Colibri runs very large open models on the machine you already own. A mixture-of-experts model with hundreds of billions of parameters only uses a small part of itself for each word, so Colibri keeps that part in RAM and reads the rest, the experts, from your disk as the model asks for them. The result is a 744-billion-parameter GLM model running in about 10 GB of memory, with no graphics card required, in a small engine written in pure C.
It runs thirteen engines today, including GLM, Kimi, DeepSeek, Qwen and MiMo, plus an image model, and reads the GGUF files people already publish. A setup script looks at your RAM, disk and GPU, recommends a model that fits, downloads it, and opens a chat dashboard with an OpenAI-compatible API on localhost. It is Apache-2.0, has about 47,000 stars and 221 contributors since July 2026, and version 2.1.0 is current.
Be realistic about speed. The README's own numbers run from a few seconds to about 20 seconds per word on the biggest models, depending on your disk; it is for trying frontier-sized models privately, not for fast chat. You need at least 8 GB of RAM (16 GB is better) and 22 GB of free disk for the smallest model.
- Repository: github.com/JustVugg/colibri
- Licence: Apache-2.0 (Apache License 2.0)
- Language: C. Stars: 46.8K. Forks: 5,401. Last push: Nov 3, 2026.
- Scan: safe, Nov 3, 2026, commit 0a5504a
Who it is for
People curious to run the biggest open models without buying a GPU rig, privacy-minded users who want a large model fully offline, and tinkerers with a fast NVMe drive and patience.
Getting started
1. Windows: download the ZIP from GitHub, unzip it and double-click
START-HERE.bat2. macOS or Linux: clone it (git, Python and a compiler needed)
git clone https://github.com/JustVugg/colibri && cd colibri3. Answer one question, which model, and it opens the dashboard
./start-here.shThe setup builds the engine for your machine when a compiler is there, or downloads the prebuilt release. Model downloads are large: check the size it shows before you press Enter.
Safety scan
We cloned JustVugg/colibri at commit 0a5504a on Nov 3, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 1,697 files and 526,000 lines: C, Python, headers and CUDA. One binary, a 67 KB test fixture.
- The setup scripts use no sudo themselves (they print the install command for Python if it is missing) and do not edit your shell profile. desktop/ has a Tauri build.rs that runs at compile time only if you build the desktop shell.
- Nine lockfiles with 35 advisories, 16 high. Nine of the highs are one pin, transformers 4.56.2, in requirements-kimi-k3-ref.txt, a reference script for checking Kimi output that a normal run does not use. The rest are in the Tauri desktop shell (quick-xml) and the web dashboard's build tooling (vite, postcss, nanoid).
- Four workflows, none using pull_request_target, and all 11 third-party action uses pinned to commits. A licence is present; no security policy or Dependabot.
- Network hosts are huggingface.co and modelscope.cn for model downloads, github.com for releases, python.org, and test hosts. The optional web search tool uses DuckDuckGo. Nothing reports usage.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 Cargo build script. 4 installer scripts (one can call sudo) |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 4 workflows. None use pull_request_target. 0 of 11 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 25 distinct hosts referenced from source; most often github.com, huggingface.co, example.test, hub.example. No URLs to bare IP addresses. |
| Known vulnerabilities | 35 advisories across 574 pinned packages: 0 critical, 16 high, 11 moderate, 1 low, 7 unrated. c/tools/jev-sdk/package-lock.json: 1 packages, 0 advisories; c/tools/requirements-deepseek-v4-tiny.txt: 4 packages, 0 advisories; c/tools/requirements-glm53-tiny.txt: 4 packages, 0 advisories; c/tools/requirements-jev-sdk.txt: 13 packages, 0 advisories; c/tools/requirements-kimi-k3-ref.txt: 1 packages, 10 advisories; c/tools/requirements-qwen38-tiny.txt: 4 packages, 0 advisories; c/tools/requirements-qwenimage-tiny.txt: 4 packages, 0 advisories; desktop/src-tauri/Cargo.lock: 415 packages, 12 advisories; web/package-lock.json: 136 packages, 13 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (4)
- c/scripts/run.sh, 39 lines
- c/setup.sh, 70 lines, uses sudo
- c/tools/run_f8_bench.sh, 25 lines
- start-here.sh, 43 lines, uses sudo; talks to www.python.org
Committed binaries (1)
c/tests/fixtures/e8_case.bin: .bin, 67 KB
Worst known vulnerabilities (24 of 35)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-29pf-2h5f-8g72 | high | transformers@4.56.2 | HuggingFace transformers vulnerable to remote code execution |
| GHSA-fgcw-684q-jj6r | high | transformers@4.56.2 | huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path |
| GHSA-x9r9-c232-4q39 | high | transformers@4.56.2 | Hugging Face Transformers downloads custom generation code before trust consent |
| GHSA-xrqw-3rrv-vx5w | high | transformers@4.56.2 | Transformers save_pretrained path traversal allows arbitrary file writes through chat template names |
| CVE-2025-14926 | high | transformers@4.56.2 | |
| CVE-2025-14927 | high | transformers@4.56.2 | |
| CVE-2025-14928 | high | transformers@4.56.2 | |
| CVE-2025-14929 | high | transformers@4.56.2 | |
| CVE-2025-14930 | high | transformers@4.56.2 | |
| RUSTSEC-2026-0194 | high | quick-xml@0.38.4 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.38.4 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-28wg-ghj8-5hjv | high | nanoid@3.3.15 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.15 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.16 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-68fv-2mgg-jv7q | high | source-map-js@1.2.1 | source-map-js allows event-loop denial of service through indexed source-map section offsets |
| GHSA-587h-7wmj-h5pm | high | vite@8.1.4 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-69w3-r845-3855 | moderate | transformers@4.56.2 | HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class |
| GHSA-wrw7-89jp-8q8g | moderate | glib@0.18.5 | Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` |
| GHSA-7gcf-g7xr-8hxj | moderate | serde_with@3.17.0 | serde_with: KeyValueMap serialization panics on empty sequence or map entries |
| GHSA-r6v5-fh4h-64xc | moderate | time@0.3.45 | time vulnerable to stack exhaustion Denial of Service attack |
| GHSA-82fw-gwwq-j7x9 | moderate | @vitest/mocker@4.1.10 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
| GHSA-qxg6-89mg-rqv8 | moderate | @vitest/mocker@4.1.10 | Vitest: Code injection via unauthenticated manual mock registration |
| GHSA-fxqj-rqcc-2cmp | moderate | postcss@8.5.16 | PostCSS: incomplete fix of GHSA-6g55-p6wh-862q - attacker-controlled sourceMappingURL reads arbitrary .map files when `f… |
| GHSA-698v-4r3x-3vcv | moderate | vite@8.1.4 | launch-editor: escapeCmdArgs() omits % escaping on Windows |
By the numbers
| Stars | 46.8K |
|---|---|
| Forks | 5,401 |
| Contributors | 221 |
| Commits | 5,150 |
| Open issues | 65 |
| Open pull requests | 90 |
| Releases | 21 |
| Latest release | v2.1.0 |
| Licence | Apache-2.0 |
| Main language | C |
| Project age | 4 months |
| Last push | Nov 3, 2026 |
| Tracked files | 1,697 |
| Lines of code | 526.4K |
| Checkout size | 45 MB |
Lines by language: C 181.4K, Python 154.4K, C/C++ header 87.6K, Markdown 33.5K, JSON 21.3K, CUDA 19.1K.
Questions
Is Colibri free?
Yes, Apache-2.0 with no paid tier, and the models it runs are open-weight downloads. Your cost is disk space and electricity.
Is Colibri fast?
Not on the biggest models. Expect seconds per word, because the experts stream from disk; a fast NVMe drive and more RAM help a lot. Smaller models in its list run much faster.
Colibri or Ollama?
Ollama is the easy, quick way to run models that fit in your memory. Colibri is for models far too big for your memory, trading speed for size. Both offer an OpenAI-compatible API on localhost.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.