# DeepTutor > DeepTutor is an open-source, self-hosted learning workspace from HKUDS for tutoring, quizzes, research reports and knowledge bases, with persistent memory and optional multiple users. It runs as a web app, and a deeptutor CLI emits NDJSON for other agents. - Canonical: https://www.anchorterminal.com/tools/deeptutor - Pricing: https://www.anchorterminal.com/tools/deeptutor#pricing - Reviews: https://www.anchorterminal.com/tools/deeptutor#reviews - Markdown: https://www.anchorterminal.com/tools/deeptutor.md (~10,450 tokens) - Slim: https://www.anchorterminal.com/tools/deeptutor.min.md (~1,930 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/deeptutor.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-10-30 ## Overview **Grade B · 62.7/100 · rank #494 of 1239 · #7 in Personal assistants · not agent-ready · confidence medium** ## Assessment DeepTutor runs on the owner's machine under Apache 2.0, ships releases every few days with upgrade notes, and gives other agents a JSON CLI with resumable sessions. Its default launch binds all interfaces with sign-in off and permissive CORS, there is no security policy, and two CVEs in 2026 covered a shell-tool RCE and a multi-user MCP bypass, both fixed. ## Facts | Field | Value | | --- | --- | | Vendor | HKUDS (https://deeptutor.info) | | Kind | Agent harness | | Category | Personal assistants (https://www.anchorterminal.com/categories/personal-assistants) | | Auth | None · No account with the project. The owner adds model provider keys in Settings or through `deeptutor config apply` with `api_key_env` naming an environment variable, or signs in to OpenAI Codex (OAuth), GitHub Copilot (device login) or CodeBuddy. Web sign-in is off by default; with `auth.json` enabled the first registered user becomes admin and grants models, knowledge bases, skills, tools and MCP access to other users (https://github.com/HKUDS/DeepTutor/blob/main/README.md). | | Pricing | Free (Free · OSS) · Free under the Apache 2.0 licence, and the README says the project has no paid online products. The owner pays the chosen model, embedding and search providers, or nothing with a local model through Ollama, LM Studio, llama.cpp, vLLM or Lemonade. The README carries a PageIndex discount code and an API Route provider preset, both third parties (checked 2026-10-30). | | x402 | No · No x402, MPP or L402 in the README, SKILL.md or the developer handbook (checked 2026-10-30). | | Licence | Apache-2.0 | | Packages | pypi: `deeptutor`; pypi: `deeptutor-cli` | | Source | https://github.com/HKUDS/DeepTutor | | Docs | https://deeptutor.info/ | | llms.txt | not found | | Last release | 2026-10-28 | | GitHub stars | 51,497 (as of 2026-10-30) | | Where it runs | The owner's machine or server. PyPI `deeptutor` (core chat, CLI and SDK) and `deeptutor[full]` (web app and feature modules) for Python 3.11 to 3.14 with Node.js 20 or later, Docker images `ghcr.io/hkuds/deeptutor`, or a source checkout. No hosted service from the project was found | | Surfaces | Next.js web app on port 3782, FastAPI backend with HTTP and WebSocket routes on port 8001, interactive `deeptutor chat`, one-shot `deeptutor run` with NDJSON output, a Python SDK in the core package, and Partners answering on IM channels | | What it does | Tutoring chat, question and quiz generation, cited research reports, worked solutions, visualisations, video lessons, mastery paths, immersive reading of documents and video, generated books, a learning notebook, practice with spaced repetition, a task board and a calendar | | Knowledge bases | LlamaIndex (default), PageIndex, GraphRAG, LightRAG, LightRAG Server, WeKnora, Tencent IMA, MarginNote 4, Kiwix and linked Obsidian vaults, with versioned re-indexing, GitHub and documentation-site sync, and `deeptutor kb eval` retrieval metrics | | Memory | File-backed three layers. L1 workspace mirror and append-only event trace, L2 per-surface facts, L3 cross-surface synthesis, with a memory graph and `deeptutor memory show` and `clear` | | Acts without asking | The chat agent calls its tools when the model chooses, including `exec` for generated code inside the sandbox backend, `web_fetch`, memory writes and `consult_subagent`. Writes outside `outputs/` need an Allow once confirmation. Partner shell exec is off until an admin sets `allow_shell_exec` | | Other agents | Consults Claude Code, Codex, Grok CLI, Antigravity, Kimi, opencode, MiMo Code, Hermes Agent, OpenClaw or DeepSeek Harness on the same machine, and imports ChatGPT, Claude Code and Codex history as third-party transcripts | | Channels | Partners answer on Feishu, Telegram, Slack, Discord, DingTalk, QQ, WeCom, WhatsApp, Zulip, Mattermost, Matrix, Mochat and Microsoft Teams, depending on installed extras and credentials | | Credentials | Provider keys in `data/user/settings/model_catalog.json`. Codex and Copilot tokens under `data/system/user-secrets//`, outside the trees the exec sandbox can reach, per the README | | Outbound traffic | The chosen model, embedding, search and speech providers, configured MCP services, IM channels, the EduHub and ClawHub skill hubs when used, a version check against GitHub's releases API, and npm metadata for Codex sign-in. No telemetry code was found in the files read | | Advisories | CVE-2026-51870 (critical, TutorBot shell tool in v1.4.0, closed in v1.4.1) and GHSA-jg88-rvpc-qvxj (CVE-2026-58168, high, multi-user MCP bypass before 1.4.10) | | Releases | v1.7.0 on 28 October 2026, v1.6.15 on 18 October, v1.6.14 on 8 October. 88 GitHub releases since v0.2.0 on 2 January 2026 | | Capabilities | assistant.memory, assistant.self-hosted, assistant.messaging, agent.mcp-client, knowledge.search, search.research, memory.user, document.write | | Tags | open-source, self-hosted, local, free, python, apache-2.0, cli, harness, docker, mcp-client, rag, no-card | | JSON | https://www.anchorterminal.com/api/v1/tools/deeptutor.json | ## Score breakdown (methodology v0.7, October 2026 research run) Assessed 2026-10-30 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 78 | 15.6 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 71 | 11.5 | | Agent ergonomics | 13% | 16.2 | 63 | 10.2 | | Security & auth | 14% | 17.5 | 51 | 8.9 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 84 | 7.3 | | Transparency & trust (editorial 65, provenance 39) | 7% | 8.8 | 52 | 4.5 | | Negative events | up to −15 | up to −15 | 2026-09-30. CVE-2026-51870 (critical on NVD). Command execution through the TutorBot shell tool's `ExecTool.execute` in v1.4.0, reported in issue #506. v1.4.1 of 27 May 2026 lists it closed with a shell RCE (#518), a filesystem path traversal (#517) and three authorisation bypasses (#514 to #516), and makes shell exec opt-in. Fixed within five days and documented in release notes, -2. https://nvd.nist.gov/vuln/detail/CVE-2026-51870 2026-06-30. GHSA-jg88-rvpc-qvxj (CVE-2026-58168, high). Before 1.4.10, a user grant without `mcp_tools` let non-admin users in multi-user mode invoke every configured MCP tool. Single-user installs were unaffected. Fixed in 1.4.10 of 21 June 2026 with deny-by-default MCP access, -1. https://api.osv.dev/v1/vulns/GHSA-jg88-rvpc-qvxj | -3 | | **Total** | | | | **62.7 → B** | ### Why each score - Reliability 78 (checked 2026-10-30): Read with the local-software lines, as for nanobot and Vibe-Trading, since the owner runs it. `deeptutor` and `deeptutor[full]` install from PyPI for Python 3.11 to 3.14 with Node.js 20 or later stated, and versioned images are on GHCR. The PyPI page answered with a bot check and wasn't read; the PyPI release workflow on main succeeded on 28 October 2026 (20). A Tests workflow runs on pushes and pull requests to main, dev and preview and nightly, with about 1,000 Python test files and about 440 web test files in the tree. The latest runs on main passed on 28, 29 and 30 October, but the nightly run failed every night from 20 to 28 October and once on push on 28 October (15 of 25). 141 open issues and 127 open pull requests on 30 October 2026, with recent issues labelled bug or enhancement. Issue threads weren't read, a judgement call (15 of 25). CONTRIBUTING.md ties conventional commits to minor and patch bumps, and release notes carry Upgrade Notes, with the 1.6.3 front and back-end refactor and the 1.7.0 package split called out as breaking (13 of 15). Version 1.7.0, with 1.0 reached in April 2026 (15). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 71 (checked 2026-10-30): Harness reading of the lines, as for nanobot. The FastAPI backend serves FastAPI's OpenAPI file on the owner's host (`/openapi.json` is named in SECURITY_GUARD.md), `deeptutor plugin info ` prints a tool's schema, and `config apply` validates against a documented field table. No published OpenAPI file or tool manifest outside the running program (18 of 25). llms.txt on deeptutor.info couldn't be checked because its robots.txt disallows ClaudeBot and anthropic-ai. The repository has SKILL.md, AGENTS.md and a Markdown developer handbook in docs-for-dev (5 of 10). SKILL.md says when to use the CLI and lists every command with its options, and AGENT_SETUP.md says what each check proves and what it doesn't, such as that `doctor --online` does not verify embedding (14 of 20). CLI options are typed with documented choices (`--format rich|json`, `--mode`), but capability settings pass as free `--config key=value` pairs or `--config-json` (9 of 15). Many worked examples, a troubleshooting method and a reasoning-safety checklist, with exit code 2 documented for invalid setup JSON and no full table of exit codes or error events (11 of 15). 88 GitHub releases with dated notes, per-version release files in the repository and upgrade steps (14 of 15). - Agent ergonomics 63 (checked 2026-10-30): Harness reading, scored on what an agent or script driving it has to supply. Driven through the CLI rather than as an MCP server. SKILL.md is about 12,800 characters, and NDJSON output streams every `content`, `tool_call` and `tool_result` event with no documented filter for a final answer only (15 of 25). `kb search` takes a mode and `kb eval` a top-k, `session list` takes `--limit`, and modules can be disabled to shrink the surface, with no documented cap on streamed output (12 of 20). `doctor --format json` reports each check, `config apply` emits JSON and exits with code 2, failed retrieval cases are reported apart from scores, and quota and catalogue errors are reported as they are (13 of 20). `--session` resumes a session, the turn runtime is described as restart-safe with recoverable streams, interrupted LlamaIndex rebuilds resume from checkpoints, the ChatGPT import is idempotent, and `ask_user` resolves with an empty reply when there is no TTY (13 of 20). `pip install`, `deeptutor init --non-interactive` and `deeptutor start` start it with default ports, a model provider must be configured first, and the SDK is Python only beside the HTTP API (10 of 15). - Security & auth 51 (checked 2026-10-30): Harness reading used for nanobot and Vibe-Trading. 30 for what leaves the machine and who can reach it by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the files read; `services/llm/telemetry.py` only writes debug and warning log lines. Outbound calls the README names are the chosen providers, skill hubs when used, a version check against GitHub's releases API and npm metadata for Codex sign-in. `deeptutor start` and `deeptutor serve` bind the backend to 0.0.0.0 and the launcher sets the frontend `HOSTNAME` to 0.0.0.0, sign-in is off by default, and with sign-in off `main.py` sets CORS to any http or https origin with credentials. Provider keys sit in plain JSON under `data/user/settings/`, while OAuth tokens sit outside the sandbox's reach (12). Execution is read-only outside `outputs/`, copies elsewhere need an Allow once confirmation, a runner sidecar or bubblewrap isolates code when present, and the restricted subprocess fallback is allowed by default and labelled best effort. Partner shell exec is off until an admin enables it, MCP tools are deny-by-default for non-admins, and skill imports pass a gate that checks the hub's verdict and strips `always:` (13). Imported conversations are read as third-party transcripts, web search results are filtered to public http and https URLs with optional domain lists, and the README says API keys never pass through the model. No general guidance on untrusted text in fetched pages or documents was found (7). L1 memory is an append-only event trace, multi-user mode keeps audit records and grants, tool activity streams to an Activity panel, and usage accounting persists (11). No SECURITY.md, no private reporting route and no repository-published advisory. The two CVEs were filed by outside parties, and fixes were listed in release notes with issue numbers. CONTRIBUTING.md names pip-audit, Bandit and a secrets baseline (6). - Payments & pricing 60 (checked 2026-10-30): Read with the self-hosted rule. No payment protocol (0). Free under the Apache 2.0 licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. The README says the project has no paid online products, and it runs with a local model through Ollama, LM Studio, llama.cpp, vLLM or Lemonade with no sign-up. The PageIndex discount code and the API Route preset in the README are third parties' products and are not scored. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 84 (checked 2026-10-30): v1.7.0 was published on 28 October 2026, two days before this check (30). 27 GitHub releases in the 90 days to 30 October, v1.5.8 to v1.7.0 (20). The lead maintainer has 1,723 commits and the first page of contributors lists 27 other people with eight or more, against 141 open issues and 127 open pull requests. Thread replies weren't read, a judgement call (17 of 25). Not an MCP server, so the registry line does not apply. A Python SDK in the core package, versioned GHCR images and matching feature wheels ship from the same repository (11 of 15). Dependencies carry version bounds and feature wheels must match the core version, but no Dependabot configuration was found and nightly tests failed for nine nights in October (6 of 10). - Transparency & trust 52 (checked 2026-10-30): Apache 2.0 (30). There is no hosted service, so no privacy policy is needed. DATA_STORAGE.md names where settings, credentials, chat history, memory, knowledge bases, logs and audit records live, says SQLite is the only supported database and says every backup is sensitive. Nothing was found stating what each provider receives beyond the README's provider list (16 of 30). Release notes carry Upgrade Notes, and renames and retirements are dated (TutorBot to Partners in 1.4.3, Co-Writer to the Learning notebook and `deeptutor-cli` to a compatibility alias in 1.7.0). No deprecation policy or notice period (9 of 20). No telemetry was found in the files read, and the version check has a settings toggle, but the docs read carry no statement on telemetry (10 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (27 items): https://www.anchorterminal.com/fixes/deeptutor.md (JSON https://www.anchorterminal.com/fixes/deeptutor.json) ### What we couldn't check - Category. personal-assistants, as the lead suggested, because DeepTutor works for one person (or a small group) over their own materials, remembers them and answers on IM channels. It is a tutor rather than a general assistant over mail and calendar, and no learning or education category exists in data/categories.json. local-ai was the other candidate. Judgement call. - Kind is `harness`, the kind used for nanobot and Vibe-Trading, since it is an agent program the owner runs that other agents drive through its CLI. Graded with the local-software Reliability lines, the harness reading of Schema, Ergonomics and Security, and the self-hosted Payments rule. - firstReleased is 29 December 2025, the date the README gives for the official release. The repository was created on 28 December 2025 and the first GitHub release, v0.2.0, is dated 2 January 2026. Nothing shows the code was public before 29 December. - deeptutor.info. Its robots.txt disallows ClaudeBot, Claude-Web and anthropic-ai, so the site is off-limits. /llms.txt and /.well-known/security.txt were requested in the same command as robots.txt, before it was read, and both answered 404; nothing from those two responses is used here, and both are recorded as unchecked. The docs site's terms, privacy page and Agent Handoff page are unchecked. - unchecked: PyPI release dates, versions and classifiers. pypi.org answered with a bot check, which we didn't try to pass. Release dates are from GitHub releases. - unchecked: issue and pull request threads, so responsiveness rests on counts and labels on the issues page. - unchecked: the whole source for outbound calls. Only the files named in sources were read, since the project was neither cloned nor run. No telemetry was found in them. - unchecked: whether the version check is on by default. `app_update.py` calls GitHub's releases API, and the launcher refers to an update-check toggle in system.json. - The 0.0.0.0 binding with sign-in off and credentialed permissive CORS is a reading of `run_server.py`, `launcher.py` and `main.py` on main. It was not tested. The README's Docker examples publish ports on 127.0.0.1 only. - Deduction of 3 for two CVEs in the last 12 months, both fixed and listed in release notes, weighed against nanobot's -6 and Vibe-Trading's -4. CVE-2026-51870 was published by NVD four months after the v1.4.1 fix and NVD lists no fixed version; v1.4.1's notes name issue #506 as closed. Judgement call. - No SECURITY.md was found and the repository has no published advisories; GHSA-jg88-rvpc-qvxj is a reviewed GitHub advisory database entry, read through OSV. - The README lists a personal email address for the lead maintainer as the contact. It is left out of the humans file under the rule on personal email addresses. - Our own products. DeepTutor doesn't do LocalGhost's job (a personal AI server archiving the owner's photos, location and health data) or letme's (choosing tools from our grades). Graded the normal way. - No legal entity was established. HKUDS is a GitHub organisation for the Data Intelligence Lab at the University of Hong Kong. ### Sources - repository metadata (created 28 December 2025, Apache-2.0, default branch, open issue and pull request total): (seen 2026-10-30) - releases (88, v0.2.0 on 2 January 2026 to v1.7.0 on 28 October 2026, with notes): (seen 2026-10-30) - repository tree on main (file layout, workflows, no SECURITY.md): (seen 2026-10-30) - contributors: (seen 2026-10-30) - repository security advisories (none published): (seen 2026-10-30) - workflow runs on main (Tests, Repository Hygiene, PyPI Release): (seen 2026-10-30) - README (capabilities, install paths, CLI, multi-user, sandbox, maintainers, release list): (seen 2026-10-30) - SKILL.md (CLI handover for agents): (seen 2026-10-30) - agent setup guide: (seen 2026-10-30) - developer handbook index: (seen 2026-10-30) - optional request screening (fastapi-guard) guide: (seen 2026-10-30) - local data persistence guide: (seen 2026-10-30) - tools and capabilities and reasoning-safety guides: (seen 2026-10-30) - API entry point (CORS settings with sign-in off): (seen 2026-10-30) - backend server launcher (binds 0.0.0.0): (seen 2026-10-30) - full-app launcher (backend and frontend bind 0.0.0.0): (seen 2026-10-30) - Dockerfile (BACKEND_HOST and FRONTEND_HOST default 0.0.0.0, non-root user): (seen 2026-10-30) - LLM telemetry module (local logging only): (seen 2026-10-30) - version check and update service (GitHub releases API): (seen 2026-10-30) - pyproject.toml (package, Python range, modules, dependencies): (seen 2026-10-30) - Tests workflow: (seen 2026-10-30) - CONTRIBUTING.md (versioning, security tooling): (seen 2026-10-30) - open issues and pull requests pages: (seen 2026-10-30) - OSV record for GHSA-jg88-rvpc-qvxj (CVE-2026-58168): (seen 2026-10-30) - NVD record for CVE-2026-51870: (seen 2026-10-30) - NVD record for CVE-2026-58168: (seen 2026-10-30) - deeptutor.info robots.txt (disallows ClaudeBot, Claude-Web and anthropic-ai): (seen 2026-10-30) - RDAP for deeptutor.info (registered 20 May 2026): (seen 2026-10-30) - GitHub robots.txt: (seen 2026-10-30) ## Score history Every move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/deeptutor/history.json - 2026-10-30: graded 62.7 B (methodology 0.7) ## Who's behind it (provenance 39/100, checked 2026-10-30) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | not found | 0/20 | | Domain age | deeptutor.info, registered 2026-05-20 (under a year) | 0/15 | | Endpoint on the vendor's domain | no hosted endpoint | n/a | | Terms of service | nothing hosted, so the Apache-2.0 licence stands in | 10/10 | | Privacy policy | nothing hosted, not scored | n/a | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | could not be fetched | 0/10 | | People named | 4 named with their role, 4 with a public profile | 10/10 | | Support route | help pages, a community | 5/5 | No legal entity is named. The repository belongs to the GitHub organisation HKUDS, the Data Intelligence Lab at the University of Hong Kong, and the README says the project is led by Bingxi Zhao within the HKUDS group. deeptutor.info's robots.txt disallows ClaudeBot, Claude-Web and anthropic-ai, so its pages were not read. Its terms, privacy page and security.txt are unknown. No SECURITY.md was found in the repository tree on 30 October 2026. RDAP gives a registration date of 20 May 2026 for deeptutor.info. The README dates the docs site's launch to 22 May 2026. There is no hosted endpoint. The API answers on the owner's own host. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The Apache-2.0 licence stands in and the check scores in full. **Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored. ## Humans behind the project (researched 2026-10-30 from public pages, not part of the grade) ### Key people - Bingxi Zhao, Project lead and maintainer, DeepTutor. GitHub: https://github.com/pancacake - Xingyu Hou, Maintainer, DeepTutor. GitHub: https://github.com/TyrionH-is-coding - Jiahao Zhang, Maintainer, DeepTutor. GitHub: https://github.com/zzhtx258 - Chao Huang, Director, Data Intelligence Lab at the University of Hong Kong (HKUDS). LinkedIn: https://www.linkedin.com/in/chao-huang-208993177/. X: https://x.com/huang_chao4969 - Note: deeptutor's readme names bingxi zhao, xingyu hou and jiahao zhang as maintainers with their github accounts, says the project is led by bingxi zhao within the hkuds group, and thanks chao huang as director of the data intelligence lab at hku. citation.cff lists bingxi zhao, jiahao zhang, xubin ren, zirui guo, tianzhe chu, yi ma and chao huang as authors of the arxiv paper 2604.26962. chao huang's entry, linkedin, x and bio are carried over from the hkuds humans file for nanobot of 28 october 2026. the readme's contact is a personal email address, left out. hkuds is a university lab, so no investors were looked for; the readme says the project has no paid products. - HKUDS: GitHub https://github.com/HKUDS ### Getting support - Discord: https://discord.gg/eRsjPgMU4t - Help: https://deeptutor.info/ - Help: https://github.com/HKUDS/DeepTutor/issues - Community (GitHub Discussions): https://github.com/HKUDS/DeepTutor/discussions - Community (WeChat group): https://github.com/HKUDS/DeepTutor/issues/78 - Community (Feishu and WeChat groups): https://github.com/HKUDS/DeepTutor/blob/main/Communication.md - Sources: https://github.com/HKUDS/DeepTutor/blob/main/README.md, https://github.com/HKUDS/DeepTutor/blob/main/CITATION.cff, https://github.com/HKUDS/DeepTutor/blob/main/Communication.md, https://raw.githubusercontent.com/HKUDS/.github/main/profile/README.md, https://github.com/HKUDS ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - Apache 2.0, self-hosted, and the README says the project sells nothing - `deeptutor run ... --format json` streams NDJSON tagged with `session_id`, and `--session` chains turns headlessly - SKILL.md and AGENT_SETUP.md give an agent a non-interactive setup path with `config apply --check` and `doctor --format json` - Releases every few days with dated notes and upgrade steps, 27 in the 90 days to 30 October 2026 - Inspectable file-backed memory with an append-only L1 trace, and grants, audit records and per-user isolation in multi-user mode ## Weaknesses - The default launch binds the backend to 0.0.0.0 with sign-in off and CORS open to any origin with credentials - No SECURITY.md, no private reporting route and no repository-published advisories, while two CVEs were assigned in 2026 - The `exec` sandbox falls back to a best-effort restricted subprocess by default when no runner or bubblewrap is present - Nightly test runs on main failed every night from 20 to 28 October 2026 before passing again on 29 and 30 October - Provider keys are stored in plain JSON under `data/user/settings/` ## Before you call it (notes for agents) 1. Run `deeptutor run "..." --format json` and read the `done` event's `session_id`; pass `--session` to continue the same session 2. Configure with `deeptutor config apply setup.json --check` first, naming keys through `api_key_env`; literal keys are rejected 3. Before exposing it beyond one machine, enable sign-in in `auth.json`, set exact `cors_origins` and set `BACKEND_HOST=127.0.0.1` where loopback is wanted 4. Run 1.4.10 or later. Earlier versions carry CVE-2026-51870 (shell tool RCE, fixed in 1.4.1) and CVE-2026-58168 (multi-user MCP bypass) 5. Set `sandbox_allow_subprocess` to false where generated code must run only in the runner sidecar or bubblewrap ## Connect Install: ```bash pip install -U "deeptutor[full]" # then: deeptutor init && deeptutor start # or: docker run --rm -p 127.0.0.1:3782:3782 -v deeptutor-data:/app/data ghcr.io/hkuds/deeptutor:latest ``` Headless / CI: ```json { "command": "deeptutor run chat \"$TASK\" --format json" } ``` ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | ZeroClaw | BB | 70.6 | 168 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/zeroclaw.md | | NanoClaw | B | 68.6 | 235 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanoclaw.md | | Hermes Agent | B | 68.2 | 255 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/hermes-agent.md | | OpenClaw | B | 67.4 | 288 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/openclaw.md | | IronClaw | B | 66.8 | 309 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/ironclaw.md | | nanobot | B | 63 | 483 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanobot.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The README calls it an agent-native learning workspace. Chat, Ask Questions, Quiz, Research, Visualize, Solve, Mastery Path, Immersive Reading, Audio Overview and Video Lesson share one capability runtime and session context (source: ) - `deeptutor run "" --format json` streams NDJSON, one event per line (`content`, `tool_call`, `tool_result`, `done`), each tagged with `session_id`, and `--session` continues a session. With no TTY an `ask_user` pause resolves with an empty reply instead of hanging (source: ) - A root SKILL.md and docs-for-dev/AGENT_SETUP.md are written for an outside agent installing and driving it. `deeptutor config apply setup.json --check` validates a setup without writing settings, emits JSON and exits with code 2 on invalid input, and literal keys or credentials in URLs are rejected (source: ) - `deeptutor start` and `deeptutor serve` bind the backend to 0.0.0.0, sign-in is off by default, and with sign-in off the API's CORS setting accepts any http or https origin with credentials (source: ) - Generated code runs through one `exec` tool on the strongest available backend, a runner sidecar, Linux bubblewrap or a restricted subprocess fallback that is allowed by default and shown as best effort. Execution is read-only outside `outputs/`, and copying a file elsewhere needs an Allow once confirmation (source: ) - CVE-2026-51870 (critical, NVD, published 30 September 2026) covers command execution through the TutorBot shell tool in v1.4.0. The v1.4.1 notes of 27 May 2026 list it (#506) with a shell RCE, a path traversal and three authorisation bypasses as closed, and make shell exec opt-in (source: ) - GHSA-jg88-rvpc-qvxj (CVE-2026-58168, high, published 30 June 2026) let non-admin users in multi-user mode invoke unrestricted MCP tools before 1.4.10, which made MCP tools deny-by-default for non-admins on 21 June 2026 (source: ) - No SECURITY.md or private reporting route was found in the repository, and the repository security-advisories endpoint listed no published advisories on 30 October 2026 (source: ) - The README dates the official release to 29 December 2025. The repository was created on 28 December 2025 and the first GitHub release, v0.2.0, is dated 2 January 2026. 88 releases to v1.7.0 on 28 October 2026 (source: ) - HKUDS also publishes nanobot and Vibe-Trading, both listed here. DeepTutor does neither LocalGhost's job nor letme's. It is a learning workspace, and it rates or routes no tools - #7 of 52 in Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md - All 1196 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md ## Compare - [asaply vs DeepTutor](https://www.anchorterminal.com/compare/asaply-vs-deeptutor.md): F 7.8 vs B 62.7 - [Asmi vs DeepTutor](https://www.anchorterminal.com/compare/asmi-vs-deeptutor.md): F 33.2 vs B 62.7 - [AstrBot vs DeepTutor](https://www.anchorterminal.com/compare/astrbot-vs-deeptutor.md): C 59 vs B 62.7 - [Boba vs DeepTutor](https://www.anchorterminal.com/compare/boba-vs-deeptutor.md): F 10.3 vs B 62.7 - [Brea vs DeepTutor](https://www.anchorterminal.com/compare/brea-vs-deeptutor.md): F 12.7 vs B 62.7 - [Atticus vs DeepTutor](https://www.anchorterminal.com/compare/atticus-vs-deeptutor.md): E 43 vs B 62.7 - [Boski vs DeepTutor](https://www.anchorterminal.com/compare/boski-vs-deeptutor.md): F 26.1 vs B 62.7 - [Caddy vs DeepTutor](https://www.anchorterminal.com/compare/caddy-app-vs-deeptutor.md): F 16.7 vs B 62.7 - [Claude Duet vs DeepTutor](https://www.anchorterminal.com/compare/claude-duet-vs-deeptutor.md): F 17.8 vs B 62.7 - [CowAgent vs DeepTutor](https://www.anchorterminal.com/compare/cowagent-vs-deeptutor.md): C 58.7 vs B 62.7 - [DeepTutor vs Del](https://www.anchorterminal.com/compare/deeptutor-vs-del.md): B 62.7 vs F 20.5 - [DeepTutor vs folk](https://www.anchorterminal.com/compare/deeptutor-vs-folk-nozomio.md): B 62.7 vs F 19.7 - [DeepTutor vs GAIA](https://www.anchorterminal.com/compare/deeptutor-vs-gaia.md): B 62.7 vs D 49.7 - [DeepTutor vs Gemini Spark](https://www.anchorterminal.com/compare/deeptutor-vs-gemini-spark.md): B 62.7 vs F 24.9 - [DeepTutor vs Grok Bot](https://www.anchorterminal.com/compare/deeptutor-vs-grok-bot.md): B 62.7 vs F 24.3 - [DeepTutor vs Hark Pro](https://www.anchorterminal.com/compare/deeptutor-vs-hark-pro.md): B 62.7 vs F 21.9 - [DeepTutor vs Haven](https://www.anchorterminal.com/compare/deeptutor-vs-haven.md): B 62.7 vs F 22.3 - [DeepTutor vs Hermes Agent](https://www.anchorterminal.com/compare/deeptutor-vs-hermes-agent.md): B 62.7 vs B 68.2 - [DeepTutor vs HireAlpha](https://www.anchorterminal.com/compare/deeptutor-vs-hirealpha.md): B 62.7 vs F 8.7 - [DeepTutor vs Instinct](https://www.anchorterminal.com/compare/deeptutor-vs-instinct.md): B 62.7 vs F 7.5 - [DeepTutor vs IronClaw](https://www.anchorterminal.com/compare/deeptutor-vs-ironclaw.md): B 62.7 vs B 66.8 - [DeepTutor vs LearnHarness](https://www.anchorterminal.com/compare/deeptutor-vs-learnharness.md): B 62.7 vs C 59.3 - [DeepTutor vs Leon](https://www.anchorterminal.com/compare/deeptutor-vs-leon.md): B 62.7 vs E 41.3 - [DeepTutor vs Lindy](https://www.anchorterminal.com/compare/deeptutor-vs-lindy.md): B 62.7 vs F 32.5 - [DeepTutor vs Lobby](https://www.anchorterminal.com/compare/deeptutor-vs-lobby-os.md): B 62.7 vs F 11.2 - [DeepTutor vs nanobot](https://www.anchorterminal.com/compare/deeptutor-vs-nanobot.md): B 62.7 vs B 63 - [DeepTutor vs NanoClaw](https://www.anchorterminal.com/compare/deeptutor-vs-nanoclaw.md): B 62.7 vs B 68.6 - [DeepTutor vs Natura tinyNature](https://www.anchorterminal.com/compare/deeptutor-vs-natura.md): B 62.7 vs F 14.9 - [DeepTutor vs Dots](https://www.anchorterminal.com/compare/deeptutor-vs-openai-dots.md): B 62.7 vs F 28.8 - [DeepTutor vs OpenClaw](https://www.anchorterminal.com/compare/deeptutor-vs-openclaw.md): B 62.7 vs B 67.4 - [DeepTutor vs OpenDuet](https://www.anchorterminal.com/compare/deeptutor-vs-openduet.md): B 62.7 vs D 49.5 - [DeepTutor vs OpenInstinct](https://www.anchorterminal.com/compare/deeptutor-vs-openinstinct.md): B 62.7 vs F 21.9 - [DeepTutor vs Orbits](https://www.anchorterminal.com/compare/deeptutor-vs-orbits.md): B 62.7 vs F 15.7 - [DeepTutor vs Orchid](https://www.anchorterminal.com/compare/deeptutor-vs-orchid-ai.md): B 62.7 vs F 20.2 - [DeepTutor vs Pally](https://www.anchorterminal.com/compare/deeptutor-vs-pally.md): B 62.7 vs F 37.7 - [DeepTutor vs PicoClaw](https://www.anchorterminal.com/compare/deeptutor-vs-picoclaw.md): B 62.7 vs D 46.2 - [DeepTutor vs Poke](https://www.anchorterminal.com/compare/deeptutor-vs-poke.md): B 62.7 vs F 37.7 - [DeepTutor vs QwenPaw](https://www.anchorterminal.com/compare/deeptutor-vs-qwenpaw.md): B 62.7 vs B 62.4 - [DeepTutor vs szn](https://www.anchorterminal.com/compare/deeptutor-vs-szn.md): B 62.7 vs F 7.8 - [DeepTutor vs Tab](https://www.anchorterminal.com/compare/deeptutor-vs-tab-bot.md): B 62.7 vs F 10.6 - [DeepTutor vs Talorys](https://www.anchorterminal.com/compare/deeptutor-vs-talorys.md): B 62.7 vs F 29.4 - [DeepTutor vs Tasker AI](https://www.anchorterminal.com/compare/deeptutor-vs-tasker-ai.md): B 62.7 vs F 7.6 - [DeepTutor vs Tomo](https://www.anchorterminal.com/compare/deeptutor-vs-tomo.md): B 62.7 vs F 13.2 - [DeepTutor vs Town](https://www.anchorterminal.com/compare/deeptutor-vs-town.md): B 62.7 vs D 48.7 - [DeepTutor vs Wajo (Fo)](https://www.anchorterminal.com/compare/deeptutor-vs-wajo.md): B 62.7 vs E 43.9 - [DeepTutor vs Zapia](https://www.anchorterminal.com/compare/deeptutor-vs-zapia.md): B 62.7 vs F 17.3 - [DeepTutor vs ZeroClaw](https://www.anchorterminal.com/compare/deeptutor-vs-zeroclaw.md): B 62.7 vs BB 70.6 - [DeepTutor vs Zo Computer](https://www.anchorterminal.com/compare/deeptutor-vs-zo-computer.md): B 62.7 vs E 43.2 - [AI Job Search vs DeepTutor](https://www.anchorterminal.com/compare/ai-job-search-vs-deeptutor.md): D 46 vs B 62.7 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on deeptutor.info or one of its subdomains, or the README of github.com/HKUDS/DeepTutor. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "deeptutor", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html DeepTutor on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![DeepTutor on Anchor Terminal](https://www.anchorterminal.com/badges/deeptutor.svg)](https://www.anchorterminal.com/tools/deeptutor) ``` Plain link: ```html DeepTutor on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say DeepTutor is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/deeptutor-dark.png - Light: https://www.anchorterminal.com/assets/share/deeptutor-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=deeptutor --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp