SillyTavern is a chat interface you install on your own computer and connect to whichever model you like. It does not run models itself. Instead it talks to local backends such as KoboldCpp, text-generation-webui, Ollama and TabbyAPI, or to hosted APIs from OpenAI, Anthropic, Google, Mistral, OpenRouter and many others, and gives all of them the same interface with your characters, chats and settings stored locally.
Its depth is the reason people use it. Characters come as shareable cards, world info and lorebooks inject background facts when keywords appear, group chats put several characters in one scene, and every part of the prompt is visible and editable. It can generate images through Automatic1111 or ComfyUI, speak replies with text-to-speech, show a Visual Novel mode with character sprites, and run on a phone through Termux. Extensions add more, and the team says outright that the steep learning curve is part of the fun.
It started in 2023 as a fork of TavernAI and is AGPL-3.0, with about 34,800 stars and over 400 contributors, at 1.19.0 when scanned. The project runs no hosted service and states that it does not track users.
- Repository: github.com/SillyTavern/SillyTavern
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: JavaScript. Stars: 34.8K. Forks: 6,535. Last push: Oct 2, 2026.
- Scan: safe, Oct 22, 2026, commit 06bde93
Who it is for
AI hobbyists who write interactive stories or roleplay with characters, people who switch between local and hosted models and want one interface for all of them, and anyone who wants full control over the prompt a model sees.
Getting started
1. Get the stable release branch (needs Git and Node.js 20 or newer)
git clone https://github.com/SillyTavern/SillyTavern -b release2. Install dependencies and start it (Windows: run Start.bat)
cd SillyTavern && ./start.sh3. Open the interface, then connect an API from the plug icon
open http://127.0.0.1:8000Update later with git pull inside the folder. The documentation site has guides for Windows, Android (Termux) and Docker. By default it only accepts connections from the same machine; read the remote access guide before changing listen or whitelist settings in config.yaml.
Safety scan
We cloned SillyTavern/SillyTavern at commit 06bde93 on Oct 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no committed binaries across 1,010 files and about 266,000 lines of JavaScript. The hosts in the code are the model and image APIs it supports.
- Safe defaults: config.yaml ships with listen set to false and whitelist mode on, so only 127.0.0.1 can connect until you change it. start.sh checks for Node.js and runs npm install; no sudo, no shell profile edits.
- 159 known advisories (5 critical, 77 high), 122 of them in the main package-lock.json that npm install uses. The criticals: two JavaScript injection flaws in Handlebars, which SillyTavern uses to fill in prompt templates, a risk if you load a template written by someone else; simple-git, used to install extensions by git URL; proxy-addr, which matters only behind a reverse proxy; and protobufjs, pulled in through an ONNX model library. Extensions run their own code anyway, so the same rule applies: install only what you trust.
- The other lockfiles cover the optional Electron wrapper (25) and the test suite (19).
- 10 workflows. Four use pull_request_target for labelling and merge-conflict checks, and none checks out the pull request; all 19 third-party actions are pinned to commits. Security policy, licence and contributing guide present; no Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 10 workflows. 4 use pull_request_target, none check out the pull request head. 0 of 19 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, api.openai.com, api.electronhub.ai, api.z.ai. No URLs to bare IP addresses. |
| Known vulnerabilities | 159 advisories across 1,006 pinned packages: 5 critical, 77 high, 66 moderate, 11 low. package-lock.json: 829 packages, 122 advisories; src/electron/package-lock.json: 70 packages, 25 advisories; tests/package-lock.json: 343 packages, 19 advisories. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (2)
- src/electron/start.sh, 12 lines
- start.sh, 17 lines; talks to nodejs.org
Worst known vulnerabilities (24 of 159)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-8r5x-fm3f-whwj | critical | handlebars@4.7.9 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| GHSA-p8wg-vrv2-v86f | critical | handlebars@4.7.9 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| GHSA-xq3m-2v4x-88gg | critical | protobufjs@6.11.4 | Arbitrary code execution in protobufjs |
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-x6jw-m9v5-85vh | critical | simple-git@3.33.0 | simple-git unsafe-operation guard does not block trailer command configuration |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@2.1.0 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@2.1.0 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@2.1.0 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@2.1.0 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@2.1.0 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-35jp-ww65-95wh | high | axios@1.15.2 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| GHSA-3pq3-5fj3-cg6v | high | axios@1.15.2 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
| GHSA-542g-h47m-68v8 | high | axios@1.15.2 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
| GHSA-777c-7fjr-54vf | high | axios@1.15.2 | Allocation of Resources Without Limits or Throttling in Axios |
| GHSA-gcfj-64vw-6mp9 | high | axios@1.15.2 | Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning |
| GHSA-hfxv-24rg-xrqf | high | axios@1.15.2 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| GHSA-j5f8-grm9-p9fc | high | axios@1.15.2 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
| GHSA-m8m8-qj5v-23w3 | high | axios@1.15.2 | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection |
| GHSA-mghh-pgcx-3jjj | high | axios@1.15.2 | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location |
| GHSA-p92q-9vqr-4j8v | high | axios@1.15.2 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
| GHSA-pjwm-pj3p-43mv | high | axios@1.15.2 | axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV… |
| GHSA-x97p-jq2g-jp4f | high | axios@1.15.2 | Axios: Prototype Pollution Gadget in axios toFormData Options |
| GHSA-c475-qrg2-pj4r | high | basic-ftp@5.3.1 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.14 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
Workflows worth a look
- .github/workflows/on-close-handler.yml: pull_request_target
- .github/workflows/on-open-handler.yml: pull_request_target
- .github/workflows/pr-auto-manager.yml: pull_request_target
- .github/workflows/pr-check-merge-conflicts.yaml: pull_request_target
By the numbers
| Stars | 34.8K |
|---|---|
| Forks | 6,535 |
| Contributors | 417 |
| Commits | 11.8K |
| Open issues | 450 |
| Open pull requests | 221 |
| Releases | 103 |
| Latest release | 1.19.0 |
| Licence | AGPL-3.0 |
| Main language | JavaScript |
| Project age | 3 years |
| Last push | Oct 2, 2026 |
| Tracked files | 1,010 |
| Lines of code | 266.3K |
| Checkout size | 62 MB |
Lines by language: JavaScript 197.2K, JSON 36K, CSS 15.8K, HTML 13.4K, YAML 1,937, Markdown 938.
Questions
Is SillyTavern free?
Yes. SillyTavern is free and open source under the AGPL-3.0 licence, with no paid tier or hosted service. You pay only for whatever model API you connect, or nothing if you run a local backend such as KoboldCpp or Ollama.
Does SillyTavern include a model?
No. It is a front end only. Pair it with a local backend (KoboldCpp, Ollama, text-generation-webui, TabbyAPI) or a hosted API key from OpenAI, Anthropic, Google, OpenRouter and others.
Can I use SillyTavern on my phone?
Yes, two ways. Android users can install it inside Termux following the official guide, and the interface is mobile-friendly. Or run it on a home computer and enable remote access with a whitelist or basic authentication, then open it from the phone's browser.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.