Kokoro-FastAPI wraps Kokoro-82M, a small open text-to-speech model, in a Docker container with an OpenAI-compatible speech endpoint on port 8880. Any app that can talk to OpenAI's text-to-speech API can point at it instead and get natural-sounding speech generated on your own machine. It speaks American and British English, Spanish, French, Hindi, Italian, Japanese, Brazilian Portuguese and Mandarin.
Because the model has only 82 million parameters, it runs at usable speed on a plain CPU and very fast on a GPU, which is why it has become a common backend for Home Assistant voices, audiobook converters, read-aloud browser extensions and Open WebUI. Beyond the basic endpoint it can mix voices with weights, produce per-word timestamps for captions, take SSML, convert text to phonemes, and serve an optional web UI for long read-along generation.
Prebuilt images cover CPU, NVIDIA (including RTX 50-series and Jetson) and, experimentally, AMD ROCm. Apple Silicon users get GPU acceleration only by running it outside Docker with the included start-gpu_mac.sh script. Custom voices come from a separate companion project rather than this repository.
- Repository: github.com/remsky/Kokoro-FastAPI
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 5,594. Forks: 931. Last push: Oct 23, 2026.
- Scan: safe, Oct 26, 2026, commit b048d6d
Who it is for
Self-hosters who want a private text-to-speech voice for Home Assistant, audiobooks or chat front ends, and developers who want a drop-in local replacement for OpenAI's speech API.
Getting started
1. Run on any machine with Docker (CPU)
docker run -p 8880:8880 ghcr.io/remsky/kokoro-fastapi-cpu:latest2. Or with an NVIDIA GPU
docker run --gpus all -p 8880:8880 ghcr.io/remsky/kokoro-fastapi-gpu:latest3. Apple Silicon, using the Mac GPU (from a clone of the repository)
./start-gpu_mac.shThe API is then at http://localhost:8880/v1. Use any OpenAI client with base_url set to that address, model "kokoro" and a voice such as "af_bella"; the API key can be any string. The README asks you to pin a release tag rather than :latest for stable use.
Safety scan
We cloned remsky/Kokoro-FastAPI at commit b048d6d on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs across 416 files, about 22,000 lines of them Python.
- The two pattern hits are in docker/rocm/Dockerfile and docker/test-client/Dockerfile, which install the uv package manager with curl -LsSf https://astral.sh/uv/install.sh | sh while building the image. It is uv's official installer, but it is fetched unpinned at build time.
- The five start scripts (start-cpu.sh, start-gpu.sh, start-gpu_mac.sh and two PowerShell versions) are 12 to 26 lines each and only set paths and run the server with uv. No sudo.
- uv.lock pins 184 packages with 61 known advisories (2 critical, 29 high), most of them in torch, plus anyio, certifi and filelock; the test client's lockfile adds 9 more. The server is meant to run on localhost or a trusted network, which limits the exposure, but do not put port 8880 on the open internet.
- Model weights download from Hugging Face on first run unless baked into the image. Four workflows with all 10 third-party actions pinned to commits, none using pull_request_target. Dependabot and a contributing guide are present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 2 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 5 installer scripts |
| Committed binaries | None. |
| CI workflows | 4 workflows. None use pull_request_target. 0 of 10 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 10 distinct hosts referenced from source; most often repo.radeon.com, github.com, huggingface.co, astral.sh. No URLs to bare IP addresses. |
| Known vulnerabilities | 69 advisories across 218 pinned packages: 4 critical, 31 high, 16 moderate, 18 low. docker/test-client/uv.lock: 50 packages, 9 advisories; package-lock.json: 4 packages, 0 advisories; uv.lock: 184 packages, 61 advisories. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (2)
| Where | Rule | Match |
|---|---|---|
| docker/rocm/Dockerfile:27 | download-piped-to-shell | && curl -LsSf https://astral.sh/uv/install.sh | sh \ |
| docker/test-client/Dockerfile:29 | download-piped-to-shell | && curl -LsSf https://astral.sh/uv/install.sh | sh \ |
Installer scripts (5)
- start-cpu.ps1, 12 lines
- start-cpu.sh, 26 lines
- start-gpu.ps1, 12 lines
- start-gpu.sh, 18 lines
- start-gpu_mac.sh, 21 lines
Worst known vulnerabilities (24 of 69)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 | critical | anyio@4.13.0 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.5.20 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.12.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.2.25 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.29.0 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-27vj-qcqg-25rc | high | fsspec@2026.4.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.25.0 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-27vj-qcqg-25rc | high | fsspec@2026.2.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
| GHSA-8mgp-746c-j5xp | high | nltk@3.10.3 | NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots |
| CVE-2025-55551 | high | torch@2.8.0 | |
| CVE-2025-55552 | high | torch@2.8.0 | |
| CVE-2026-4538 | high | torch@2.8.0 | |
| GHSA-63cw-57p8-fm3p | high | torch@2.8.0 | |
| CVE-2025-55551 | high | torch@2.8.0+cpu | |
| CVE-2025-55552 | high | torch@2.8.0+cpu | |
| CVE-2026-4538 | high | torch@2.8.0+cpu | |
| GHSA-63cw-57p8-fm3p | high | torch@2.8.0+cpu | |
| CVE-2025-55551 | high | torch@2.8.0+cu126 | |
| CVE-2025-55552 | high | torch@2.8.0+cu126 | |
| CVE-2026-4538 | high | torch@2.8.0+cu126 | |
| GHSA-63cw-57p8-fm3p | high | torch@2.8.0+cu126 | |
| CVE-2025-55551 | high | torch@2.8.0+cu128 | |
| CVE-2025-55552 | high | torch@2.8.0+cu128 | |
| CVE-2026-4538 | high | torch@2.8.0+cu128 |
By the numbers
| Stars | 5,594 |
|---|---|
| Forks | 931 |
| Contributors | 54 |
| Commits | 669 |
| Open issues | 12 |
| Open pull requests | 5 |
| Releases | 26 |
| Latest release | v0.9.0 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 23, 2026 |
| Tracked files | 416 |
| Lines of code | 39.4K |
| Checkout size | 58 MB |
Lines by language: Python 21.5K, JavaScript 7,460, Markdown 3,243, CSS 2,662, JSON 2,399, YAML 1,190.
Questions
Is Kokoro-FastAPI free?
Yes. The wrapper is Apache-2.0-licensed, and the Kokoro-82M model it serves is also openly licensed for commercial use. Everything runs on your own hardware.
Does it work with apps built for OpenAI's text-to-speech?
Yes. It implements the same /v1/audio/speech endpoint, so you point the app's base URL at http://localhost:8880/v1, use "kokoro" as the model and pick one of Kokoro's voice names. Voices can be combined, for example "af_sky+af_bella".
Do I need a GPU?
No. The CPU image is the recommended start for laptops and small servers, and the model is small enough to keep up with most uses. An NVIDIA GPU makes long jobs like audiobooks much faster.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.