AstrBot connects an AI agent to the chat apps people already use. One instance can answer in Telegram, Discord, Slack, LINE, Mattermost, Misskey, KOOK, QQ, WeChat Work, WeChat Official Accounts, Feishu and DingTalk, with Matrix and others through community adapters. Behind it you choose the model: OpenAI, Anthropic, Gemini, DeepSeek and other APIs, local models through Ollama or LM Studio, or agent platforms such as Dify and Coze.
It goes well beyond a chat relay: personas, a knowledge base, MCP tools and skills, automatic context compression, speech-to-text and text-to-speech, a web dashboard for configuration, a web chat interface, and a sandbox for running the agent's code and shell commands in isolation. A plugin market lists more than 1,000 community plugins that install from the dashboard.
It is AGPL-3.0, with about 43,700 stars, 381 contributors and frequent releases, at v4.29.3 when scanned. Much of its community and documentation is Chinese-first, and the README is available in several languages.
- Repository: github.com/AstrBotDevs/AstrBot
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: Python. Stars: 43.7K. Forks: 3,202. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit 832fc6d
Who it is for
People who want an AI assistant inside their group chats or community servers, and developers building a bot for a team or customers on Telegram, Discord, Slack or the Chinese messaging platforms.
Getting started
1. Install with uv
uv tool install astrbot --python 3.122. Initialise on first run
astrbot init3. Start the bot and its dashboard
astrbot runThe dashboard opens on port 6185; sign in with the username and random password printed in the startup log, then change them. Docker, a desktop app and several server panels are documented on docs.astrbot.app. To turn off usage statistics, set ASTRBOT_DISABLE_METRICS=1 or use the dashboard setting.
Safety scan
We cloned AstrBotDevs/AstrBot at commit 832fc6d on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The 6 secret hits are fake keys in tests for its log redaction and dashboard (tests/unit/test_diagnostic_redaction.py and tests/test_fastapi_v1_dashboard.py). No real credentials.
- Pattern hits: the exfil-host flags on api.telegram.org are the Telegram adapter talking to Telegram's own bot API; the Dockerfile installs Node.js with NodeSource's curl | bash; one generated dashboard API file has a 23,162-character line.
- Usage statistics are on by default: counts of messages and model calls, adapter and model names, OS, Python version, an installation ID and the machine's hostname, sent to tickstats.soulter.top. Section 8 of the EULA discloses this, and ASTRBOT_DISABLE_METRICS=1 or the 'Disable Anonymous Usage Statistics' setting turns it off. Updates, the plugin list and the default text-to-image service also use the developer's soulter.top servers.
- Plugins from the market are community Python code that runs inside AstrBot with access to its configuration and chats; install only ones you have reason to trust.
- 187 known advisories (4 critical, 84 high), almost all in dashboard/pnpm-lock.yaml (171), the web dashboard's dependencies such as axios, Vue and handlebars, some of which end up in the dashboard you open in a browser, and docs/pnpm-lock.yaml (24), the documentation site.
- 12 workflows, none using pull_request_target; none of the 17 third-party actions is pinned. The install.sh and install.ps1 scripts (about 450 lines each, no sudo) add uv to your PATH through your shell profile. CodeQL and Dependabot on; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 6 candidates found and read; see the notes above. |
| Suspicious code | 8 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 4 installer scripts (one edits your shell profile; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 12 workflows. None use pull_request_target. 17 of 17 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, docs.astrbot.app, cdn.jsdelivr.net, api.telegram.org. 3 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 187 advisories across 867 pinned packages: 4 critical, 84 high, 81 moderate, 18 low. dashboard/pnpm-lock.yaml: 742 packages, 171 advisories; docs/pnpm-lock.yaml: 167 packages, 24 advisories; requirements.txt: 2 packages, 0 advisories. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file, contributing guide. Missing security policy. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (6, redacted)
| Where | Rule | Match |
|---|---|---|
| tests/test_fastapi_v1_dashboard.py:4821 | private-key | -----B…--- (27 chars) |
| tests/unit/test_diagnostic_redaction.py:47 | private-key | -----B…--- (35 chars) |
| tests/unit/test_diagnostic_redaction.py:152 | private-key | -----B…--- (27 chars) |
| tests/unit/test_diagnostic_redaction.py:163 | private-key | -----B…--- (27 chars) |
| tests/unit/test_diagnostic_redaction.py:254 | private-key | -----B…--- (27 chars) |
| tests/unit/test_diagnostic_redaction.py:278 | private-key | -----B…--- (27 chars) |
Pattern hits (8)
| Where | Rule | Match |
|---|---|---|
| Dockerfile:19 | download-piped-to-shell | && curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - \ |
| astrbot/core/config/default.py:467 | exfil-host | "telegram_api_base_url": "https://api.telegram.org/bot", |
| astrbot/core/platform/sources/telegram/tg_adapter.py:61 | exfil-host | "https://api.telegram.org/bot", |
| astrbot/core/platform/sources/telegram/tg_adapter.py:64 | exfil-host | base_url = "https://api.telegram.org/bot" |
| dashboard/src/api/generated/openapi-v1/sdk.gen.ts:4 | very-long-line | 23162 chars |
| docs/public/install.sh:65 | download-piped-to-shell | # Read menus from the terminal, never from the script stream in curl | bash. |
| tests/fixtures/helpers.py:47 | exfil-host (test/example) | "telegram_api_base_url": "https://api.telegram.org/bot", |
| tests/fixtures/mocks/telegram.py:121 | exfil-host (test/example) | bot.base_url = "https://api.telegram.org/bottest_token_123/" |
URLs to bare IP addresses (3)
| Where | Rule | Match |
|---|---|---|
| tests/test_fastapi_v1_dashboard.py:4801 | ip-literal-url | "public_endpoint": "http://8.8.8.8:8080/v1", |
| tests/test_fastapi_v1_dashboard.py:4821 | ip-literal-url | f"{secret}\n{quote(secret, safe='')}\n{plugin_secret}\n{trace_secret}\nhttp://8.8.8.8:8080/v1 https://[2606:4700:4700::1111]:443/v1 http://192.168.1.2:6185/heal… |
| tests/unit/test_diagnostic_redaction.py:288 | ip-literal-url | "api_base": "http://8.8.8.8:8080/v1", |
Installer scripts (4)
- docs/public/install.ps1, 482 lines, edits your shell profile; talks to docs.astral.sh, github.com, mirrors.cernet.edu.cn, mirrors.ustc.edu.cn, pypi.org
- docs/public/install.sh, 450 lines, edits your shell profile; talks to docs.astral.sh, github.com, mirrors.cernet.edu.cn, mirrors.ustc.edu.cn, pypi.org
- scripts/run_pytests_ci.sh, 36 lines
- scripts/start-with-neo.sh, 299 lines, uses sudo
Worst known vulnerabilities (24 of 187)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2w6w-674q-4c4q | critical | handlebars@4.7.8 | Handlebars.js has JavaScript Injection via AST Type Confusion |
| GHSA-8r5x-fm3f-whwj | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| GHSA-p8wg-vrv2-v86f | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| GHSA-23hp-3jrh-7fpw | critical | tar@6.2.1 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-g2v6-rqmx-r4w6 | high | @vue/server-renderer@3.3.4 | @vue/server-renderer: XSS via missing CR in attribute-name blacklist |
| GHSA-35jp-ww65-95wh | high | axios@1.13.5 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| GHSA-3g43-6gmg-66jw | high | axios@1.13.5 | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| GHSA-3pq3-5fj3-cg6v | high | axios@1.13.5 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
| GHSA-542g-h47m-68v8 | high | axios@1.13.5 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
| GHSA-6chq-wfr3-2hj9 | high | axios@1.13.5 | Axios: Header Injection via Prototype Pollution |
| GHSA-777c-7fjr-54vf | high | axios@1.13.5 | Allocation of Resources Without Limits or Throttling in Axios |
| GHSA-hfxv-24rg-xrqf | high | axios@1.13.5 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| GHSA-j5f8-grm9-p9fc | high | axios@1.13.5 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
| GHSA-p92q-9vqr-4j8v | high | axios@1.13.5 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
| GHSA-pf86-5x62-jrwf | high | axios@1.13.5 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| GHSA-pmwg-cvhr-8vh7 | high | axios@1.13.5 | Axios: Incomplete Fix for CVE-2025-62718 - NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax… |
| GHSA-q8qp-cvcw-x6jj | high | axios@1.13.5 | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@2.0.2 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@2.0.2 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
By the numbers
| Stars | 43.7K |
|---|---|
| Forks | 3,202 |
| Contributors | 381 |
| Commits | 5,455 |
| Open issues | 700 |
| Open pull requests | 341 |
| Releases | 261 |
| Latest release | v4.29.3 |
| Licence | AGPL-3.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 25, 2026 |
| Tracked files | 1,871 |
| Lines of code | 449.4K |
| Checkout size | 22 MB |
Lines by language: Python 251.1K, Vue 84.6K, JSON 36.1K, Markdown 35.1K, TypeScript 19.3K, YAML 8,749.
Questions
Is AstrBot free?
Yes. AstrBot is free and open source under AGPL-3.0, and the project states that it runs no paid services and never charges users. You pay only for the model APIs you connect, or nothing with local models.
Does AstrBot collect data?
By default it sends anonymous usage statistics, such as message counts, adapter and model names, OS and an installation ID, but not message text, according to its EULA. Set ASTRBOT_DISABLE_METRICS=1 or switch on 'Disable Anonymous Usage Statistics' in the dashboard to stop it.
Which chat platforms does AstrBot support?
Officially QQ, the OneBot v11 protocol, Telegram, WeChat Work, WeChat Official Accounts, Feishu (Lark), DingTalk, Slack, Discord, LINE, Satori, KOOK, Misskey and Mattermost, with Matrix, Rocket.Chat and VoceChat through community plugins.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.