The official support table has 15 rows, with WhatsApp unfinished
AstrBot puts a language-model assistant inside the chat systems people already use. Its README lists 15 official rows, including Telegram, Slack, Discord, LINE, Mattermost, QQ, WeCom, Feishu, DingTalk, and WeChat Official Accounts, with WhatsApp marked Coming Soon. Matrix, Rocket.Chat, and VoceChat are community maintained. This is the reason to consider it: one agent can keep the same tools, knowledge, and persona across several networks instead of growing a separate bot stack for each one.
That channel reach comes with a wide application surface. AstrBot supports hosted model APIs, local Ollama and LM Studio servers, speech input and output, multimodal messages, a knowledge base, skills, MCP, personas, context compression, a WebUI, and browser chat. The project says its marketplace has more than 1,000 plugins. A small Telegram responder will use only a fraction of that system, while a multi-channel internal assistant can make the breadth pay for itself.
The 166-package install is the easy part
The quick start asks for Python 3.12 and uv: install the tool, initialize its environment once, then run it. Docker and Compose are documented as the steadier server route. The supplied Compose file exposes port 6185 for the WebUI and an optional port 6199 for a OneBot v11 WebSocket, while persisting AstrBot data in a local volume. A separate desktop application exists for people who mainly want ChatUI rather than a server.
A working assistant still needs at least one model connection and one chat-platform credential. OpenAI-compatible services, Anthropic, Gemini, DeepSeek, Ollama, and LM Studio are among the listed choices. Each extra channel brings its own bot registration, token, webhook, or network rules. Speech providers, web search, retrieval, and plugins add more secrets. AstrBot gathers those parts behind one control panel, but it cannot make the upstream accounts or their permission models disappear.
What happened when we ran it
Our sandbox installed commit b53999e in 104 seconds, pulling 166 packages and occupying 469 MB. The build completed successfully in 9 seconds. We used an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. Pip-audit found 0 known vulnerabilities in that installed environment. Those results cover repository setup, not message delivery, model quality, plugin safety, or response speed.
The test command failed after 9 seconds with exit code 4. Pytest tried to load tests/conftest.py, reached line 15, and raised ModuleNotFoundError: No module named 'pytest_asyncio'. No test count appeared because collection never started. The log does not establish why the package was absent, so calling this an application defect or a packaging mistake would go beyond the evidence. The useful finding is narrower: our fresh install did not produce a runnable stock test suite.
The repository itself is substantial: 1,768 files, roughly 341,975 source lines, and an 18.4 MB checkout before dependencies. Our scan found 11 CI workflow files, a Dockerfile, a Compose file, and a tests directory. That is evidence of active engineering structure, though it does not cancel the failed command. Contributors should reproduce the documented development environment and make the test dependency path explicit before treating a local build as ready to merge.
More than 1,000 marketplace plugins need separate review
AstrBot's agent sandbox is designed to isolate code execution, shell calls, and resources reused within a session. That is a sensible boundary for a bot allowed to act. Operators still choose what the sandbox can read, where it can connect, how long a job runs, and whether host credentials are visible. A 3 CPU and 8 GB lab container without secrets is much safer than a production bot holding platform tokens and model keys.
The project's EULA is unusually direct about plugins. It says marketplace plugins are third party, and the AstrBot team does not audit or guarantee them. It also says limited anonymous metrics may include feature frequency and error information; setting ASTRBOT_DISABLE_METRICS=1 turns collection off. Before enabling a plugin, inspect its code, maintainer activity, network destinations, and requested access. One-click installation reduces typing, not the consequences of installing untrusted code beside live conversations.
v4.28.2 is active, but WhatsApp remains unavailable
The v4.28.2 support table still marks WhatsApp as Coming Soon, with no date. Teams that need it now should walk away rather than convert that label into a delivery promise. The licensing decision also deserves review: GitHub reports AGPL-3.0, and the repository includes a separate EULA with content restrictions, safety terms, and acceptance on installation or use. A legal team should evaluate the exact texts for the intended distribution and service model.
Maintenance is clearly active. GitHub showed 41,226 stars, 1,100 open issues, and 469 open pull requests on September 30, 2026. The last push was September 29, and v4.28.2 shipped on September 27 with fixes for SQLite datetime handling and message-history cleanup outside UTC. Recent issue and pull-request activity covered Telegram command routing, provider reloads, media paths, and background-task logs. The 1,569 combined queue is large, but the dates show a project being worked on rather than an abandoned backlog.
AstrBot is a good fit when channel coverage is the hard requirement. Narrow the deployment to the adapters, providers, plugins, and tool permissions you can support, then test real message and media flows on every chosen network. Our 104-second install and 9-second build say evaluation is practical. The missing pytest_asyncio result says contributors should settle the development test path before depending on it as a release gate.