# AstrBot (slim)

> AstrBot is an open-source chatbot and agent program that the owner runs and connects to messaging platforms such as QQ, Telegram, Slack, Discord, Lark and WeCom, with scheduled tasks, MCP tools, plugins and a web admin panel.

- Full: https://www.anchorterminal.com/tools/astrbot.md (~8,600 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/tools/astrbot.json · canonical https://www.anchorterminal.com/tools/astrbot
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**C · 58.8/100 · rank #584 of 986 · #8 in Personal assistants · not agent-ready · confidence medium**


Assessment: Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.

## Facts

- Kind: Agent harness · vendor: AstrBotDevs · category: Personal assistants · legal entity: not named · provenance 23/100
- Packages: pypi `astrbot`, oci `soulter/astrbot`
- Auth: OAuth or key · pricing: Free · x402: no · licence: AGPL-3.0-or-later
- Probe metrics: not measured yet (probes haven't run)
- What it is: A chatbot and agent program with a development framework for plugins. It answers in private and group chats on the platforms the owner connects, and it is a personal assistant only as far as the owner adds plugins or MCP servers for their own accounts
- Runs: On the owner's machine or server. `uv tool install astrbot` with Python 3.12 or later, the `soulter/astrbot` Docker image, a desktop app, or Kubernetes and panel installs (https://github.com/AstrBotDevs/AstrBot)
- Channels: Official adapters for QQ, OneBot v11, Telegram, WeCom and WeCom AI Bot, WeChat Official Accounts, Lark, DingTalk, Slack, Discord, LINE, Satori, KOOK, Misskey and Mattermost, plus a built-in web chat. Matrix, Rocket.Chat and VoceChat are community plugins. WhatsApp is listed as coming soon
- Acts without asking: Replies, `send_message_to_user`, `future_task` scheduling, web search and MCP tools all run with no approval prompt. A scheduled task wakes the agent, which may call paid models and send messages
- Approval controls: None per tool call. Per-persona tool selection, administrator IDs, a session whitelist, command permissions, and computer use off by default with role permissions
- Accounts: Bot credentials for each messaging platform and keys for model, search and sandbox providers. No built-in mail, calendar or file-storage connector. These come only through MCP servers or third-party plugins
- Credential storage: Platform tokens and provider keys are kept in `data/cmd_config.json` on the owner's disk. We found no encryption of them in the config code. Developer API keys and the panel password are stored as PBKDF2 hashes
- Memory: Conversation history and platform message history in SQLite (`data/data_v4.db`), a knowledge base on FAISS, and context compression. No built-in long-term memory of the owner was found. `/reset` clears a conversation's context, `/del` deletes it, and the panel and API delete conversations and sessions
- Model providers: OpenAI-compatible services, Anthropic, Google Gemini, DeepSeek, Moonshot, Zhipu and others, Ollama or LM Studio for local models, or a Dify, Coze, Bailian or DeerFlow agent in place of the built-in one. The chosen provider receives the conversation
- HTTP API: `/api/v1` on port 6185 since v4.18.0, with `abk_` keys, 11 scopes and two sensitive sub-scopes. OpenAPI file with 170 paths and 240 operations at https://github.com/AstrBotDevs/AstrBot/blob/master/docs/public/openapi.json and on the running server at `/api/v1/openapi.json`
- MCP client: stdio, SSE and Streamable HTTP, with custom headers for remote servers and a launcher allowlist for stdio
- Telemetry: On by default to tickstats.soulter.top. `ASTRBOT_DISABLE_METRICS=1` or `disable_metrics` in the config turns it off
- Cost: Free under AGPL-3.0. The owner pays the model provider and any search or sandbox service, or nothing with a local model. The EULA says the team sells nothing
- Releases in 90 days: About 15 tags from v4.26.6 (14 July 2026) to v4.29.0-beta.2 (11 October 2026). Latest stable v4.28.2 of 27 September 2026

- Scores: Reliability 81, Performance pending, Schema & documentation 62, Agent ergonomics 54, Security & auth 44, Payments & pricing 60, Task success pending, Maintenance & community 81, Transparency & trust 40 · negative events -2 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as software the owner runs. · Schema & documentation, Graded on what an outside agent reads, the HTTP API and the built-in tool definitions. · Agent ergonomics, Harness reading, scored on what an agent or pipeline driving it has to supply. · Security & auth, Harness reading of the framework checklist, as the Goose dossier uses. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v4.28.2, the latest stable release, is dated 27 September 2026, and v4.29.0-beta.2 followed on 11 October (30). · Transparency & trust, AGPL-3.0-or-later with the whole source public.
- Sources: 31, open questions: 11, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/astrbot.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/astrbot.svg` or a link to https://www.anchorterminal.com/tools/astrbot from a page on astrbot.app or one of its subdomains, or the README of github.com/AstrBotDevs/AstrBot, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `ASTRBOT_DISABLE_METRICS=1` before the first start. Statistics, including the hostname, are sent to tickstats.soulter.top by default
2. Set `dashboard.host` to 127.0.0.1 in `data/cmd_config.json`, or the `DASHBOARD_HOST` variable, unless remote access is intended. The default is 0.0.0.0
3. Create an `abk_` key in Settings, OpenAPI with only the scopes needed, and send it as `Authorization: Bearer` or `X-API-Key`
4. Include `username` in every `POST /api/v1/chat` body. Without the `chat:admin` scope an administrator ID is rejected
5. Check Extensions, Future Tasks after asking for a schedule. One-off tasks are deleted after their run even when the run fails

## Connect

```bash
uv tool install astrbot --python 3.12 && astrbot init && astrbot run
```

```bash
curl -N 'http://localhost:6185/api/v1/chat' -H 'Authorization: Bearer abk_xxx' -H 'Content-Type: application/json' -d '{"message":"Hello","username":"alice"}'
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)