Open-LLM-VTuber puts a talking, animated character in front of a language model. You speak, it transcribes you, the model answers, and a Live2D avatar says the reply aloud with matching expressions. You can interrupt it mid-sentence without headphones, let it see your camera or screen, and run it in a browser or as a desktop pet that floats above other windows.
Every stage is swappable: Ollama, LM Studio, vLLM or any OpenAI-compatible API for the model, plus Claude, Gemini, DeepSeek and others; sherpa-onnx, Faster-Whisper, FunASR and more for speech recognition; and a long list of text-to-speech engines from Edge TTS to CosyVoice. With local choices for all three it runs with no internet connection. A character is a prompt plus a Live2D model, and both can be replaced.
It is MIT-licensed, with about 14,400 stars, at v1.2.1. Expect some setup: it is a Python project installed with uv. The README says the team's attention has moved to a v2.0 rewrite that is still being planned, and the last commit when scanned was in May 2026.
- Repository: github.com/Open-LLM-VTuber/Open-LLM-VTuber
- Licence: custom (Other)
- Language: Python. Stars: 14.4K. Forks: 1,732. Last push: May 15, 2026.
- Scan: safe, Oct 26, 2026, commit 992309c
Who it is for
Hobbyists who want a voice assistant with a face, VTubers experimenting with an AI co-host, and anyone who wants a private, offline voice chat with a local model.
Getting started
1. Clone it with its submodules (the --recursive flag is required)
git clone https://github.com/Open-LLM-VTuber/Open-LLM-VTuber --recursive2. Install dependencies with uv and copy the default config
cd Open-LLM-VTuber && uv sync && cp config_templates/conf.default.yaml conf.yaml3. Start the server, then open the address it prints in your browser
uv run run_server.pySet your model in conf.yaml first; the docs use Ollama as the example. The microphone only works over https when you open the page from another device, such as your phone.
Safety scan
We cloned Open-LLM-VTuber/Open-LLM-VTuber at commit 992309c on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries, no install scripts and no bare-IP URLs across about 51,000 lines, most of them Python and JSON.
- uv.lock carries 137 advisories, 6 critical, and these ship with the app: torch 2.2.2 (a torch.load code-execution bug), aiohttp 3.9.5, brotli, PyJWT and certifi among them. Most matter when the server faces untrusted traffic or loads untrusted model files, one more reason not to put it on the open internet.
- requirements.txt and requirements-bilibili.txt (for the optional Bilibili live-stream client) repeat largely the same pins, which is why the three lockfiles report overlapping totals.
- The outside hosts in the code are the model and voice APIs you can choose (OpenAI, Anthropic, Gemini, DeepSeek, Groq, ElevenLabs, Fish Audio and others) plus Hugging Face for model downloads. None is contacted unless you configure it.
- 6 workflows, none using pull_request_target; none of the 8 third-party actions is pinned to a commit. CodeQL and a contributing guide are present; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 6 workflows. None use pull_request_target. 8 of 8 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 21 distinct hosts referenced from source; most often github.com, repo.anaconda.com, huggingface.co, open-llm-vtuber.github.io. No URLs to bare IP addresses. |
| Known vulnerabilities | 191 advisories across 330 pinned packages: 6 critical, 62 high, 75 moderate, 48 low. requirements-bilibili.txt: 36 packages, 77 advisories; requirements.txt: 308 packages, 135 advisories; uv.lock: 310 packages, 137 advisories. |
| Project hygiene | Has CodeQL, licence file, contributing guide. Missing security policy, automated dependency updates. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 191)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-9v8h-qqgm-4m35 | critical | brotli@1.1.0 | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package |
| GHSA-53q9-r3pm-6pq6 | critical | torch@2.2.2 | PyTorch: `torch.load` with `weights_only=True` leads to remote code execution |
| CVE-2024-48063 | critical | torch@2.2.2 | |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.12.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.1.4 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-ffc3-869f-jxw9 | critical | pyjwt@2.10.1 | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guar… |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.9.5 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.9.5 | aiohttp server lacks an initial request/header timeout |
| GHSA-6mq8-rvhq-8wgg | high | aiohttp@3.9.5 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.9.5 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.9.5 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-2qfp-q593-8484 | high | brotli@1.1.0 | Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation |
| GHSA-9h52-p55h-vw2f | high | mcp@1.15.0 | Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default |
| GHSA-jpw9-pfvf-9f58 | high | mcp@1.15.0 | MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal |
| GHSA-vj7q-gjh5-988w | high | mcp@1.15.0 | MCP Python SDK: WebSocket server transport does not support Host/Origin validation |
| CVE-2025-55551 | high | torch@2.2.2 | |
| CVE-2025-55552 | high | torch@2.2.2 | |
| CVE-2025-55553 | high | torch@2.2.2 | |
| CVE-2025-55557 | high | torch@2.2.2 | |
| CVE-2025-55558 | high | torch@2.2.2 | |
| CVE-2025-55560 | high | torch@2.2.2 | |
| CVE-2026-4538 | high | torch@2.2.2 | |
| GHSA-63cw-57p8-fm3p | high | torch@2.2.2 | |
| CVE-2025-55551 | high | torch@2.8.0 |
By the numbers
| Stars | 14.4K |
|---|---|
| Forks | 1,732 |
| Contributors | 29 |
| Commits | 913 |
| Open issues | 111 |
| Open pull requests | 49 |
| Releases | 19 |
| Latest release | v1.2.1 |
| Licence | custom |
| Main language | Python |
| Project age | 2 years |
| Last push | May 15, 2026 |
| Tracked files | 253 |
| Lines of code | 51.5K |
| Checkout size | 24 MB |
Lines by language: JSON 29.1K, Python 17.6K, Markdown 2,088, YAML 2,069, JavaScript 530, HTML 143.
Questions
Is Open-LLM-VTuber free?
Yes. The code is MIT-licensed. The Live2D sample models bundled with it are under Live2D Inc.'s own free material licence, which adds conditions for commercial use by larger companies, so swap in your own model if you plan to use it commercially.
Can it run completely offline?
Yes, if you pick local options for all three parts: a model through Ollama, LM Studio or similar, local speech recognition such as sherpa-onnx or Faster-Whisper, and a local voice. Cloud APIs are optional for any part your hardware struggles with.
Does it need a GPU?
No, but it helps. It runs on CPU, supports NVIDIA and other GPUs, and some components accelerate on macOS. Speech recognition and the language model are the heavy parts, so a slow machine can hand those to a cloud API instead.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.