gptme 0.33.0 is broader than a coding agent
The repository reflects that scope. Our checkout had 1,533 files and roughly 413,355 lines of source at commit d27f98d. The project supports Anthropic, OpenAI, Google, xAI, DeepSeek, OpenRouter, subscription sign-in for some providers, and local models through llama.cpp. MCP servers can supply tools, while ACP lets supported editors launch gptme as a coding agent. This flexibility is the main reason to choose it, and also the reason configuration and permissions need deliberate work.
What happened when we ran it
Our sandbox installed 95 packages in 87 seconds and used 157 MB on disk. The build completed in 21 seconds. We ran Python 3.12 on Debian with 3 CPUs, 8 GB of RAM, no secrets, and an unprivileged user. The repository has 17 CI workflow files, a Compose file, and a tests directory. Pip-audit reported 0 known vulnerabilities in the installed Python environment.
The test step ran for 632 seconds and exited 1. Pytest's final line reported 9,557 passed, 27 failed, 220 skipped, 75 errors, and 6 subtests passed. The harness parser separately classified 3 collection or setup errors. The log tail names failures in the skills command tests, including show, search, and directory behavior, then prints several conversation-resume messages. It does not establish one cause for all 102 failures and errors, so we will not invent one.
The 157 MB install still needs a model and tool policy
The recommended install is pipx install gptme, with uv tool install gptme as another isolated option. Python 3.10 or newer is required. A hosted model needs an API key, OpenRouter browser setup, or a supported subscription login. A local model avoids that credential but needs a running llama.cpp-compatible endpoint and enough hardware for the selected model. Browser automation and the full extra set use separate install variants.
Our base install pulled 95 packages, while the README exposes tools that can reach the filesystem, shell, Python interpreter, browser, desktop, GitHub, and long-lived tmux sessions. Each extra changes the trust boundary. A personal laptop may already hold SSH keys, cloud credentials, browser sessions, and private repositories. Run gptme from the smallest directory that fits the task, keep secrets out of reachable context, and use a container or VM when the prompt or repository is untrusted.
Non-interactive mode removes the confirmation stop
gptme can auto-approve tool confirmations with -y, and -n runs without user interaction and implies no confirmation. The README presents this mode for scripts and CI. It also supplies a command that generates a user-level service and timer for persistent agents. Those are useful building blocks, but scheduling changes the risk: nobody is watching the proposed command, file edit, or network request before it happens.
Issue #3598 states the current boundary plainly: gptme runs with the user's permissions, and auto_confirm approves everything in headless mode. The issue proposes deterministic checks below the model for destructive commands, secret paths, and outbound hosts. Until such controls are installed and tested, prompt instructions, lessons, and model judgment should not be the only barrier around an unattended agent. Use operating-system accounts, filesystem permissions, network rules, credentials with narrow scopes, and a review step before external changes.
MCP, ACP, plugins, and lessons make customization unusually deep
MCP support is included in the default install, so gptme can discover and load external tool servers. ACP support is an optional extra that connects the same agent to Zed or JetBrains. Plugins add Python tools and hooks. Skills package instructions and helper scripts, while lessons inject guidance based on keywords or tool patterns. These layers let a user shape behavior without maintaining a fork of the core project.
The feature count can become its own maintenance job. Our 413,355-line checkout includes a server, web UI integration, desktop work, multiple provider adapters, automation helpers, and many tool paths. A plugin or MCP server can have the same authority as a built-in tool once the agent calls it. Pin extensions, read their source, record why each one is enabled, and remove tools that do not serve the task. A smaller callable set also makes approval prompts easier to understand.
Version 0.33.0 is active and still changing quickly
The latest release was v0.33.0, published on August 19, 2026. Its notes span provider work, ACP fixes, web UI compatibility, model identifiers, test changes, documentation, and refactoring. The repository was pushed again on August 26. GitHub listed 23 open issues and pull requests combined, with 4,398 stars and 416 forks. Current pushes plus a recent release show active maintenance rather than a project living on old attention.
The failed 632-second suite still matters. Passing 9,557 tests is strong evidence of engineering effort, while 27 failures and 75 errors mean our exact clean environment did not reproduce a release-ready result. Teams should run the areas they depend on, especially provider calls, skills, MCP loading, session recovery, server authentication, and headless behavior. A narrow acceptance suite around your actual workflow will be faster and more useful than assuming the full upstream result transfers to production.
Choose gptme when ownership of the agent is the point
gptme is attractive for a technical single user who wants model choice, terminal access, local conversation state, and the freedom to build a persistent workflow. It can be a coding assistant, research tool, shell helper, or scheduled agent without routing every task through one vendor's interface. The MIT license and documented extension layers make that ownership practical.
Our measurements put a sensible boundary around the recommendation: 157 MB installed and 0 known audit findings are manageable, while 632 seconds of tests still ended unsuccessfully. Start interactively, with confirmations enabled and a small tool set. Add MCP servers and plugins one at a time. Headless service mode should come last, after the agent runs under a restricted account and every external action has a policy outside its prompt.