DeerFlow

Quick Verdict

DeerFlow is a strong candidate for engineering teams that want to self-host one agent runtime for deep research, coding, file-based creation, and multi-agent work that can last from minutes to hours. The active product is DeerFlow 2.0, a ground-up rewrite that shares no code with version 1. The earlier deep-research implementation remains on the main-1.x branch, so an existing v1 deployment should be treated as a migration rather than a routine upgrade.

As of July 21, 2026, the official repository was receiving same-day updates and its documentation covered setup, production sizing, persistence, tracing, and deployment safety. That is a better maintenance signal than a frozen popularity count. DeerFlow is MIT-licensed software, not a managed DeerFlow cloud subscription: users choose and pay for their own models, search providers, databases, compute, and observability. Its sandbox and tool policies reduce exposure when configured correctly, but neither is a guarantee that an autonomous run is safe or correct.

Best For

• Platform teams building internal research, repository analysis, report generation, or artifact-producing agents.
• Developers comfortable with Python 3.12+, Node.js 22+, Docker, model APIs, and production operations.
• Teams that need subagent delegation, custom skills, MCP tools, persistent memory, and trace inspection in one runtime.
• Organizations that prefer source access and self-hosting over a closed, fully managed agent service.
• It is not ideal for users who want a zero-setup web app, cannot review tool actions, or lack a policy for secrets, data retention, and destructive operations.

Key Features

• Research and coding in one harness: Web retrieval, file operations, optional shell execution, and artifact generation support reports, code, web pages, and presentations.
• Subagent orchestration: A lead agent can decompose work, run delegated agents with scoped contexts, and synthesize their results.
• Extensible skills and tools: Skills load progressively, while Python tools and MCP servers extend the runtime. Skill tool policies are useful behavioral controls, but the official docs do not present them as a hard security boundary.
• Long-task context management: Summaries, filesystem offloading, manual compaction, and long-term memory keep intermediate work from consuming the entire context window.
• Multiple execution modes: Local execution, Docker containers, and a Kubernetes provisioner are supported. The all-in-one sandbox can expose browser, filesystem, and shell capabilities.
• Deployment and tracing: Docker development, production Compose, persistent SQLite or PostgreSQL, and integrations with LangSmith, Langfuse, and Monocle are documented.
• Operational controls: Configuration includes execution preferences and subagent caps, while production guidance covers exact CORS origins, authentication, proxies, and gateway ownership limits.

Use Cases

DeerFlow fits a research pipeline that searches several sources, stores evidence, delegates verification, and produces a cited report. It can also inspect a repository, modify files, run checks, and create a deliverable in one workspace. Other practical uses include assembling slide decks, generating a small website from researched material, or coordinating specialist subagents around one completion goal.

Long tasks should be designed as reviewable stages. Persist research before synthesis, generate a diff before applying code changes, and place deployment behind a separate approval. Content retrieved from the web is untrusted because a page can contain prompt-injection instructions. Use a domain allowlist, prevent page text from changing system rules, and never let browsing content request secrets or broader tool access. Give each run a temporary workspace and task-scoped credentials. Deletion, publishing, payments, messages, purchases, and form submission should always stop for explicit human confirmation.

Pricing

DeerFlow 2.0 is available under the MIT license and has no publicly listed official managed-cloud plan. Self-hosting therefore has no software subscription fee, but it still incurs model tokens, search or crawling API charges, storage, database, logging, container compute, and engineering time. The official deployment guide suggests starting a persistent server at 8 vCPU, 16 GB RAM, and 40 GB of free SSD, with 16 vCPU and 32 GB RAM recommended for heavier shared use. A locally hosted model requires separate capacity.

Before production, cap the maximum number of subagents, concurrent runs, search calls, elapsed time, and model tokens per run. Add a budget stop rather than trusting the model to economize. Retries must use idempotency keys or checkpoints around external writes, otherwise a resumed run may send the same message, create the same record, or incur the same paid API call twice.

Pros

• Combines research, coding, content creation, files, memory, and subagents in a coherent runtime.
• Clear MIT license and public source support modification and private deployment.
• Provides more long-horizon infrastructure than a basic agent loop, including context compaction and artifacts.
• Supports multiple model providers and several tracing backends.
• Official documentation gives concrete production sizing and warns about unsafe host-shell execution.
• Same-day repository activity on the review date indicates active maintenance without relying on star counts.

Cons

• Version 2 is incompatible with version 1 and requires deliberate migration testing.
• There is no official managed DeerFlow price or SLA; operators own availability, backups, and upgrades.
• Long, parallel runs can amplify model, search, storage, and retry costs quickly.
• Local execution is not secure isolation, and a container sandbox cannot eliminate kernel, mount, network, exfiltration, or agent-action risk.
• The stack is operationally heavy for nontechnical users and includes a gateway, frontend, database, model providers, and optional tracing systems.
• Traces can capture prompts, tool arguments, and responses, creating an additional sensitive-data store to govern.

Alternatives

FAQ

How is DeerFlow 2.0 related to the original project?

It is a ground-up rewrite with no shared v1 code. The original deep-research framework is maintained on main-1.x, so validate configurations, tools, and stored data before migrating.

Does DeerFlow have an official cloud price?

No public managed DeerFlow cloud plan was listed as of July 21, 2026. The software is free under MIT, while models, search, servers, databases, and monitoring are paid separately.

Does the sandbox make agent execution safe?

No. It narrows part of the blast radius. Production still needs least privilege, read-only mounts where possible, network allowlists, temporary credentials, resource limits, audit logs, and confirmation for high-impact actions.

How should a team control long-task cost?

Set limits for subagent count, concurrency, model tier, tokens, searches, and wall-clock duration. Track spend by run and stop at a defined budget threshold instead of allowing indefinite autonomous continuation.

How should DeerFlow handle prompt injection from websites?

Treat retrieved content as data, not instructions. Restrict domains and tools, isolate browser credentials, prevent content from requesting secrets, and require approval before login, upload, submission, purchase, or payment.

Should DeerFlow operate directly against production systems?

Not by default. Start with temporary repositories, test accounts, and isolated environments. Put releases, database writes, deletions, and external notifications behind separate approval gates.

Bottom Line

DeerFlow 2.0 is compelling when a team wants an extensible, self-hosted harness rather than another chat interface. Its integrated subagents, files, memory, skills, sandbox options, and tracing make it suitable for serious research and coding workflows. The decision should depend on a real pilot: measure task completion, human interventions, trace quality, peak resources, and total model plus infrastructure cost. Expand usage only after domain restrictions, credential isolation, budget caps, idempotent retries, and human confirmation are working in practice.