mrkeyoor.com_
Thu 17 Sept 23:18 UTC
AI Toolsevaluationupdated 26 Aug 2026

byterover-cli review

ByteRover CLI gives coding agents a persistent project memory made from files and facts you curate. It runs as a local command-line tool and web interface, can share memory through ByteRover Cloud, and exposes an MCP server for compatible agents.

+5stars / 7d
Verdict

Our ByteRover run passed all 8,910 tests, but installing it pulled 1,673 packages and npm audit found 46 known vulnerabilities, including 16 high-severity findings. Try it for reviewed, portable coding-agent memory if your team will inspect each curation result and can absorb its 1,006 MB dependency footprint. Do not make it the sole record of project decisions until the open false-success and content-substitution reports are resolved and verified in your workflow.

We ran it

Lab card: what happened when we ran byterover-cliScreenshot of byterover-cli (docs.byterover.dev)
Install✓ · 101s1673 packages · 1006 MB
Build✓ · 52s
Tests✓ · 222s8910 passed · 0 failed of 8910 (mocha)
Known vulns460 critical · 16 high · 11 moderate · 19 low (npm audit)
Repo2038 files~315,399 lines of source · 13.4 MB · 4 CI workflows · tests dir

Answers from our run

Does byterover-cli build from source?

Dependencies installed in 101 seconds (1673 packages), and the build succeeded in 52 seconds. We cloned commit 1052ac1 into a clean Debian container with 3 CPUs and no project-specific setup.

Do byterover-cli's tests pass?

Yes: 8910 of 8910 passed when we ran the project's own test command (mocha). Some failures need services or credentials a bare container does not have.

Does byterover-cli have known vulnerabilities in its dependencies?

npm audit flagged 46 known advisories in the dependency tree at the time of our run.

Who should not use byterover-cli?

Companies planning to resell ByteRover as a hosted service: Elastic License 2.0 forbids providing a substantial set of its features as a managed service.

What are the alternatives to byterover-cli?

Mem0, Graphiti, Letta. Our ByteRover run passed all 8,910 tests, but installing it pulled 1,673 packages and npm audit found 46 known vulnerabilities, including 16 high-severity findings.

Setup3/5101-second install pulled 1,673 packages and used 1,006 MB
Docs4/5Broad command and provider coverage, though the README is dense
Community4/54,948 stars with active issue discussion after the last push
Maturity3/58,910 tests pass, but curation correctness reports are serious

Who it’s for

Developers who repeatedly explain the same architecture and conventions to coding agents.
Teams willing to review proposed memory changes before other agents rely on them.
Claude Code, Cursor, and MCP users who want one context store across several tools.
Local-model users prepared to configure an OpenAI-compatible provider and tune longer request limits.

Who it’s NOT for

Companies planning to resell ByteRover as a hosted service: Elastic License 2.0 forbids providing a substantial set of its features as a managed service.
Teams that treat agent memory as an unquestioned source of truth: issue 757 reports supplied curation text being replaced with unrelated internal content.
Automation that trusts a zero exit code alone: issue 767 shows a curate operation reporting success after its only write failed schema validation.
Headless Docker users who need the web interface on a network address: issue 715 says it binds to 127.0.0.1 with no configurable host.
Security-sensitive teams unable to carry dependency remediation: our npm audit found 46 known vulnerabilities, including 16 high-severity findings.

Setup reality

Our sandbox install succeeded in 101 seconds, pulling 1,673 packages and using 1,006 MB. The build passed in 52 seconds. Tests took 222 seconds, with all 8,910 Mocha tests passing; npm audit reported 46 known vulnerabilities, including 16 high, 11 moderate, and 19 low.

The bundled installer needs no separate Node runtime on supported macOS and Linux builds; npm installation requires Node 20 or newer. Useful work still needs a chosen LLM provider, its credentials or a reachable local server, a project directory, and optional ByteRover login credentials for cloud sync.

ByteRover runs a daemon and stores project state under a global data directory plus .brv project data. Settings changes require a restart. The web interface's localhost binding limits headless or container access, according to open issue 715.

ByteRover stores coding context across agent sessions

ByteRover CLI addresses the amnesia built into most coding chats. It keeps project facts in a context tree that agents can query later, adds a review queue for proposed changes, and offers branch, commit, merge, push, and pull operations for that memory. The same store can serve a terminal REPL, a local web interface, and an MCP connection. That makes it useful when a developer moves between Claude Code, Cursor, and other compatible tools but wants one maintained account of the codebase.

The breadth comes with weight. Our checkout contained 2,038 files and roughly 315,399 source lines before installation. The CLI includes a daemon, React-based terminal interface, web dashboard, 24 built-in agent tools, connections for 20 model providers, cloud sync, connectors, and a package hub. A team should approach it as another development service with state and credentials, not as a small prompt file that can be copied into a repository and forgotten.

Reviewed curation is safer than automatic memory writing

The strongest product decision is the pending-review workflow. A developer can curate a fact, inspect the proposed operation, and approve or reject it before the context tree changes. That matters because stored guidance outlives the chat that created it. A wrong authentication convention or stale deployment command can be repeated by every connected agent. Version-control commands also give the context tree branches and history, which helps teams discuss a memory change instead of editing an opaque database record.

Those controls only help when people use them. The installed tree reached 1,006 MB in our sandbox, and the runtime can execute code, read and write files, and call model providers. Credentials may include an OpenAI, Anthropic, Google, or another provider key, plus a ByteRover Cloud key for team sync. Local providers avoid sending prompts to a hosted model, but they still require a reachable service and enough time for agent loops. ByteRover's documented defaults allow 10 minutes per task and 2 minutes per model request.

What happened when we ran it

Our clean Debian sandbox installed commit 1052ac1 in 101 seconds. Npm added 1,673 packages and occupied 1,006 MB on disk. The build succeeded in 52 seconds. This is a straightforward result in the sense that no manual repair was needed, but the dependency count and disk use are high for a command-line memory tool. Budget both in CI images and developer machines before adopting it across a team.

The test command ran for 222 seconds and Mocha reported 8,910 passed with 0 failures out of 8,910. That is unusually substantial executable coverage for this category. Npm audit gave the less comfortable result: 46 known vulnerabilities, split into 16 high, 11 moderate, and 19 low, with none critical. The audit does not prove an exploitable path in ByteRover, but it gives maintainers a concrete dependency queue that security-conscious adopters should review before exposing the daemon or processing sensitive repositories.

Curation can report success without preserving the requested fact

Open issue 767 documents a sharp automation hazard in version 3.16.1. A bracketed label led the curator to produce a category outside its accepted enum. The individual write failed validation, yet the task was marked completed and the CLI printed a success message with zero facts added. A script that checks only process status can silently lose memory. Until fixed, integrations should inspect operation results and confirm that the intended fact appears in a follow-up query.

Issue 757 is more serious for human-reviewed use. Its reporter submitted several targeted curation entries and found that 5 of 6 initial cases produced unrelated internal workflow content; one contrast case worked. The report says review tasks looked plausible while representing the wrong source material. It does not establish that every provider or project suffers. It does establish a reason to compare each proposal with the submitted text before approval, especially when the tree is treated as source-of-truth documentation.

Local operation still depends on provider and daemon behavior

The packaged shell installer supports macOS and Linux on x64 and ARM64 without a separate Node installation. The npm path needs Node 20 or newer and covers other platforms. First run selects a model provider, while cloud collaboration requires login. The daemon reads settings at startup, so changing concurrency or timeouts takes a restart. Project data and global state also need a backup policy if the memory is valuable.

Slow local models expose another edge. Issue 765 reports a curate operation hanging during its second model step and says restarting the daemon temporarily clears the condition. The report names a local LM Studio setup and offers a suspected connection-pool cause, which remains the reporter's diagnosis rather than a confirmed project finding. Issue 715 separately says the web UI binds to localhost, preventing ordinary access through a published Docker port. Headless users should verify both behaviors before designing a shared internal service.

Elastic License 2.0 limits hosted resale

GitHub's license field did not identify an SPDX license, while the repository's LICENSE file is Elastic License 2.0. It permits use, copying, distribution, and modification under stated conditions. It also prohibits offering third parties a hosted or managed service that exposes a substantial set of the software's features. Internal use and commercial resale are different questions here, so product teams should read the license before building ByteRover into a customer-facing platform.

The repository had 4,948 stars and 23 combined open issues and pull requests when fetched. Its last push was June 25, 2026, while issue discussion continued in August. Release 3.16.1 arrived May 27 and fixed login state being lost across restarts. That activity does not settle the curation correctness reports. With 8,910 passing tests, the engineering base is credible; with 46 audit findings and open cases where memory can be wrong or absent, adoption should stay supervised.

Alternatives

ProjectWhat it isPick it when
Mem0 gh↗A developer platform and library for adding memory to AI applications.pick this instead when you are building memory into your own application rather than curating a coding-agent context tree.
Graphiti gh↗A temporal knowledge-graph framework for agent memory and changing facts.pick this instead when relationships and time-aware retrieval matter more than a ready-made coding CLI.
LettaAn agent framework centered on stateful agents and editable memory.pick this instead when you want to build and host the whole agent, not only supply memory to existing coding tools.

Sources

  1. ByteRover CLI repository and README
  2. ByteRover CLI 3.16.1 release
  3. ByteRover Elastic License 2.0
  4. Curation content substitution report
  5. False-success curation report

More ai tools reviews

rowboat · skills · superpowers-zh · yolov5 · eve · MemOS · the whole board →