LobeHub: A Self-Hosted Workspace for AI Agents (GitHub, Scanned)

LobeHub began as LobeChat, one of the best-looking ChatGPT-style interfaces on GitHub, and has grown into a workspace for agents. You build an agent by describing it, give it skills and MCP plugins from a library of more than 10,000, put several in a group to work on one task, schedule runs, and let them keep a structured, editable memory of how you work. It connects to OpenAI, Anthropic, Google and dozens of other providers, Ollama included, and the desktop app can drive coding agents such as Claude Code and Codex installed on your machine.

It is a Next.js and TypeScript code base of about 2.5 million lines (plus three million lines of JSON), built by LobeHub LLC with 357 contributors and 818 releases so far. You can use the hosted version at app.lobehub.com or self-host it with Docker. The licence is the LobeHub Community License: Apache-2.0 plus a condition that developing and distributing a derivative work needs a commercial licence.

• Repository: github.com/lobehub/lobehub
• Licence: custom (Other)
• Language: TypeScript. Stars: 82.8K. Forks: 15.9K. Last push: Sep 27, 2026.
• Scan: safe, Sep 27, 2026, commit 413ec82

Who it is for

Individuals and teams who want one good-looking interface for many model providers, people building multi-agent workflows without writing code, and self-hosters comfortable running a Postgres-backed Docker stack.

Getting started

1. Create a folder for the deployment

mkdir lobehub-db && cd lobehub-db

2. Run the setup script, which downloads the Compose file and writes a .env with generated keys

bash <(curl -fsSL https://lobe.li/setup.sh)

3. Start the stack

docker compose up -d

The short link redirects to docker-compose/setup.sh in the repository, 863 lines, which is run as is. It downloads the Compose file, SearXNG settings and an .env template from the project's GitHub and generates secrets such as the JWKS key; the only sudo in it is a printed hint about Docker group membership.

Safety scan

We cloned lobehub/lobehub at commit 413ec82 on Sep 27, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• Five secret hits, none a leak: two test keys in unit tests and two example AWS keys in the environment-variable docs. The fifth deserves a note: docker-compose/production/grafana/init_data.json seeds Casdoor, the login server in that variant of the stack, with a fixed RSA private key for signing tokens. Anyone deploying it unchanged shares a signing key with everyone else who did, so generate a new certificate first. The default setup script uses a different Compose file without Casdoor.
• 17 pattern hits. Thirteen are curl | sh install commands for third-party coding agents (Amp, Claude Code, Cursor, Devin, Factory, Kimi, OpenCode, Qoder, xAI) and for Ollama, in the table the desktop app displays as install instructions when a tool is missing, and in its tests. The other four are three long prompt or generated files and a Telegram webhook test.
• Install hooks: the desktop app's postinstall rebuilds Electron native modules, a macOS notifications package compiles its native addon on install, and the root prepare script points Git at the repository's hooks. The two binaries are epub test fixtures, and the seven bare-IP URLs are tests for the filter that recognizes private addresses.
• The main app's pnpm lockfile is git-ignored, so the advisory check only covered the desktop app's lockfile: one critical (tar 6.2.1, a build-time archive library) and 54 high, mostly in XML and URL parsing libraries. The web app's resolved dependency versions cannot be checked from the repository.
• 32 workflows. Two use pull_request_target (release tagging and pull request assignment) and neither checks out the pull request; none of the 37 third-party actions is pinned to a commit. Renovate, a security policy and a code of conduct are present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JSON 3.2M, TypeScript 2.5M, Markdown 167.7K, YAML 34.8K, JavaScript 13K, Shell 8,283.

Questions

Is LobeHub free?

The self-hosted version is free to run, including commercially as a service, under the LobeHub Community License. What the licence restricts is developing and distributing a derivative work based on it, which needs a commercial licence from LobeHub LLC. The hosted version at app.lobehub.com is a separate service run by LobeHub, and model usage is billed by whichever providers you connect.

Can LobeHub use local models?

Yes. Ollama is a built-in provider with its own setup guide in the app, and an OpenAI-compatible server such as vLLM, LocalAI or llama.cpp's can be used by overriding the OpenAI base URL. Hosted providers need your own API keys. Note that the README's API key section recommends a third-party OpenAI reseller through a referral link; a reseller sees every prompt you send through it.

LobeHub or Open WebUI?

Both are self-hosted chat front ends for many providers. Open WebUI is the usual choice in front of Ollama, with document search and a Python plugin system, and installs as one container. LobeHub leans toward hosted providers and agents, with groups, schedules, memory and a skills library in a more designed interface, but its Docker stack needs Postgres and object storage. Check both licences before rebranding either.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.