Coze Studio is the open-source core of Coze, ByteDance's platform for building AI agents. You build an agent in a browser: pick a model, write its prompt, attach knowledge bases for retrieval, plugins and databases, and wire multi-step logic on a drag-and-drop workflow canvas. Finished agents and apps can be called through an API or embedded with a chat SDK.
It belongs on the list as a self-hosted alternative to Dify and similar builders, with a Go backend and React front end, and it runs on a machine with 2 cores and 4 GB of memory through Docker Compose. Models are configured by you, from OpenAI to Volcengine or a local endpoint.
About 21,800 stars, Apache-2.0, at v0.5.1 when scanned. The limits: activity has slowed, with the last commit at the end of July 2026 and the last release in February; some features of the commercial Coze, such as voice customisation, are not in the open version; and much of the documentation is on coze.cn.
- Repository: github.com/coze-dev/coze-studio
- Licence: Apache-2.0 (Apache License 2.0)
- Language: TypeScript. Stars: 21.8K. Forks: 3,131. Last push: Jul 29, 2026.
- Scan: safe, Oct 26, 2026, commit fefb05f
Who it is for
Teams who want a visual agent and workflow builder on their own servers, and developers comparing self-hosted alternatives to Dify, Flowise or n8n's AI nodes.
Getting started
1. Get the code
git clone https://github.com/coze-dev/coze-studio.git2. Build and start it with Docker (macOS or Linux)
cd coze-studio && make web3. On Windows, start it with Docker Compose
cp ./docker/.env.example ./docker/.env && docker compose -f ./docker/docker-compose.yml upThen register an account at http://localhost:8888/sign and add a model at http://localhost:8888/admin/#model-management before building anything. The first start pulls and builds several images and takes a while.
Safety scan
We cloned coze-dev/coze-studio at commit fefb05f on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs. The 10,000-plus www.apache.org mentions are licence headers.
- Three of the four curl | sh hits are messages telling you how to install Atlas or nvm yourself; scripts/setup/server.sh does install Deno from deno.land that way inside the server setup. The 2 very long lines are workflow canvas configuration.
- 644 known advisories. The ones that matter are in backend/go.mod, which ships in the server: 10 critical, including golang.org/x/crypto 0.39.0 SSH issues, a gRPC authorisation bypass and kin-openapi. Most of the rest are in the pnpm lockfiles for the front end and its Rush build tooling.
- The README lists the risks of a public deployment itself: open account registration, Python execution in workflow code nodes, server-side request forgery and privilege issues. Keep it on a private network or behind authentication.
- 8 workflows, none using pull_request_target; none of the 7 third-party actions is pinned to a commit. Contributing guide and code of conduct present; security reports go to ByteDance's security centre. The licence file is LICENSE-APACHE, which the scanner did not recognise.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 6 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 5 installer scripts (one fetches and runs a remote script) |
| Committed binaries | None. |
| CI workflows | 8 workflows. None use pull_request_target. 7 of 7 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often www.apache.org, storybook.js.org, github.com, www.coze.cn. No URLs to bare IP addresses. |
| Known vulnerabilities | 644 advisories across 4,653 pinned packages: 35 critical, 270 high, 232 moderate, 63 low, 44 unrated. backend/go.mod: 310 packages, 114 advisories; common/autoinstallers/plugins/pnpm-lock.yaml: 640 packages, 87 advisories; common/autoinstallers/rush-commands/pnpm-lock.yaml: 40 packages, 6 advisories; common/autoinstallers/rush-commitlint/pnpm-lock.yaml: 348 packages, 41 advisories; common/autoinstallers/rush-lint-staged/pnpm-lock.yaml: 657 packages, 110 advisories; common/config/subspaces/default/pnpm-lock.yaml: 3,770 packages, 444 advisories; common/config/subspaces/e2e/pnpm-lock.yaml: 161 packages, 43 advisories; scripts/volcengine/go.mod: 6 packages, 0 advisories. |
| Project hygiene | Has contributing guide. Missing security policy, automated dependency updates, CodeQL, licence file. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (6)
| Where | Rule | Match |
|---|---|---|
| frontend/packages/workflow/playground/src/options/workflow-document-custom-options.ts:38 | very-long-line | 4468 chars |
| frontend/packages/workflow/playground/src/options/workflow-document-custom-options.ts:39 | very-long-line | 4512 chars |
| scripts/setup/db_migrate_apply.sh:37 | download-piped-to-shell | echo -e "${RED}curl -sSf https://atlasgo.sh | sh -s -- --community${NC}" |
| scripts/setup/db_migrate_dump.sh:36 | download-piped-to-shell | echo -e "${RED}curl -sSf https://atlasgo.sh | sh -s -- --community${NC}" |
| scripts/setup/server.sh:39 | download-piped-to-shell | curl -fsSL https://deno.land/install.sh | sh |
| scripts/setup_fe.sh:22 | download-piped-to-shell | echo -e " curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.3/install.sh | bash" |
Installer scripts (5)
- docker/volumes/elasticsearch/setup_es.sh, 142 lines
- frontend/scripts/setup-env.sh, 32 lines; talks to www.apache.org
- scripts/hooks/setup-vscode-settings.sh, 74 lines; talks to www.apache.org
- scripts/setup_fe.sh, 53 lines, fetches and runs a remote script; talks to raw.githubusercontent.com
- scripts/start_fe.sh, 27 lines
Worst known vulnerabilities (24 of 644)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-r277-6w6q-xmqw | critical | github.com/getkin/kin-openapi@0.118.0 | kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default |
| GHSA-f6mr-38g8-39rg | critical | github.com/ollama/ollama@0.9.6 | Ollama Platform has missing authentication enabling attackers to perform model management operations |
| GHSA-5cgq-3rg8-m6cv | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status |
| GHSA-89gr-r52h-f8rx | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed |
| GHSA-f5wc-c3c7-36mc | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys |
| GHSA-jppx-rxg9-jmrx | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto doesn't enforce invoking key constraints |
| GHSA-rm3j-f69w-wqmq | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto vulnerable to infinite loop on large channel writes |
| GHSA-vgwf-h737-ff37 | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses |
| GHSA-x527-x647-q7gg | critical | golang.org/x/crypto@0.39.0 | golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement |
| GHSA-p77j-4mvh-x3m3 | critical | google.golang.org/grpc@1.71.0 | gRPC-Go has an authorization bypass via missing leading slash in :path |
| GHSA-2w6w-674q-4c4q | critical | handlebars@4.7.8 | Handlebars.js has JavaScript Injection via AST Type Confusion |
| GHSA-8r5x-fm3f-whwj | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| GHSA-p8wg-vrv2-v86f | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| GHSA-r275-fr43-pm7q | critical | simple-git@3.28.0 | simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE |
| GHSA-x6jw-m9v5-85vh | critical | simple-git@3.28.0 | simple-git unsafe-operation guard does not block trailer command configuration |
| GHSA-fjxv-7rqg-78g4 | critical | form-data@3.0.3 | form-data uses unsafe random function in form-data for choosing boundary |
| GHSA-m7jm-9gc2-mpf2 | critical | fast-xml-parser@5.2.3 | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
| GHSA-w7jw-789q-3m8p | critical | shell-quote@1.8.2 | shell-quote quote() does not escape newlines in object .op values |
| GHSA-23hp-3jrh-7fpw | critical | tar@6.2.1 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-67hx-6x53-jw92 | critical | @babel/traverse@7.21.5 | Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code |
| GHSA-fjxv-7rqg-78g4 | critical | form-data@2.3.3 | form-data uses unsafe random function in form-data for choosing boundary |
| GHSA-fjxv-7rqg-78g4 | critical | form-data@4.0.3 | form-data uses unsafe random function in form-data for choosing boundary |
| GHSA-37j7-fg3j-429f | critical | happy-dom@12.10.3 | Happy DOM: VM Context Escape can lead to Remote Code Execution |
| GHSA-96g7-g7g9-jxw8 | critical | happy-dom@12.10.3 | happy-dom allows for server side code to be executed by a <script> tag |
By the numbers
| Stars | 21.8K |
|---|---|
| Forks | 3,131 |
| Contributors | 62 |
| Commits | 392 |
| Open issues | 501 |
| Open pull requests | 81 |
| Releases | 11 |
| Latest release | v0.5.1 |
| Licence | Apache-2.0 |
| Main language | TypeScript |
| Project age | 1 year |
| Last push | Jul 29, 2026 |
| Tracked files | 15,305 |
| Lines of code | 1.8M |
| Checkout size | 76 MB |
Lines by language: TypeScript 1M, Go 626.2K, JSON 119.3K, Markdown 21.9K, JavaScript 15.6K, YAML 14.2K.
Questions
Is Coze Studio free?
Yes. Coze Studio is open source under Apache-2.0 and free to self-host. You pay only for the models you connect, unless you run local ones.
What is the difference between Coze Studio and Coze?
Coze is ByteDance's hosted agent platform at coze.com and coze.cn. Coze Studio is its open-sourced core engine that you run yourself; a few commercial features are left out.
Can Coze Studio use local models?
Yes. Models are added in the admin panel, and besides OpenAI and Volcengine you can point it at a local OpenAI-compatible endpoint such as Ollama.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.