One interface connects to many model and media backends
SillyTavern puts OpenAI, Claude, OpenRouter, Mistral, KoboldCpp, text-generation servers, and other providers behind one chat interface. Its reason to exist is control: character cards, personas, group conversations, lorebooks, prompt managers, swipe choices, translation, text to speech, and image generation can all shape a session. The browser layout also has a mobile mode and a visual-novel presentation for character-focused conversations.
The application does not include inference. SillyTavern says it offers no hosted service, so a useful session still needs a remote API or a local model server. That separation is good for choice and makes costs visible at the provider, but setup never ends with npm install. Users must select a connection type, store its credential, choose a model, and understand how prompt settings affect that backend. Image and voice features add their own endpoints.
Node.js 20 runs the interface; local models need separate hardware
The README sets Node.js 20 as the minimum for the user interface. Windows, macOS/Linux, Android through Termux, and Docker each have a dedicated installation guide. The UI itself can run on modest hardware. For local inference, the project suggests an NVIDIA 3000-series GPU with at least 6 GB of VRAM, while noting that the actual requirement depends on the chosen model and backend.
That recommendation should not be read as a capacity promise. Our sandbox measured only the application repository, not model downloads, token speed, or GPU memory use. A hosted API moves that cost elsewhere and introduces billing plus key management. A local server keeps prompts on your machine but adds model files and inference tuning. SillyTavern handles both routes once they exist; it does not size or operate them for you.
What happened when we ran it
Our sandbox installed commit 8172dcd in 19 seconds. Npm added 785 packages and used 400 MB on disk. The checkout already contained 988 files, about 193,327 lines of source, and 61.8 MB before installation. That is a large application despite the quick dependency step, so extension compatibility, configuration migration, and rollback deserve the same care as any other self-hosted web service.
There was no build script or target, so the lab skipped a build. The package also exposed no test script or target, and our test step was skipped. The repository scan still found a tests directory, 10 CI workflow files, and a Dockerfile. Those signals show project-side automation exists, but the checkout did not give our clean root workflow a command that produced a passed test count.
Npm audit reported 45 known vulnerabilities in the installed tree: 1 critical, 17 high, and 27 moderate. The audit output alone does not prove that each advisory is reachable through SillyTavern. It does set a concrete review burden for anyone exposing the server to a network. Pin the release, inspect the advisory paths on your deployment, and retest after dependency changes instead of treating the fast 19-second install as a security result.
A third-party extension already caused API-key theft
The maintainers' May 2026 security notice says the Bot Browser extension exploited a backup flaw that had already been patched in SillyTavern. Users who installed it on versions before 1.17.0 could have API keys exfiltrated. The notice tells those users to update and rotate their keys, and it treats every version before 1.17.0 as insecure. This is a recorded incident, not a hypothetical warning about plugins.
Version 1.18.0 added clearer extension categories and an extra confirmation before third-party extension installation. The maintainers still cannot inspect the whole external ecosystem. Their advice is practical: remove unused extensions, distrust code-like imported presets, avoid server plugins unless necessary, watch provider usage, and set low spending limits. SillyTavern gives extensions deep access because power users want deep customization. That same access raises the cost of a bad install.
Current chat-save reports make backups worth the trouble
Open issue 5941 describes a core path where an internal read error can return HTTP 200 with an empty object. The reporter argues that the client may then treat a healthy chat as empty and write a greeting over it; 84 of their 311 older chat files lacked the integrity marker that could block that overwrite. Issue 5955 separately asks for a visible saving indicator after reports of settings corruption during reloads or concurrent tabs.
Those are user reports rather than our lab results, and both remained open when checked. They are specific enough to change operating advice. Keep the data directory in regular backups, close duplicate tabs, and let saves finish before restarting. Character histories and lorebooks are the reason many people choose SillyTavern, so losing them is a more serious failure than briefly losing access to the interface.
August activity is strong despite a 600-item open queue
GitHub recorded the last push on August 26, 2026. The repository had 32,873 stars and 600 open issues and pull requests combined; GitHub search separated them into 440 issues and 160 pull requests. The README credits more than 300 contributors. This is an active project with enough surface area to keep a large queue, rather than a dormant release surviving on old popularity.
The latest tagged release was 1.18.0 on May 3, while the release branch continued receiving work in August. That gap makes the branch and tag distinction important during upgrades. SillyTavern is the right sort of complicated for a role-play power user who will use its prompt controls every day. The 45 audit findings, extension incident, and open save-path reports make it a poor fit for casual public hosting or a machine where provider credentials are left unmonitored.