): add OpenSandbox provider — 第 5 个 sandbox provider
• #4780: feat(extensions): gateway contribution points + packaged extension management — 扩展系统打包分发（+7565 行）
• #4846: feat: integrate MiniMax Code as a native ACP agent
• #4665 / #4690 / #4833: MCP durable task runtime（foundation + driver + notifications/chat UI）
• #4659: feat(harness): deterministic tool receipts with model-visible ledger（RFC #4651）
• #4848: feat(scheduler): scheduled-run recursion_limit 可配置 + #4785（timestamp 序列化）+ #4713（多实例恢复）
• #4789: feat(memory): hybrid fact eviction policy
• #4797: feat(subagents): isolated date-only context
• #4763: Docs/add chinese readme — README_zh.md 上线
• #4703: feat(integrations): support switching Lark app credentials
• 渠道修复：#4903（Feishu 入站附件）、#4815（Telegram eventloop）、#4762（WeCom websocket）、#4752（Discord typing）、#4724（DingTalk mentions）、#4888（Buzz seen-id store）
• 安全/健壮性：#4827（gateway reads 鉴权）、#4830/#4825（skills namespace fail-closed / copy 替代 hardlink）、#4823/#4783（memory 参数校验）、#4842/#4812（E2B upload 限界）、#4769（并发 run 预算）、#4882/#4939（summarization 保留 user message）、#4836（browser JPEG 帧）

2.2.0 milestone — CREATED (not yet active)

Date	Completion	Open	Closed	Total
2026-07-13	0%	0	0	0

Weekly merged PRs (Jun 8–Jun 29): ~30+ PRs

Key merged PRs this cycle:

• #3760: feat(tui): Hermes-like terminal workbench backed by DeerFlowClient (2.1.0)
• #3809: refactor(middlewares): declarative layered builder; reorder ThreadData before Uploads (2.1.0)
• #3810: fix(feishu): stop creating thread topics and throttle card updates (2.1.0)
• #3826: fix(frontend): preserve messages across context summarization (2.1.0)
• #3828: fix: reap macOS nginx processes on stop (2.1.0)
• #3844: fix(auth): fix auth setup redirects in partial setup state
• #3854: fix(frontend): retain presented artifacts in header dropdown (2.1.0)
• #3780: fix: ignore middleware prompts in run journal input
• #3772: fix(mcp): isolate tool discovery failures per server (2.1.0)
• #3770: docs: adopt AGENTS.md as source of truth + refresh module guides (2.1.0)

Previously tracked issues now resolved

• **P0 3352: 压缩上下文后前端渲染顺序乱套 — CLOSED 2026-06-03
• #3189: write_file 流式超时/断连 — CLOSED via #3195 (merged 2026-06-07)
• #3146: structured subtask status — CLOSED via #3154 (merged 2026-06-07)
• #3144: config reload boundary — CLOSED via #3153 (merged 2026-06-07)
• #2503: phantom stream messages — CLOSED via #3378 (merged 2026-06-07)
• #3373: psycopg_pool.PoolClosed — CLOSED via #3381 (merged 2026-06-07)
• #2902: auth 429 login errors — CLOSED via #2915 (merged 2026-05-16)

Fit for ZoOL’s enterprise AI assistant research

DeerFlow is a strong candidate when the priority is a capable long-horizon agent runtime with sandbox, skills, memory, sub-agents, and Feishu/WeCom/WeChat/DingTalk IM entrypoints.

Key gaps for ZoOL’s scenario:

1. Cron/Scheduler — ✅ RESOLVED! PR #3898 (scheduled tasks MVP) merged 2026-07-06/07. Supports cron and once schedules, workspace management page, durable persistence. This was the #1 deployment blocker and is now closed.
2. Security/Auth — JWT+bcrypt+CSRF+user isolation merged; 429 login bug fixed; pluggable auth RFCs still draft; MCP per-user credential injection merged (#4868) — resolves #3322; fine-grained RBAC (#3462) still open
3. Memory — 🚀 2 个 Memory Contract backend 落地（OpenViking #4707 + Honcho #4730）；OpenViking tools (#4745)；hybrid fact eviction (#4789)；cognitiveStyle PR (#3182) under review
4. Known bugs — sandbox E2B capacity enforced (#4575); MCP bring-up timeout (#4083); Lark CLI lock fix (#4701); frontend performance bounds (#4622); summarization user-message preservation (#4882)

Positive signals this cycle (Aug 9–Aug 24):

• 🚀 MCP per-user credential injection MERGED (#4868) — #2 长期 gap（#3322）关闭，shared MCP server 支持多用户各自 credential
• 🚀 第 2 个 Memory Contract backend 落地：Honcho (#4730) + OpenViking tools (#4745)
• 🚀 第 5 个 sandbox provider：OpenSandbox (#4877)
• 🚀 Extensions 系统打包分发 + gateway 贡献点 (#4780) — 7565 行扩展能力
• 🚀 MiniMax Code 原生 ACP agent (#4846)
• 🚀 MCP durable task runtime（#4665/#4690/#4833）
• 🚀 中文 README 上线 (#4763) — 中国企业部署友好
• Stars: 80.7k（up from 79.5k, +1.2k — 稳定增长）
• 2.1.0 milestone: 91.7% → 92.1%（48 open / 558 closed）
• 渠道修复密集： Feishu/Telegram/WeCom/Discord/DingTalk/Buzz 六渠道各有关键 fix

Watchlist

• ✅ Cron scheduler: RESOLVED — PR #3898 merged (scheduled tasks MVP)；+ scheduler 硬化（#4848 recursion_limit 可配置、#4713 多实例恢复）
• ✅ Memory contract: 2 backend 落地 — OpenViking adapter (#4707, 08-07) + Honcho backend (#4730, 08-12) + OpenViking tools (#4745)
• ✅ MCP per-user credential isolation (#3322): RESOLVED — PR #4868 (per-user credential injection) merged 2026-08-23
• ✅ 2.1.0 milestone: 48 open / 558 closed (~92.1%) — near completion; expect release soon
• 2.2.0 milestone — created but empty; scope not yet defined; watch for population
• Memory: cognitiveStyle (#3182) — collaboration preferences, XL PR under review
• Pluggable auth RFCs (#2470, #2471) — still draft, no merged implementation
• Fine-grained RBAC (#3462) — open for 2.1.0, no PR yet
• Extensions system — packaged extension management + gateway contribution points (#4780, #4684, #4863) landed
• MCP durable task runtime — foundation + driver + notifications/chat UI (#4665/#4690/#4833) landed
• Enterprise security hardening — sandbox E2B capacity (#4575), file boundary hardening (#2636) in progress
• Layered architecture refactoring (#2429) — still open, major restructuring
• SkillScan safety scanning (#2634) — RFC, no implementation
• Sandbox memory usage — #3213 raised concern about ~1GB per sandbox instance, still open

Related pages

• agent-frameworks-cn-im — comparison of China enterprise IM agent frameworks.