mrkeyoor.com_
Wed 16 Sept 23:52 UTC
AI Toolsevaluationupdated 25 Aug 2026

AstrBot review

AstrBot is an open-source Python platform for putting an AI assistant inside chat systems such as Telegram, Slack, Discord, QQ, Feishu, and DingTalk. Its main README is in English, with Chinese, Japanese, French, Spanish, and Russian versions linked, and its documentation and release notes include substantial Chinese-language material.

+314stars / 7d
Verdict

Our AstrBot install and build finished in 82 seconds total, and pip-audit found 0 known vulnerabilities, but tests never started because pytest_asyncio was missing. AstrBot is a strong candidate for a multilingual, self-hosted assistant spanning several chat networks, especially the Chinese platforms its official adapters cover. Treat plugins, agent shell access, and every messaging credential as production security boundaries.

We ran it

Lab card: what happened when we ran AstrBotScreenshot of AstrBot (astrbot.app)
Install✓ · 76s172 packages · 471 MB
Build✓ · 6s
Tests✗ · 6sran, no count parsed
Known vulns0(pip-audit)
Repo1634 files~302,866 lines of source · 15.4 MB · 11 CI workflows · Dockerfile · tests dir

Answers from our run

Does AstrBot build from source?

Dependencies installed in 76 seconds (172 packages), and the build succeeded in 6 seconds. We cloned commit c6a14e0 into a clean Debian container with 3 CPUs and no project-specific setup.

Do AstrBot's tests pass?

The test command failed in our container, and its output did not report a pass or fail count.

Does AstrBot have known vulnerabilities in its dependencies?

pip-audit found none in the dependency tree at the time of our run.

Who should not use AstrBot?

Operators who need WhatsApp today: the support table labels it Coming Soon, while the listed Matrix, Rocket.Chat, and VoceChat adapters are community maintained.

What are the alternatives to AstrBot?

Rasa, Botpress, Open WebUI. Our AstrBot install and build finished in 82 seconds total, and pip-audit found 0 known vulnerabilities, but tests never started because pytest_asyncio was missing.

Setup4/5uv and Docker paths are clear; provider and chat credentials remain
Docs4/5English README plus several translations and deployment routes
Community5/5Recent release, same-week pushes, and a large plugin ecosystem
Maturity3/5Wide integrations, but our test environment missed a test dependency

Who it’s for

Self-hosters who want one assistant identity across several messaging platforms.
Teams connecting hosted or local language models to chat, knowledge bases, skills, and MCP tools.
Chinese-market deployments that need official adapters for QQ, WeCom, Feishu, DingTalk, or WeChat Official Accounts.
Python developers willing to inspect plugins and maintain provider and platform credentials.

Who it’s NOT for

Operators who need WhatsApp today: the support table labels it Coming Soon, while the listed Matrix, Rocket.Chat, and VoceChat adapters are community maintained.
Teams that cannot audit extensions: the README advertises more than 1,000 plugins, and one-click installation does not establish each plugin's safety or maintenance.
Organizations unwilling to run agent-generated code or shell calls: the sandbox isolates that capability, but enabling it still requires resource and permission policy.
Contributors expecting tests to run from the installed dependency set: our suite stopped in 6 seconds because pytest_asyncio was missing.
Closed-source distributors who have not reviewed AGPL 3.0 obligations for their deployment and modifications.

Setup reality

Our Python 3.12 install at commit c6a14e0 succeeded in 76 seconds, adding 172 packages and 471 MB. The build succeeded in 6 seconds. Tests exited 4 after 6 seconds because tests/conftest.py imported pytest_asyncio, which was not installed; no tests ran. Pip-audit reported 0 known vulnerabilities.

A useful bot needs at least one model provider or local model service plus credentials for each messaging platform. Knowledge bases, speech, web search, plugins, and sandboxed execution add their own services and trust decisions.

The repository includes Docker and Compose files, 11 CI workflows, and a tests directory. The checkout itself is 15.4 MB with 1,634 files and about 302,866 source lines.

AstrBot puts one agent in many chat networks

AstrBot connects language models, tools, knowledge bases, and personas to messaging platforms people already use. The official support table includes Telegram, Slack, Discord, QQ, WeCom, Feishu, DingTalk, WeChat Official Accounts, LINE, Mattermost, and several others. That breadth is its main selling point. A team can build one assistant workflow and expose it in more than one chat environment instead of maintaining a separate bot stack for each network.

The default GitHub README is English and links Simplified Chinese, Traditional Chinese, Japanese, French, Spanish, and Russian versions. Releases include English and Chinese notes. This multilingual effort helps international evaluation, although some linked deployment documentation uses Chinese paths or labels. Teams outside that language community should read the exact adapter guide they need before assuming every integration has equally complete English instructions.

The useful core is broader than message forwarding

AstrBot supports hosted model APIs from OpenAI, Anthropic, Google, DeepSeek, and others, plus local services such as Ollama and LM Studio. It also lists speech-to-text and text-to-speech providers, MCP, skills, multimodal conversations, context compression, a knowledge base, personas, a WebUI, and a browser chat interface. These pieces let a bot answer from private material or call tools rather than merely relaying prompts to one model.

The README advertises more than 1,000 plugins with one-click installation. That catalog can save integration work, but the number is not a security review. A plugin runs close to conversations, provider keys, platform tokens, and possibly tool execution. Check its repository, maintainer activity, requested permissions, network destinations, and update history. Pin approved versions where possible and test upgrades in a separate instance before exposing them to production chats.

What happened when we ran it

Our Python 3.12 install at commit c6a14e0 completed in 76 seconds. It installed 172 packages and occupied 471 MB on disk, while the repository checkout was 15.4 MB. The build completed in another 6 seconds on 3 CPUs and 8 GB of RAM. Pip-audit reported 0 known vulnerabilities in the installed environment, a useful point-in-time result rather than a promise about future dependencies or optional plugins.

Tests stopped after 6 seconds with exit code 4. Pytest could not load tests/conftest.py because importing pytest_asyncio raised ModuleNotFoundError. No tests ran, so there is no pass or failure count to report. The direct finding is a missing test dependency in our installed environment. We did not guess whether the package belongs in a development extra, lock group, or container layer because the log excerpt does not establish that.

Agent sandboxing reduces risk without removing it

AstrBot includes an agent sandbox for isolated code execution, shell calls, and session-level resource reuse. Isolation is the correct direction for an assistant allowed to act. Operators still decide what image runs, which files and networks it can reach, how long jobs live, and how much CPU or memory a session receives. A sandbox with host secrets mounted into it defeats the point.

Our run used an unprivileged container with no secrets, 3 CPUs, and 8 GB of RAM. A real bot will have messaging tokens and model credentials, so keep those outside tool execution wherever the architecture allows. Give each adapter its own narrowly scoped credential, rotate it independently, and avoid using an agent chat as the only way to administer the service. Logs may contain user messages or model output and need their own retention policy.

Platform coverage has explicit gaps

The support table distinguishes official and community adapters. Matrix, Rocket.Chat, and VoceChat are community maintained. WhatsApp is marked Coming Soon; that phrase is an aspiration in the current README, not a working adapter or a dated commitment. If one of those platforms is mandatory, test its exact adapter before choosing AstrBot. A broad logo list matters less than reliable delivery, reconnection, media handling, and permission behavior on the network your users depend on.

Version 4.27.4 was published on August 19, 2026. Its fixes covered preference loading, group-chat context, Telegram audio handling, dashboard behavior, knowledge-base uploads, and a Weixin customer-service webhook case. GitHub listed 1,442 open issues and pull requests on August 25, with a push that same day. The queue is not 1,442 verified bugs, but it does reflect a wide product surface and heavy activity.

Choose AstrBot for channel reach, then narrow it

AstrBot fits a technically capable self-hoster who needs an assistant across several supported messaging systems. The AGPL 3.0 license, Docker and Compose files, active releases, translated README, official adapters, and local-model support make serious evaluation reasonable. Its breadth should be constrained in deployment: enable only the providers, channels, plugins, and tool permissions the bot needs.

Rasa is better for controlled dialogue logic and explicit actions. Botpress suits teams preferring a visual managed builder. Open WebUI is the simpler comparison when users can work in a browser instead of chat networks. AstrBot wins when channel reach is the requirement, particularly around QQ, WeCom, Feishu, and DingTalk. Our missing pytest_asyncio result means contributors should verify the development dependency path before relying on the repository suite.

Alternatives

ProjectWhat it isPick it when
RasaA conversational AI framework centered on explicit assistants, intents, actions, and dialogue logic.pick this instead when controlled conversational flows matter more than a plugin-rich general agent.
BotpressA visual platform and runtime for building chatbots and agent workflows.pick this instead when a managed visual builder is preferable to operating a Python bot platform.
Open WebUI gh↗A self-hosted browser interface for local and hosted language models with tools and knowledge features.pick this instead when the primary interface is the web rather than existing messaging apps.

Sources

  1. AstrBot README
  2. AstrBot repository
  3. AstrBot v4.27.4 release
  4. AstrBot documentation

More ai tools reviews

eve · MemOS · LongCat-Video · Concat · DLSS5-Feeder · Concat · the whole board →