CodeBuddy

A LangGraph deep agent that codes in your editor — bring your own model

CodeBuddy is a LangGraph / deepagents coding agent that runs inside VS Code. Not autocomplete, not a chat box bolted onto a completion API — a real tool-calling agent loop that reads your codebase, edits files, runs commands, queries the language server, searches the web, and reviews its own work, one turn at a time and under your control.

The part most assistants hide: you bring the model. Point CodeBuddy at your own account and keys — Anthropic, Gemini, OpenAI, Groq, DeepSeek, Qwen, GLM, xAI Grok, or a local model — and your prompts and code go to your provider, not ours.

Read the DOCS · Report an issue

Why CodeBuddy

• It's an actual deep agent. Built on LangGraph + deepagents (createDeepAgent) — a genuine plan → act → verify loop with tool calls, subagent fan-out, and middleware. It doesn't just suggest the next line; it does the task and shows its work.
• Bring your own model (BYOK). 9 providers, your keys, stored in your OS keychain — never in settings, never sent to us. Swap models per task; run fully local if you want.
• Your machine, your data. No CodeBuddy backend sits between you and the model. Chat history and indexes live in your workspace under .codebuddy/.
• Security-first by construction. Every LLM-issued shell command and file write goes through a modal approval; every file path is workspace-validated; outbound URLs are SSRF-checked; untrusted code runs only in a QuickJS sandbox.
• Open & extensible. MCP-native, skill system, MIT-licensed

Bring your own model

Select a provider in the onboarding wizard, paste your key (it goes straight to the OS keychain), and go. Supported today:

Multi-model routing lets you send background/subagent work to a cheaper, faster model while the main turn runs on your best one.

What it can do

Understand your code

• Live editor context, lsp_query (hover / definitions / references / signatures), get_diagnostics, search_symbols, fuzzy find_files, and semantic (vector) codebase search.

Change it safely

• AST-aware edits (ast_edit) that replace a named function/class body via tree-sitter, plus string-based edit_file and a multi-file composer. Every write lands in a diff review before it touches disk.

Run things — with a gate

• Execute terminal commands, but anything outside a small safe-prefix list requires a modal approval that shows the full command. No silent shell.

Extend the agent

• MCP servers (stdio + SSE) add tools on demand; skills package repeatable workflows; subagents fan out specialized/parallel work.

Stay in control

• Plan mode (read-only: produce a plan, touch nothing), persistent chat history, per-conversation cost tracking + budget caps, and optional Langfuse/OpenTelemetry observability.

Automate the routine

• Scheduled standups, code-health checks, and dependency reviews.

How it works

VS Code webview (React)  →  BaseWebViewProvider  →  CodeBuddyAgentService
                                                      └─ LangGraph + deepagents loop
                                                         ├─ your chosen LLM (BYOK)
                                                         ├─ tools (edit / terminal / LSP / search / MCP)
                                                         ├─ middleware (memory · skills · tool-hooks · sandbox)
                                                         └─ subagents (dynamic fan-out)

The agent can only touch your editor through an explicit, permission-filtered tool list, wrapped with rate-limiting, dedup, and audit logging.

Getting started

1. Install CodeBuddy from the VS Code Marketplace.
2. Open the CodeBuddy panel — the onboarding wizard walks you through picking a provider and adding your API key (or a local endpoint).
3. Ask it something — "explain how auth flows through this repo", "add a test for OrderService.create", "find and fix the failing lint". Approve any commands or edits it proposes.

Full setup, provider notes, and configuration: DOCS.

Contributing

Contributions are welcome. See CONTRIBUTING.md for setting up the dev environment, the two-harness test split, coding conventions, and the security invariants to respect. Architecture map: CLAUDE.md.

License

MIT License — see LICENSE for details.

Repository · Issues · Docs