anythingllm-embed

Name: anythingllm-embed
Author: Mintplex-Labs

by Mintplex-Labs

Warning

AnythingLLM Embed widget submodule for the main AnythingLLM application

167stars

93forks

JavaScript

Added 3/9/2026

View on GitHub Download ZIP Scan for vulnerabilities

AI Agentsai-assistantai-chatbotanythingllmchat-widgetcustomer-support-ai

Installation

# Add to your Claude Code skills
git clone https://github.com/Mintplex-Labs/anythingllm-embed

Getting Started

Guides for using ai agents skills like anythingllm-embed.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportWarning

Last scanned: 5/30/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/helpers: Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "braces: Uncontrolled resource consumption in braces",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "compression: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "cross-spawn: Regular Expression Denial of Service (ReDoS) in cross-spawn",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify allows tampering by prototype pollution",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "markdown-it: markdown-it is has a Regular Expression Denial of Service (ReDoS)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "micromatch: Regular Expression Denial of Service (ReDoS) in micromatch",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "nanoid: Predictable results in nanoid generation when given non-integer values",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "nodemon: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "on-headers: on-headers is vulnerable to http response header manipulation",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp outputs backtracking regular expressions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "semver: semver vulnerable to Regular Expression Denial of Service",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "serve: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "serve-handler: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "simple-update-notifier: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite's `server.fs.deny` did not deny requests for patterns with directories.",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-05-30T15:59:34.966Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

213,760

ai-coding-principles middleman

AnythingLLM Embedded Chat Widget

This is a submodule of AnythingLLM - the all-in-one AI Application

Please report any issues or feature requests to the main repo

[!WARNING] The core AnythingLLM team publishes a pre-built version of the script that is bundled with the main application. You can find it in the main repo here. You should only be working in this repo if you are wanting to build your own custom embed widget for AnythingLLM

This folder of AnythingLLM contains the source code for how the embedded version of AnythingLLM works to provide a public facing interface of your workspace.

The AnythingLLM Embedded chat widget allows you to expose a workspace and its embedded knowledge base as a chat bubble via a <script> or <iframe> element that you can embed in a website or HTML.

Security

Users will not be able to view or read context snippets like they can in the core AnythingLLM application
Users are assigned a random session ID that they use to persist a chat session.
Recommended You can limit both the number of chats an embedding can process and per-session.

by using the AnythingLLM embedded chat widget you are responsible for securing and configuration of the embed as to not allow excessive chat model abuse of your instance

Developer Setup

cd embed from the root of the repo
yarn to install all dev and script dependencies
yarn dev to boot up an example HTML page to use the chat embed widget.

While in development mode (yarn dev) the script will rebuild on any changes to files in the src directory. Ensure that the required keys for the development embed are accurate and set.

yarn build will compile and minify your build of the script. You can then host and link your built script wherever you like.

Integrations & Embed Types

`<script>` tag HTML embed

The primary way of embedding a workspace as a chat widget is via a simple <script>

<!--
An example of a script tag embed
REQUIRED data attributes:
  data-embed-id // The unique id of your embed with its default settings
  data-base-api-url // The URL of your anythingLLM instance backend
-->
<script
  data-embed-id="5fc05aaf-2f2c-4c84-87a3-367a4692c1ee"
  data-base-api-url="http://localhost:3001/api/embed"
  src="http://localhost:3000/embed/anythingllm-chat-widget.min.js"
></script>

`<script>` Customization Options

LLM Overrides

data-prompt — Override the chat window with a custom system prompt. This is not visible to the user. If undefined it will use the embeds attached workspace system prompt.
data-model — Override the chat model used for responses. This must be a valid model string for your AnythingLLM LLM provider. If unset it will use the embeds attached workspace model selection or the system setting.
data-temperature — Override the chat model temperature. This must be a valid value for your AnythingLLM LLM provider. If unset it will use the embeds attached workspace model temperature or the system setting.

Language & Localization

data-language — Set the language for the chat interface. If not specified, it will default to English (en). Currently supported languages are available here. (PR's welcome)

Style Overrides

data-chat-icon — The chat bubble icon show when chat is closed. Options are plus, chatBubble, support, search2, search, magic.
data-button-color — The chat bubble background color shown when chat is closed. Value must be hex color code.
data-user-bg-color — The background color of the user chat bubbles when chatting. Value must be hex color code.
data-assistant-bg-color — The background color of the assistant response chat bubbles when chatting. Value must be hex color code.
data-brand-image-url — URL to image that will be show at the top of the chat when chat is open.
data-greeting — Default text message to be shown when chat is opened and no previous message history is found.
data-no-sponsor — Setting this attribute to anything will hide the custom or default sponsor at the bottom of an open chat window.
data-no-header — Setting this attribute hides the header above the chat window.
data-sponsor-link — A clickable link in the sponsor section in the footer of an open chat window.
data-sponsor-text — The text displays in sponsor text in the footer of an open chat window.
data-position - Adjust the positioning of the embed chat widget and open chat button. Default bottom-right. Options are bottom-right, bottom-left, top-right, top-left.
data-assistant-name - Set the chat assistant name that appears above each chat message. Default AnythingLLM Chat Assistant
data-assistant-icon - Set the icon of the chat assistant.
data-window-height - Set the chat window height. must include CSS suffix: px,%,rem
data-window-width - Set the chat window width. must include CSS suffix: px,%,rem
data-text-size - Set the text size of the chats in pixels.
data-username - A specific readable name or identifier for the client for your reference. Will be shown in AnythingLLM chat logs. If empty it will not be reported.
data-default-messages - A string of comma-separated messages you want to display to the user when the chat widget has no history. Example: "How are you?, What is so interesting about this project?, Tell me a joke."
data-send-message-text — Override the placeholder text in the message input field.
data-reset-chat-text — Override the text shown on the reset chat button.

Behavior Overrides

data-open-on-load — Once loaded, open the chat as default. It can still be closed by the user. To enable set this attribute to on. All other values will be ignored.
data-show-thoughts — Allow users to see the AI's thought process, if applicable, in responses. If set to "false", users will only see a static "Thinking" indication without the explict thought content. If "true" the user will see the full thought content as well as the real response. Defaults to "false".
data-support-email — Shows a support email that the user can used to draft an email via the "three dot" menu in the top right. Option will not appear if it is not set.

`<iframe>` tag HTML embed

work in progress

`<iframe>` Customization Options