Overview
CodeBuddy is a LangGraph deep-agent coding assistant that runs in your editor. It plans, edits code, runs your terminal, and stops at every risky boundary to ask.
Built on deepagentsjs. Runs in VS Code 1.78+, Cursor, Windsurf, VSCodium, and any editor that speaks the VS Code extension API.
What it does
Section titled “What it does”- Plans — decomposes tasks with the
write_todostool and delegates specialist work to 9 subagents (code-analyzer,debugger,architect,tester,reviewer, and others). - Edits code — 27+ built-in tools for reading, writing, grepping, refactoring, and diff-review-gated changes.
- Runs your stack — terminal execution (with modal approval), test runners, browser automation, DAP debugging.
- Connects out — Model Context Protocol (MCP) for external tools; 16 pre-built skills (GitHub, Jira, AWS, Postgres, Redis, Datadog, Kubernetes, Sentry, Linear, and more).
- Recovers on its own — provider failover, stream retry, agent safety limits (15000 events / 2000 tool calls / 60 min), context compaction.
Providers
Section titled “Providers”Anthropic, OpenAI, Google Gemini, Groq, DeepSeek, xAI Grok, Qwen, GLM — plus any local endpoint (Ollama, LM Studio, Docker, OpenRouter). Switch providers in Settings; no reinstall.
Security posture
Section titled “Security posture”- Modal approval on every LLM-issued shell command, MCP server launch, file delete, and skill install.
- Path-traversal guards on every LLM-controlled file path (TOCTOU-resistant).
- SSRF blocklist on outbound HTTP; DNS-rebinding pinning on OTLP telemetry.
- QuickJS sandbox for user-authored scripts (predicates, transforms, slash commands).
- Three permission profiles —
restricted,standard,trusted— with catastrophic-command denies enforced across all three.
See Security for the full model.
Install
Section titled “Install”| Editor | Source |
|---|---|
| VS Code | Marketplace |
| Cursor | Marketplace |
| Windsurf | Marketplace |
| VSCodium | Open VSX |
| Codespaces | Marketplace (extension auto-installs from the extensions section of the devcontainer) |
Requires Node.js 18+ (for MCP servers) and an API key from at least one supported provider. Docker Desktop optional (for Docker-gateway MCP and local models).
Next: Quickstart — first task in under 5 minutes.