Deep Agents bundles the parts that minimal agents leave to you
A call to create_deep_agent starts with an agent that can plan, manage a long context, delegate work, and use files. Developers can add functions, connect MCP servers, swap the model, select a filesystem backend, persist memory, or place approval in front of tool calls. LangGraph supplies streaming, checkpoints, and execution underneath. That is much more machinery than sending a prompt and one tool list to a chat model.
The bundle makes sense for tasks that span many steps or produce artifacts. A research agent can offload large tool results to disk; a coding agent can assign isolated questions to subagents; an operations assistant can pause before a consequential call. If your application only needs to look up an order and format a response, LangChain's smaller create_agent has fewer moving parts. The README makes that layering explicit rather than claiming every agent needs the full harness.
The 6-second build passed, but pytest collected 0 tests
Our sandbox installed 82 packages in 24 seconds and used 120 MB. Building commit 9bef676 took 6 seconds and succeeded. Pip-audit found 0 known vulnerabilities in the installed Python environment. The test command did not reach the suite: after 39 seconds, pytest exited with code 4 and reported 0 passed, 0 failed, and 0 collected.
The checkout contained 1,542 files, roughly 670,112 source lines, and 59.1 MB. It had 55 CI workflow files, a tests directory, and no Dockerfile. Those repository signals show substantial automation, but our exact environment still failed before collection. A buyer should reproduce the supported development command from the pinned revision instead of treating visible CI volume as proof that any local pytest invocation will work.
What happened when we ran it
Our run installed Deep Agents in 24 seconds and built it in 6 seconds on 3 CPUs with 8 GB of RAM. Installation added 82 packages and occupied 120 MB. The dependency audit returned 0 known vulnerabilities. No error appeared during install or build.
Pytest failed with exit 4 after 39 seconds. Its final message was ERROR: Unknown config option: asyncio_default_fixture_loop_scope, followed by no tests ran in 0.21s. The log does not say which dependency, plugin, or project setting caused that mismatch, so we will not assign one. The measured fact is that no test executed in our Python 3.12 Bookworm image. This is a configuration failure, not evidence that application assertions passed or failed.
The measured CLI path was removed immediately after our commit
At commit 9bef676, our harness detected the project under libs/cli/. Release deepagents==0.7.9, published August 25, 2026, says the deprecated libs/cli package was removed. The current README instead separates the Python deepagents package from Deep Agents Code, a prebuilt terminal agent installed through its own command. Pinning the revision is essential when comparing our lab result with today's tree.
The same release fixed excluded-tool execution, rubric coverage, and timeout documentation, while raising dependency minimums. That is active maintenance and a reminder that interfaces are still moving in the 0.7 series. If you adopt the library, pin Deep Agents, LangChain, LangGraph, model integrations, and checkpoint schema together. Run migrations and stored-thread tests before upgrading a production agent.
Shell and file tools need boundaries the model cannot change
The README's security position is direct: the agent can do anything exposed by its tools, so enforcement belongs in the tool or sandbox layer. A system prompt is not an access-control list. Give the agent a narrow working directory, a disposable execution environment, scoped network access, short-lived credentials, resource limits, and approval for destructive or external actions. Log the requested call and the approved arguments.
Open issue 5589 shows why backend validation also matters. It reports that an empty search string passed to edit_file with replacement enabled can insert text at every character boundary and report success. Issue 4329 describes executed subprocesses opening /dev/tty and competing with the terminal UI for input. Both are specific failure paths around high-authority tools. Sandbox recovery and file snapshots should exist even when the model behaves exactly as asked.
MCP support is useful only with a collision and trust review
Deep Agents can accept tools from MCP servers, which makes external systems available without writing every adapter inside the application. The same convenience expands the naming and security surface. Issue 4666 reports that different server and tool-name pairs can normalize to the same final name, and that an MCP tool can also collide with a built-in filesystem tool. In the reproduction, a later tool silently replaces the earlier one.
Enumerate the final tool set before agent creation, reject duplicate names, and record each tool's server and permissions. Treat project-supplied MCP configuration as code. GitHub showed 28,521 stars, 188 combined issues and pull requests, and a last push on August 26, 2026; v0.7.9 shipped the previous day. Deep Agents is lively and capable. Its value comes with a large authority surface that needs engineering controls beyond the harness itself.