LangBot connects large language models to chat apps. Set it up once and the same bot can answer on Discord, Telegram, Slack, LINE, Matrix, DingTalk, Lark, KOOK, QQ, WeCom and WeChat, with multi-turn conversations, tool calling, images, streaming replies and a built-in knowledge base for answering from your own documents.
Everything is managed from a web panel rather than config files. You pick a model from OpenAI, Anthropic, Gemini, DeepSeek, Ollama, LM Studio and many others, or hand conversations to a Dify, Coze, n8n or Langflow workflow, then add access control, rate limits and word filters. A plugin system with hundreds of plugins, MCP support and a built-in MCP endpoint let you extend it or have a coding agent manage it.
It is Apache-2.0, with about 18,500 stars and 116 contributors, at v4.11.2 when scanned. It is especially strong on Chinese platforms, and parts of the documentation are Chinese first. A hosted LangBot Cloud exists if you would rather not run it yourself.
- Repository: github.com/langbot-app/LangBot
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 18.5K. Forks: 1,668. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 1d3c47c
Who it is for
Community managers who want an AI helper in their Discord or Telegram group, companies putting a support bot on Slack, WeCom or Lark, and developers who want one bot backend for several chat apps.
Getting started
1. Run it with uv, then open http://localhost:5300
uvx langbot2. Or run it with Docker Compose
git clone https://github.com/langbot-app/LangBot && cd LangBot/docker && docker compose --profile all up -duvx needs uv installed first. Each chat platform needs its own bot token or app credentials, set up in the web panel.
Safety scan
We cloned langbot-app/LangBot at commit 1d3c47c on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious patterns and no committed binaries across 2,343 files and about 550,000 lines of Python and TypeScript. The two bare-IP URLs use 192.0.2.10, a reserved documentation address, in an OAuth test.
- 11 known advisories (2 critical, 5 high). The critical ones are in chromadb 1.5.9, pinned in uv.lock and used for the knowledge base, so update when a fixed release is available and do not expose the database separately. The rest are in the web panel's lockfiles.
- skills/package.json runs a bootstrap script on prepare, which only affects people developing the bundled agent skills. docker/deploy-k8s-test.sh is a Kubernetes test helper and uses no sudo.
- 15 workflows; the only pull_request_target one is the CLA assistant, which carries a comment forbidding checkouts and never runs PR code. 1 of 22 third-party actions pinned to a commit. Dependabot is on; no security policy file.
- Bots on personal QQ and WeChat accounts are not an official use of those platforms. Check the terms before connecting an account you care about.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script. 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 15 workflows. 1 uses pull_request_target, none check out the pull request head. 21 of 22 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often langbot.app, example.test, space.langbot.app, github.com. 2 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 11 advisories across 1,161 pinned packages: 2 critical, 5 high, 2 moderate, 2 low. uv.lock: 287 packages, 7 advisories; web/package-lock.json: 771 packages, 4 advisories; web/pnpm-lock.yaml: 681 packages, 2 advisories. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
URLs to bare IP addresses (2)
| Where | Rule | Match |
|---|---|---|
| tests/integration/api/test_user_space_oauth.py:202 | ip-literal-url | 'https://192.0.2.10/auth/space/callback', |
| tests/integration/api/test_user_space_oauth.py:207 | ip-literal-url | 'http://192.0.2.10:5300/auth/space/callback', |
npm lifecycle scripts (1)
skills/package.jsonprepare:node scripts/bootstrap-lbs.mjs
Installer scripts (2)
- docker/deploy-k8s-test.sh, 75 lines; talks to k3s.io, kind.sigs.k8s.io, kubernetes.io, minikube.sigs.k8s.io
- run_tests.sh, 32 lines
Worst known vulnerabilities (11 of 11)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-36p7-vc44-83pf | critical | chromadb@1.5.9 | ChromaDB has a code injection vulnerability |
| GHSA-f4j7-r4q5-qw2c | critical | chromadb@1.5.9 | ChromaDB Python project has a pre-authentication code injection vulnerability |
| GHSA-2wm9-hf6c-p5cr | high | chromadb@1.5.9 | ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection |
| GHSA-xph7-9rjv-w5fr | high | chromadb@1.5.9 | ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.32.7 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-23c5-xmqv-rm74 | high | minimatch@3.1.3 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| GHSA-mrhx-c7xc-m3w5 | high | zod@3.25.76 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-2g4f-4pwh-qvx6 | moderate | ajv@6.12.6 | ajv has ReDoS when using `$data` option |
| GHSA-48c2-rrv3-qjmp | moderate | yaml@2.8.2 | yaml is vulnerable to Stack Overflow via deeply nested YAML collections |
| GHSA-567q-5qvw-pf92 | low | filelock@3.32.7 | filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stal… |
| GHSA-9vhv-jxww-xfm5 | low | filelock@3.32.7 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database |
Workflows worth a look
- .github/workflows/cla.yml: pull_request_target
By the numbers
| Stars | 18.5K |
|---|---|
| Forks | 1,668 |
| Contributors | 116 |
| Commits | 4,648 |
| Open issues | 119 |
| Open pull requests | 24 |
| Releases | 216 |
| Latest release | v4.11.2 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 26, 2026 |
| Tracked files | 2,343 |
| Lines of code | 550.4K |
| Checkout size | 29 MB |
Lines by language: Python 318.3K, TypeScript 146.2K, Markdown 28K, JavaScript 22.9K, JSON 17.7K, YAML 14.7K.
Questions
Is LangBot free?
Yes. LangBot is Apache-2.0 and free to self-host. You pay your model provider per token, or nothing with Ollama or LM Studio. LangBot Cloud is the project's hosted option.
Which chat apps does LangBot support?
Discord, Telegram, Slack, LINE, Matrix, KOOK, Lark, DingTalk, WeCom, WeChat and QQ, plus Satori. Matrix bridges extend it further, to Signal, WhatsApp and others.
Can LangBot answer from my own documents?
Yes. It has a built-in knowledge base for retrieval, and it can also hand conversations to Dify, Coze, n8n or Langflow if you already have a workflow there.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.