← Back to Catalog

livekit/livekit

↗ GitHub

End-to-end realtime stack for connecting humans and AI

17,912

Stars

1,845

Forks

166

Watchers

173

Open Issues

Go·Apache License 2.0·Last commit Apr 1, 2026·by @livekit·Published April 1, 2026
A

Safety Rating A

The repository is a well-known, high-star open source project (17,900+ stars) under Apache 2.0 license. The only credential-like strings found are explicitly documented development-mode placeholder values intended for local testing. No obfuscated code, malicious patterns, data exfiltration, or prompt injection attempts were detected. The project is actively maintained with standard CI workflows and a transparent ecosystem of companion repositories.

AI-assisted review, not a professional security audit.

AI Analysis

LiveKit is an open source, scalable WebRTC Selective Forwarding Unit (SFU) media server written in Go. It provides a full end-to-end real-time stack for building multi-user video, audio, and data applications, including support for AI voice agents. It supports JWT authentication, simulcast, end-to-end encryption, SVC codecs (VP9/AV1), webhooks, and distributed/multi-region deployments. The ecosystem includes client SDKs for major platforms, server SDKs, egress/ingress services, and an AI agents framework.

Use Cases

  • Building scalable multi-user video conferencing applications
  • Real-time voice and video communication in web and mobile apps
  • AI voice assistant and multimodal AI agent integration via the Agents framework
  • Live streaming from OBS Studio or other RTMP/WHIP/HLS sources
  • Recording and multi-streaming rooms via the Egress service
  • Ingesting external media streams into a LiveKit room
  • Building spatial audio experiences
  • SIP telephony integration for real-time communications

Tags

#real-time#server#voice#self-hosted#docker

Security Findings (1)

hardcoded_secrets

The README documents placeholder development credentials (API Key: 'devkey', API Secret: 'secret') used only in development mode (--dev flag). These are intentional, well-documented defaults for local testing and not production secrets. No hardcoded production credentials were found.

↗ View on GitHub