Does my code get uploaded anywhere?

The agent loop, your files, and your project memory stay on your machine, and your API key never leaves the app. What an agent puts in a prompt does go to DeepSeek, under your own key — that's how any hosted model works. The difference is that there is no AutoCoder server in between, so we never see your code or your key.

What will this actually cost me per month?

Two things, and you should count both: the subscription (₹0 on the free tier for 50 queries, ₹899/month for unlimited) plus your own DeepSeek token spend, billed directly by DeepSeek at their rates. A typical task on V4 Flash lands in the low single-digit cents. Run /total_cost in Telegram at any time for the running total.

Do I have to leave my computer on?

Yes — and awake. AutoCoder runs the orchestrator in-process on your desktop; Telegram is the remote control, not the runtime. Tasks you send from your phone queue on that machine and execute there, so if it sleeps or you shut the lid, the run pauses until it wakes. Before scheduling anything overnight, set the machine not to sleep. That's the honest trade for keeping your code and your key local — there is no cloud runtime to fall back on.

Which platforms are supported?

Windows desktop today, via the Microsoft Store. It's a young project — if you're on macOS or Linux, the honest answer is "not yet."

Do I need my own DeepSeek API key?

Yes — it's required, not optional. You paste it into the app once and pay DeepSeek list price directly. We don't resell tokens, bundle credits, or take a cut, which is why there's no markup to explain.

What happens when an agent gets it wrong?

Two of the five agents exist for exactly that: the Verifier runs typechecks, tests, and local Semgrep packs and loops back on failures, and the Reviewer produces line-level findings with severity levels. You still get a grouped diff to read before anything ships. And /cancel stops a running task from your phone.

Can I keep it from doing things I don't want?

Persistent project rules live alongside the repo and are re-read on every task, so conventions stick without repeating them in each prompt. You also control the thinking budget — how many tokens the model may spend reasoning — and whether a task runs on all five agents or just one.

The reviewer emits structured JSON with per-line annotations, severities, and fix suggestions, which GitHub Actions, GitLab CI, and Jenkins parse natively. Scheduled tasks can create or update a PR with a grouped diff when they finish.

Why not just use Claude Code or Cursor?

Often you should. They're pair programmers — excellent when you're at the keyboard, reviewing as you go, with stronger models behind them. AutoCoder is for the other case: work you want to hand off entirely. If you want to be in the loop on every edit, use theirs. If you want the work done while you're doing something else, use ours.

Is the 6-digit access key safe?

It rotates every 7 days automatically, and you can force a new one at any time with /access_key. It authenticates your desktop app to your own Telegram account — it is not your DeepSeek key, which never leaves your machine.

Can I write prompts in a language other than English?

Yes — prefix a prompt with @regional and you'll get research-backed answers in 22 Indian languages, at the same price as English. No surcharge, no separate tier.

Back to AutoCoder.dev

What leaves your machine, and what doesn't

You're being asked to give an unfamiliar binary access to your filesystem and an API key. That deserves a straight answer rather than a trust badge, so here is the actual architecture — including the parts that are less flattering than the marketing version.

The agent loop runs on your machine

Discovery, planning, execution, verification, and review all run in-process on your desktop. Your files and your project memory never move. Telegram is the remote control, not the runtime — which is also why the machine has to stay awake for a task to finish.

There is no AutoCoder server in between

We do not proxy your requests, and there is no backend of ours holding your code. This is the honest version of the claim: prompt context does go to DeepSeek's API under your own key, because that is how any hosted model works. What we can say precisely is that we never see your code, your prompts, or your key.

Your DeepSeek key stays local

You paste it into the desktop app once and it is stored on that machine. It is never transmitted to us, and we never resell tokens or take a cut — DeepSeek bills you directly at list price. If we were routing your traffic, we would have to explain a markup. We don't, so there isn't one.

The 6-digit access key rotates every 7 days

That key authenticates your desktop app to your own Telegram account. It rotates automatically on a 7-day cycle, and /access_key forces a new one immediately if you think it has leaked. It is not your DeepSeek key and grants no access to it.

Security scanning happens locally

The Verifier runs Semgrep across three rule packs — secrets, OWASP Top 10, and security-audit — on your machine. Findings never leave it. The Reviewer's structured JSON output is yours to pipe into CI or ignore.

You control the blast radius

Persistent project rules sit alongside the repo and are re-read on every task, so you can constrain what an agent is allowed to touch without restating it each time. /cancel stops a running task from your phone, and every change comes back as a grouped diff to read before anything ships.

Reporting a vulnerability

Email support@autocoder.dev with steps to reproduce. We'll acknowledge within two business days. It's a young project and we would much rather hear it from you than read about it somewhere else.

See also the privacy policy and the FAQ.