# DeepTutor (slim)

> DeepTutor is an open-source, self-hosted learning workspace from HKUDS for tutoring, quizzes, research reports and knowledge bases, with persistent memory and optional multiple users. It runs as a web app, and a deeptutor CLI emits NDJSON for other agents.

- Full: https://www.anchorterminal.com/tools/deeptutor.md (~10,450 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/tools/deeptutor.json · canonical https://www.anchorterminal.com/tools/deeptutor
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-30 · pricing https://www.anchorterminal.com/tools/deeptutor#pricing · reviews https://www.anchorterminal.com/tools/deeptutor#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**B · 62.7/100 · rank #494 of 1239 · #7 in Personal assistants · not agent-ready · confidence medium**


Assessment: DeepTutor runs on the owner's machine under Apache 2.0, ships releases every few days with upgrade notes, and gives other agents a JSON CLI with resumable sessions. Its default launch binds all interfaces with sign-in off and permissive CORS, there is no security policy, and two CVEs in 2026 covered a shell-tool RCE and a multi-user MCP bypass, both fixed.

## Facts

- Kind: Agent harness · vendor: HKUDS · category: Personal assistants · legal entity: not named · provenance 39/100
- Packages: pypi `deeptutor`, pypi `deeptutor-cli`
- Auth: None · pricing: Free · x402: no · licence: Apache-2.0
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: The owner's machine or server. PyPI `deeptutor` (core chat, CLI and SDK) and `deeptutor[full]` (web app and feature modules) for Python 3.11 to 3.14 with Node.js 20 or later, Docker images `ghcr.io/hkuds/deeptutor`, or a source checkout. No hosted service from the project was found
- Surfaces: Next.js web app on port 3782, FastAPI backend with HTTP and WebSocket routes on port 8001, interactive `deeptutor chat`, one-shot `deeptutor run` with NDJSON output, a Python SDK in the core package, and Partners answering on IM channels
- What it does: Tutoring chat, question and quiz generation, cited research reports, worked solutions, visualisations, video lessons, mastery paths, immersive reading of documents and video, generated books, a learning notebook, practice with spaced repetition, a task board and a calendar
- Knowledge bases: LlamaIndex (default), PageIndex, GraphRAG, LightRAG, LightRAG Server, WeKnora, Tencent IMA, MarginNote 4, Kiwix and linked Obsidian vaults, with versioned re-indexing, GitHub and documentation-site sync, and `deeptutor kb eval` retrieval metrics
- Memory: File-backed three layers. L1 workspace mirror and append-only event trace, L2 per-surface facts, L3 cross-surface synthesis, with a memory graph and `deeptutor memory show` and `clear`
- Acts without asking: The chat agent calls its tools when the model chooses, including `exec` for generated code inside the sandbox backend, `web_fetch`, memory writes and `consult_subagent`. Writes outside `outputs/` need an Allow once confirmation. Partner shell exec is off until an admin sets `allow_shell_exec`
- Other agents: Consults Claude Code, Codex, Grok CLI, Antigravity, Kimi, opencode, MiMo Code, Hermes Agent, OpenClaw or DeepSeek Harness on the same machine, and imports ChatGPT, Claude Code and Codex history as third-party transcripts
- Channels: Partners answer on Feishu, Telegram, Slack, Discord, DingTalk, QQ, WeCom, WhatsApp, Zulip, Mattermost, Matrix, Mochat and Microsoft Teams, depending on installed extras and credentials
- Credentials: Provider keys in `data/user/settings/model_catalog.json`. Codex and Copilot tokens under `data/system/user-secrets/<owner>/`, outside the trees the exec sandbox can reach, per the README
- Outbound traffic: The chosen model, embedding, search and speech providers, configured MCP services, IM channels, the EduHub and ClawHub skill hubs when used, a version check against GitHub's releases API, and npm metadata for Codex sign-in. No telemetry code was found in the files read
- Advisories: CVE-2026-51870 (critical, TutorBot shell tool in v1.4.0, closed in v1.4.1) and GHSA-jg88-rvpc-qvxj (CVE-2026-58168, high, multi-user MCP bypass before 1.4.10)
- Releases: v1.7.0 on 28 October 2026, v1.6.15 on 18 October, v1.6.14 on 8 October. 88 GitHub releases since v0.2.0 on 2 January 2026

- Scores: Reliability 78, Performance pending, Schema & documentation 71, Agent ergonomics 63, Security & auth 51, Payments & pricing 60, Task success pending, Maintenance & community 84, Transparency & trust 52 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as for nanobot and Vibe-Trading, since the owner runs it. · Schema & documentation, Harness reading of the lines, as for nanobot. · Agent ergonomics, Harness reading, scored on what an agent or script driving it has to supply. · Security & auth, Harness reading used for nanobot and Vibe-Trading. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v1.7.0 was published on 28 October 2026, two days before this check (30). · Transparency & trust, Apache 2.0 (30).
- Sources: 29, open questions: 14, both in the full twin
- Capabilities: assistant.memory, assistant.self-hosted, assistant.messaging, agent.mcp-client, knowledge.search, search.research, memory.user, document.write
- JSON: https://www.anchorterminal.com/api/v1/tools/deeptutor.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/deeptutor.svg` or a link to https://www.anchorterminal.com/tools/deeptutor from a page on deeptutor.info or one of its subdomains, or the README of github.com/HKUDS/DeepTutor, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: Discord https://discord.gg/eRsjPgMU4t; https://deeptutor.info/; https://github.com/HKUDS/DeepTutor/issues; more in the full twin

## Before you call it

1. Run `deeptutor run <capability> "..." --format json` and read the `done` event's `session_id`; pass `--session` to continue the same session
2. Configure with `deeptutor config apply setup.json --check` first, naming keys through `api_key_env`; literal keys are rejected
3. Before exposing it beyond one machine, enable sign-in in `auth.json`, set exact `cors_origins` and set `BACKEND_HOST=127.0.0.1` where loopback is wanted
4. Run 1.4.10 or later. Earlier versions carry CVE-2026-51870 (shell tool RCE, fixed in 1.4.1) and CVE-2026-58168 (multi-user MCP bypass)
5. Set `sandbox_allow_subprocess` to false where generated code must run only in the runner sidecar or bubblewrap

## Connect

```bash
pip install -U "deeptutor[full]"   # then: deeptutor init && deeptutor start   # or: docker run --rm -p 127.0.0.1:3782:3782 -v deeptutor-data:/app/data ghcr.io/hkuds/deeptutor:latest
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.6 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.6 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 68.2 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.4 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.8 | assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)