CrewAI is a Python framework for multi-agent systems. You describe agents by role, goal and backstory, give them tools and tasks, and put them in a crew that works sequentially or under a manager agent that delegates. Flows are the second half: event-driven, stateful pipelines in ordinary Python for the parts that should not be left to agent judgment, which can call a crew as one step. The crewai CLI scaffolds a project, installs it and runs it.
It is here because it made multi-agent setups approachable: a researcher, a writer and a reviewer working on a report takes a page of configuration rather than an orchestration framework of your own. It is its own code base, not built on LangChain, MIT-licensed, with about 340 contributors and a release most weeks. CrewAI Inc. sells a hosted control plane (CrewAI AMP) for deploying and monitoring crews; the framework does not need it.
- Repository: github.com/crewAIInc/crewAI
- Licence: MIT (MIT License)
- Language: Python. Stars: 59.1K. Forks: 8,587. Last push: Sep 27, 2026.
- Scan: safe, Sep 25, 2026, commit 4ed2abc
Who it is for
Python developers automating multi-step research, writing or analysis work that splits naturally into roles, and teams who want agents plus deterministic steps in one framework.
Getting started
1. Install the CLI with uv (needs Python 3.10 to 3.13)
uv tool install crewai2. Scaffold a new crew project
crewai create crew latest-ai-development3. Install its dependencies and run it
cd latest_ai_development && crewai install && crewai runThe README installs uv itself with curl -LsSf https://astral.sh/uv/install.sh | sh if you do not already have it.
Safety scan
We cloned crewAIInc/crewAI at commit 4ed2abc on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- One secret-shaped string, an elided PEM header (-----BEGIN PRIVATE KEY-----...) in the docstring example of the A2A agent-card signing helper. One pattern hit, a long line of test data. No bare-IP URLs.
- No install hooks, installer scripts or committed binaries. Most of the repository by line count is documentation.
- Known advisories: 8 across 492 packages in uv.lock. Two criticals and two highs are chromadb 1.1.1, which crewai requires for its memory and knowledge stores. The criticals describe code injection through Chroma's HTTP API; CrewAI opens Chroma as an embedded local library, so that API is not exposed unless you run a Chroma server yourself. No patched version was listed. The rest (unstructured, couchbase, nltk, accelerate) come from optional extras.
- Telemetry is documented in the README: CrewAI version, Python version, OS, agent and task counts, process type, model names, agent roles and tool names are sent by default; prompts, outputs and secrets are not unless you set share_crew=True on a crew. OTEL_SDK_DISABLED=true turns it off.
- 16 workflows, all 18 third-party actions pinned to a commit. Two use pull_request_target (a first-contributor welcome and an issue-link check) and neither checks out the pull request. Security policy, Dependabot, CodeQL and contributing guide present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 1 candidate found and read; see the notes above. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 16 workflows. 2 use pull_request_target, none check out the pull request head. 0 of 18 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often test.openai.azure.com, api.example.com, app.crewai.com, github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 8 advisories across 492 pinned packages: 3 critical, 4 high, 1 moderate, 0 low. uv.lock: 492 packages, 8 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (1, redacted)
| Where | Rule | Match |
|---|---|---|
| lib/crewai/src/crewai/a2a/utils/agent_card_signing.py:106 | private-key | -----B…--- (27 chars) |
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| lib/crewai/tests/test_crew.py:310 | very-long-line | 3523 chars |
Worst known vulnerabilities (8 of 8)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-36p7-vc44-83pf | critical | chromadb@1.1.1 | ChromaDB has a code injection vulnerability |
| GHSA-f4j7-r4q5-qw2c | critical | chromadb@1.1.1 | ChromaDB Python project has a pre-authentication code injection vulnerability |
| GHSA-4mvj-m6j5-pmf7 | critical | unstructured@0.18.32 | unstructured: Server-Side Request Forgery in the URL-based partitioning |
| GHSA-2wm9-hf6c-p5cr | high | chromadb@1.1.1 | ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection |
| GHSA-xph7-9rjv-w5fr | high | chromadb@1.1.1 | ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to |
| CVE-2023-45875 | high | couchbase@4.6.1 | |
| GHSA-8mgp-746c-j5xp | high | nltk@3.10.3 | NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots |
| GHSA-4j2p-28q2-5m79 | moderate | accelerate@1.13.0 | Accelerate path traversal and denial of service via sharded checkpoint weight_map entries |
Workflows worth a look
- .github/workflows/first-contributor-welcome.yml: pull_request_target
- .github/workflows/ftc-require-issue.yml: pull_request_target
By the numbers
| Stars | 59.1K |
|---|---|
| Forks | 8,587 |
| Contributors | 340 |
| Commits | 2,910 |
| Open issues | 193 |
| Open pull requests | 309 |
| Releases | 236 |
| Latest release | 1.15.22 |
| Licence | MIT |
| Main language | Python |
| Project age | 2 years |
| Last push | Sep 27, 2026 |
| Tracked files | 31,091 |
| Lines of code | 6.9M |
| Checkout size | 404 MB |
Lines by language: Markdown 6.3M, Python 343.5K, YAML 293.9K, JSON 36.5K, JavaScript 2,548, CSS 1,123.
Questions
Is CrewAI free?
Yes. The framework is MIT-licensed and free for any use, including commercial. CrewAI AMP is the company's paid platform for deploying, monitoring and managing crews, with a free tier of its Crew Control Plane at app.crewai.com. You need neither to build and run crews locally; you pay only for the models you call.
Does CrewAI send my data anywhere?
Anonymous usage telemetry is on by default: versions, OS, counts of agents and tasks, model names, agent roles and tool names. Prompts, task outputs, API responses and secrets are not collected unless you opt in with share_crew=True. Set OTEL_SDK_DISABLED=true in the environment to switch telemetry off entirely. Your prompts otherwise go only to the model provider you configure.
Can CrewAI use local models?
Yes. Point an agent's LLM at Ollama (for example ollama/llama3.1 with the local base URL) or any OpenAI-compatible server. Smaller local models follow multi-step role instructions less reliably than large hosted ones, so start with a simple crew and a capable model before scaling down.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.