CVAT Community: self-hosted image, video and 3D annotation under the MIT licence
Computer Vision Annotation Tool (CVAT) is a leading platform for building high-quality visual datasets for vision AI. It offers open-source, cloud, and enterprise products, as well as labeling services, for image, video, and 3D annotation with AI-assisted labeling, quality assurance, team collaboration, analytics, and developer APIs.
At a glance
- What is it?
- CVAT Community is the self-hosted, MIT-licensed core of the CVAT annotation platform. It fits teams that need to keep visual data inside their own infrastructure and are willing to run Docker Compose, PostgreSQL and the surrounding stack themselves.
- Who is it for?
- Adopt CVAT Community if your visual data cannot leave your own infrastructure and you have someone who can run Docker Compose, create the superuser, and keep the server, database and browser clients current. Do not adopt it if you need the quality control UI, built-in SAM 2 or SAM 3 auto-labeling, SSO or AI agents, because the README places those in the paid CVAT Online plans and CVAT Enterprise.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository received new commits within the last day.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What CVAT Community actually solves, and for whom
The problem is not drawing boxes. It is drawing boxes on data you are not allowed to upload to somebody else's cloud, while keeping a record of who drew what and exporting the result in a format your training code already reads. CVAT Community addresses that by shipping the annotation server, the web UI and the deployment assets as a self-hosted stack. The README frames the pitch around ownership: run entirely within your own infrastructure, no data leaves your environment. That single sentence decides the audience. Research groups with ethics restrictions on video footage, medical and industrial teams with contractual data residency clauses, and platform engineers who already run Kubernetes or Docker Compose in-house are the natural fit. A two-person startup annotating a few hundred product photos is not. They can sign up for CVAT Online and skip the operational work entirely. The repository contains source and deployment assets for the community edition, which the README describes as the foundation of the commercial CVAT Online and CVAT Enterprise products. That lineage matters for anyone assessing longevity: the community edition is not a side project kept alive for marketing, it is the base layer the paid products are built on.
The mechanism: server, UI, database and a REST API in the middle
CVAT is a Python project. The default deployment is a Docker Compose stack rather than a single binary, and the README's install steps assume that shape: clone the repository, bring the services up, then create an admin account by running Django's createsuperuser inside the running server container. That command, python3 ~/manage.py createsuperuser executed inside cvat_server, tells you the server is a Django application. The web UI is served separately and is reachable on port 8080 by default. Everything the UI does is backed by a REST API, which the README lists as a first-class developer surface alongside the Python SDK and the command line tool. Data flows in one direction on the way in (images, videos or point clouds uploaded to a project or task, with labels defined up front), and out again through export in more than twenty formats including COCO, YOLO, Pascal VOC and KITTI. Cloud storage integration (S3, Azure, Google Cloud) means the media does not have to be copied into the server at all. On top of that sit the organisational layers: projects contain tasks, tasks split into jobs, jobs get assigned to annotators, and results can be compared across annotators with consensus, Ground Truth and Honeypot checks run through the server API.
Getting it running: three commands and one environment variable
The README's quick start is short. Prerequisites are Docker Engine, Docker Compose and Git. Then: git clone https://github.com/cvat-ai/cvat, cd cvat, docker compose up -d. If you are not on localhost, set CVAT_HOST to your IP or domain before bringing the stack up, which the README shows as an optional export. Once the containers are running, create the first account with docker exec -it cvat_server bash -ic 'python3 ~/manage.py createsuperuser'. Then open http://localhost:8080, or your CVAT_HOST value, and log in. That is the whole happy path. Two details in the README are easy to skim past and expensive to discover later. The first is the browser note: CVAT is primarily tested with Chromium-based browsers, Firefox may work with some caveats, and Safari or WebKit is not supported. If your annotation workforce is on Macs and expects Safari, that is a blocker before you write a single line of deployment config. The second is the pointer to separate deployment guides for AWS, Kubernetes, external PostgreSQL, backups and upgrades. The default Compose file is a starting point, not a production topology, and the README says so by linking out rather than pretending otherwise.
The line between the free edition and the paid ones
This is the section to read twice. The README is explicit that advanced project analytics, the quality control UI, built-in auto-labeling with SAM 2 and SAM 3, AI agents and SSO live in CVAT Online paid plans (Solo, Team) and CVAT Enterprise. What the community edition does include is the API-level version of quality control: consensus, Ground Truth and Honeypot checks are described as running through the server API. Read that carefully. You can build a review workflow, but you are building it against the API rather than clicking through a finished review interface. The same pattern applies to auto-labeling. The community edition supports connecting your own ML models for detection, segmentation and tracking, so the mechanism exists, but the packaged SAM 2 and SAM 3 integrations do not ship here. For an engineering team with a model server already running, that is a reasonable trade. For a labelling team that wants the assist features out of the box, the free edition will feel like it is missing the parts they saw in the demo. The README does not blur this boundary, which is worth crediting: many projects in this position quietly imply that everything is open source.
Where self-hosting stops being the right answer
The failure mode is operational, not functional. A self-hosted CVAT is a Django server, a database, a UI container, a queue for background jobs, and storage for media that grows with every video you upload. The README points to documentation for external PostgreSQL, backups and upgrades precisely because those are the tasks that decide whether the deployment survives its second year. Teams that treat docker compose up -d as the finished state usually discover the gap during an upgrade, when annotations and media have to be preserved across a schema change. There is also a licence detail that deserves attention rather than a footnote. The core is MIT, but the README states that some serverless assets and dependencies may have separate licences. If your legal review requires a clean per-file licence inventory, that sentence is the start of the work, not the end of it. The third limitation is scope. This is an annotation tool. It does not train models, it does not serve inference, and the analytics it ships are described as monitoring user activity, working time by job, events and server logs through Grafana dashboards. If you wanted a platform that also evaluates model accuracy against your ground truth, CVAT Community is one component in that pipeline, not the pipeline.
Label Studio, and the difference that matters
The obvious comparison is Label Studio, the other widely used open source annotation tool. The difference is in the data model and the depth of the video and 3D workflow. CVAT was built around video and frame-level annotation from the start, and the README lists 3D point cloud annotation as a first-class capability next to images and video, with cuboids among the supported shapes. Its organisational model is also more structured: projects contain tasks, tasks split into jobs, jobs are assigned to annotators, and review is a distinct stage. Label Studio takes a more configuration-driven approach, where you define a labelling interface as a template and the tool adapts to text, audio, images or video. That flexibility is real, and for teams annotating mixed modalities beyond vision it can be the deciding factor. The trade is that CVAT's opinionated hierarchy and its video tooling are built for vision datasets specifically, which is exactly the scope the README claims. Neither choice is wrong. If your data is images, video or point clouds and your team is large enough to need roles and job assignment, CVAT's model fits without configuration. If you are labelling text and audio alongside images, the template approach will cost you less.
Maintenance, upgrades and the licence question
Release cadence is visible in the repository: v2.74.1 on 2026-09-01, v2.74.0 on 2026-08-26, v2.73.0 on 2026-08-12. That is roughly a minor release every two weeks with patch releases in between, which means an upgrade path you have to own rather than a stable target you can freeze for a year. The README defers upgrade instructions to the deployment guides, so the practical question for any team is whether they can test an upgrade against a copy of their database before applying it to the instance their annotators are using. Budget for that, not for the install. On licensing, the core is MIT, which permits use, modification and distribution. The README's own caveat about serverless assets and dependencies having separate licences is the part to verify before shipping a modified build to a customer. Nothing here is legal advice, and the repository's licence files are the authority, not this article. The Python SDK and CLI install as ordinary packages with pip install cvat-sdk and pip install cvat-cli, which keeps the automation surface independent of how you deploy the server.
Who should run it, and what to check first
Run CVAT Community if your data cannot leave your infrastructure, your team annotates images, video or point clouds, and you have at least one engineer comfortable with Docker Compose, Django management commands and database backups. The API, Python SDK and CLI mean the tool can sit inside an existing pipeline rather than beside it, and the twenty-plus export formats mean the output lands in whatever your training code already consumes. Skip it if you need the packaged quality control interface, SAM 2 or SAM 3 auto-labeling, SSO or AI agents, because the README places those in the paid editions and no amount of self-hosting changes that. Skip it too if nobody on the team wants to own upgrades, since a release every couple of weeks is a commitment. Before you commit, do three things. Confirm your annotators have Chrome or Edge, because Safari is not supported. Read the repository's licence files for the serverless assets and dependencies the README flags. And read the deployment guides for external PostgreSQL, backups and upgrades before your first dataset is uploaded, not after.
Editorial conclusion
Adopt CVAT Community if your visual data cannot leave your own infrastructure and you have someone who can run Docker Compose, create the superuser, and keep the server, database and browser clients current. Do not adopt it if you need the quality control UI, built-in SAM 2 or SAM 3 auto-labeling, SSO or AI agents, because the README places those in the paid CVAT Online plans and CVAT Enterprise. Before committing, verify the licence status of the serverless assets and dependencies, since the README states they may carry separate licences, and check that your annotators can work in a Chromium-based browser.
Community notes