LibreChat: a self-hosted multi-provider chat stack whose agents can now run Bash

One interface over named providers and any OpenAI compatible endpoint

LibreChat is a web chat interface modelled on ChatGPT that talks to many backends at once. Built-in providers are Anthropic, AWS Bedrock, OpenAI, Azure OpenAI, Google, Vertex AI and the OpenAI Responses API, including on Azure. Beyond those, custom endpoints accept any OpenAI compatible API without a proxy. The compatible list covers local and remote services: Ollama, AMD Lemonade, groq, Cohere, Mistral AI, Apple MLX, koboldcpp, together.ai, OpenRouter, Helicone, Perplexity, ShuttleAI, Deepseek and Qwen. The v0.8.8 release added GPT-6 Astra and GPT-6.1 Sol with Responses API routing and tool calls.

Configuration is split between two files. Secrets and server settings sit in .env, starting from .env.example, where the server defaults to HOST=localhost and PORT=3080 and MongoDB to mongodb://127.0.0.1:27017/LibreChat. Endpoint definitions live in librechat.yaml, with librechat.example.yaml as the template. Model switching inside one conversation is the reason most people deploy it rather than a single vendor's app.

The compose stack is five services, and the default image tag is dev

docker-compose.yml runs the api container, named LibreChat, alongside mongodb, meilisearch, a rag_api service and an admin-panel container on port 3000 by default. The api waits on mongodb and rag_api, reaches Meilisearch at http://meilisearch:7700, and runs as the host user through ${UID}:${GID}. It mounts your .env file and four host directories: images, uploads, logs and skill, plus a named librechat-data volume.

Two details deserve attention. The file opens with a warning not to edit it directly and to put changes in a docker-compose.override.yaml instead, using docker-compose.override.yml.example as a guide; edits made to the main file are overwritten on update. The api image is registry.librechat.ai/librechat-ai/librechat-dev:latest, a dev tag, so a plain pull follows development builds. A separate deploy-compose.yml backs the deployment scripts:

docker compose -f ./deploy-compose.yml up -d

One-click templates also exist for Railway, Zeabur and Sealos, and a helm directory sits in the repository for Kubernetes.

User management and balances run from Node scripts

LibreChat is multi-user, and much of the administration happens from the command line rather than a web page. The root package.json maps npm scripts to files under config/: create-user, invite-user, list-users, reset-password, ban-user and delete-user for accounts, and add-balance, set-balance and list-balances for token balances, with user-stats for usage. Each runs a Node file directly, for example:

node config/create-user.js
node config/add-balance.js

Updates also go through scripts: config/update.js handles local, Docker and single updates, and config/deployed-update.js updates or rebases a deployed instance. In Docker these have to run inside the api container, which is easy to forget when the first account needs creating.

Agents bundle MCP servers, SKILL.md files and subagents

LibreChat Agents are no-code assistants that can use MCP servers, tools, file search and code execution, and can be shared with specific users and groups or found through an agent marketplace. Skills are reusable SKILL.md instruction bundles that run manually, automatically or always on, and a skill directory is mounted into the container. Subagents hand focused work to isolated child runs with their own context windows. Agent Plugins, still experimental, package deployment Skills and MCP servers to load at startup.

The Dockerfile copies uv and uvx from the astral-sh/uv 0.9.5 image for extended MCP support, so Python based MCP servers can be launched inside the container. Version 0.8.8 added a beta Agent Management API for creating, updating and deleting agents, files and Skills, with machine clients authenticated through deployment-bound OIDC identities and documented with OpenAPI and Swagger UI.

Attached workspaces let agents run Bash, and are marked highly experimental

The most consequential v0.8.8 addition is attached workspaces. An agent can be given a default workspace on a managed or personal code worker, then inspect file trees, read and search files, write changes and run Bash with bounded timeouts. Personal workers support self-service enrollment, readiness status and a per-agent Git identity. The project labels this highly experimental.

The safety controls are approval modes: Ask, Allow or Deny for file writes and command execution where administrators permit, plus a Full access mode meant for trusted attached environments. Background tool controls can cancel ordinary background tools, including attached Bash, while detached subagent runs continue independently. Leaving Full access on for a worker that touches real repositories means a model can change files and run commands without a prompt. Start with Ask, and remember that cancelling background tools does not stop subagents.

Code Interpreter is a separate sandboxed service

Code execution in chat goes through the Code Interpreter API, which is open source and self-hostable and built on ClickHouse/code-interpreter. It runs Python, Node.js with JavaScript and TypeScript, Go, C and C++, Java, PHP, Rust and Fortran in an isolated sandbox, with file upload, processing and download. Because it is a separate service, deploying LibreChat alone does not give you code execution; you run or connect the interpreter as well. Unified attachments in v0.8.8 mean a file is uploaded once and routed either to the model or to extracted text, with File Search and code tools provisioned only when needed.

HTTP timeouts below 30 seconds are not enforced precisely

.env.example carries an unusually candid note on server timeouts. HTTP_KEEP_ALIVE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_BUFFER_MS, HTTP_HEADERS_TIMEOUT_MS and HTTP_REQUEST_TIMEOUT_MS are optional and fall back to Node.js defaults. Header and request timeout expiry is only detected on a 30 second connection sweep, so values under 30000 take effect late. The header timeout is clamped to the request timeout when the request timeout is lower. Bun accepts the values but does not enforce them. Behind an AWS load balancer, the keep-alive timeout must sit above the ALB idle timeout.

For tracing, v0.8.8 added a Trace Viewer for model conversations, tool rounds and costs, OpenTelemetry export of application logs, and allowlisted Langfuse trace metadata. The Docker image runs Node 24.22.1 on Alpine with jemalloc preloaded, a default NODE_MAX_OLD_SPACE_SIZE of 6144, and SCARF_ANALYTICS set to false so dependency install analytics stay off.

Releases arrive as release candidates on a 0.8 line

LibreChat is MIT licensed and under steady development; the last push to main was on 2 November 2026. v0.8.8-rc4 shipped on 23 September, v0.8.8 on 1 October and v0.8.9-rc1 on 26 October 2026, and package.json already reports v0.8.9-rc1. The project is still below 1.0, and an UPGRADING.md file sits at the root. Read it before each upgrade, since the release notes name changes to agent continuation, Redis liveness detection, DocumentDB coordination, OpenID and MCP OAuth sessions and tenant isolation, all areas that touch a running deployment.

Editorial conclusion

LibreChat fits teams that want one self-hosted, multi-user chat front end across several model providers, with per-user balances, agents, MCP tools and tracing. It does not fit someone who wants a single binary or a desktop app: the Docker stack brings MongoDB, Meilisearch, a RAG API and an admin panel, and the default compose file pulls a dev image tag. Before deploying, pin an image version you have checked, keep code approvals on Ask for attached workspaces, and read UPGRADING.md before each release.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes