{"full_name":"bytedance/UI-TARS-desktop","owner":"bytedance","name":"UI-TARS-desktop","url":"https://github.com/bytedance/UI-TARS-desktop","description":"The Open-Source Multimodal AI Agent Stack: Connecting Cutting-Edge AI Models and Agent Infra","homepage":"https://agent-tars.com","topics":[],"language":"TypeScript","license":"Apache-2.0","avatar":"https://avatars.githubusercontent.com/u/4158466?v=4","created_at":"2025-01-19T09:04:43Z","pushed_at":"2026-10-09T01:29:53Z","metrics":{"stars":39591,"forks":4029,"watchers":277,"issues":577,"prs":1406,"releases":39,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":52},"growth":{"day":{"stars":6,"forks":0,"base_day":"2026-11-09"},"week":{"stars":68,"forks":10,"base_day":"2026-11-03"},"month":{"stars":360,"forks":56,"base_day":"2026-10-11"}},"history":{"dates":["2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-24","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-09","2026-11-10"],"stars":[38862,38874,38888,38902,38915,38923,38934,38941,38949,38976,38998,39009,39025,39041,39049,39059,39068,39085,39099,39108,39108,39117,39130,39143,39158,39173,39179,39179,39199,39211,39204,39208,39208,39216,39225,39231,39233,39250,39264,39276,39287,39296,39306,39313,39335,39347,39361,39368,39372,39375,39385,39395,39409,39426,39437,39453,39486,39505,39523,39536,39585,39591],"forks":[3932,3935,3933,3933,3932,3936,3936,3937,3935,3941,3944,3945,3950,3952,3953,3957,3958,3959,3961,3964,3965,3966,3966,3965,3964,3963,3967,3963,3968,3970,3971,3970,3970,3970,3972,3973,3974,3983,3985,3986,3986,3991,3990,3992,3996,3992,3993,3993,3995,3996,3996,3996,3997,3995,3996,4000,4010,4015,4019,4021,4029,4029],"watchers":[282,284,284,285,285,285,286,286,286,286,286,286,286,286,286,286,286,286,282,282,281,281,281,281,282,282,282,282,282,282,282,282,282,282,281,282,282,283,283,283,283,283,283,283,282,282,282,282,282,277,277,277,277,277,277,277,277,277,277,277,277,277],"issues_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"prs_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]},"boards":{},"same_owner":[{"full_name":"bytedance/deer-flow","name":"deer-flow","boards":{"total":198}},{"full_name":"bytedance/Dolphin","name":"Dolphin","boards":{}},{"full_name":"bytedance/IconPark","name":"IconPark","boards":{}},{"full_name":"bytedance/UI-TARS","name":"UI-TARS","boards":{}},{"full_name":"bytedance/monolith","name":"monolith","boards":{}},{"full_name":"bytedance/sonic","name":"sonic","boards":{}},{"full_name":"bytedance/trae-agent","name":"trae-agent","boards":{}},{"full_name":"bytedance/xgplayer","name":"xgplayer","boards":{}}],"issues":[{"number":268,"title":"[Feature] Windows platform support for Agent TARS ","comments":23,"created_at":"2025-03-22T10:23:51Z"},{"number":591,"title":"[Bug]: Missing clicks","comments":20,"created_at":"2025-05-13T13:24:03Z"},{"number":587,"title":"[Bug]: UI-TARS-2B-SFT model maximum context length Error","comments":16,"created_at":"2025-05-13T03:36:30Z"},{"number":11,"title":"no action after thinking","comments":12,"created_at":"2025-01-22T10:06:58Z"},{"number":311,"title":"Mac已经按要求授权应用访问设备的权限，依然无法执行浏览器访问","comments":11,"created_at":"2025-03-24T04:32:33Z"},{"number":568,"title":"[Bug]: Bug Report: 404 Not Found Error with VolcEngine Ark Despite Correct Settings and Successful API Call via curl","comments":9,"created_at":"2025-05-04T04:44:54Z"},{"number":384,"title":"[Bug]: Help needed - Local vllm deployment doesn't receive the request from desktop","comments":9,"created_at":"2025-03-26T11:41:40Z"},{"number":842,"title":"🖼️ Agent TARS Use case & Bad Case","comments":8,"created_at":"2025-06-29T16:58:31Z"}],"discussions":[{"number":2061,"title":"Docs: optional \"Listed on MCPwell\" badge + listing check","comments":0,"category":"General","created_at":"2026-11-08T14:31:54Z"},{"number":2049,"title":"虚拟桌面","comments":0,"category":"Q&A","created_at":"2026-10-17T11:49:59Z"},{"number":2041,"title":"Agent TARS: a hard dollar limit per headless run with model.headers","comments":0,"category":"Show and tell","created_at":"2026-10-03T20:58:31Z"},{"number":2040,"title":"ByteDance Agent TARS / UI-TARS is listed on Protagentic — may we show its rating?","comments":1,"category":"General","created_at":"2026-10-01T18:18:43Z"},{"number":1907,"title":"Different browser, browser profile","comments":1,"category":"Q&A","created_at":"2026-05-26T04:46:59Z"},{"number":1904,"title":"Agent-readiness feedback for UI-TARS Desktop docs?","comments":1,"category":"Ideas","created_at":"2026-05-23T09:24:28Z"},{"number":1893,"title":"在windows环境中怎么运行UI-TARS-desktop？需要先编译吗？用什么编译？","comments":3,"category":"Q&A","created_at":"2026-05-13T00:09:31Z"},{"number":1889,"title":"Request for official LexBench-Browser result review/submission","comments":1,"category":"General","created_at":"2026-05-12T04:26:12Z"}],"latest_release":{"name":"v0.3.1","tag":"v0.3.1","published_at":"2026-10-08T21:14:26Z","body":"This release closes several security issues in the Agent TARS CLI server (`@agent-tars/cli`, `@tarko/agent-server`). It changes how the server can be reached, so please read **Upgrading from 0.3.0** before you update.\n\n## Upgrading from 0.3.0\n\n**If you run the CLI on your own machine and open it at `http://localhost`, nothing changes.**\n\nOtherwise:\n\n- **The server only listens on `127.0.0.1` by default.** It used to listen on all network interfaces. To reach it from another machine or from outside a container, pass `--host`, e.g. `--host 0.0.0.0`.\n- **A non-loopback `--host` requires an access token.** Set one with `--auth-token` or `TARKO_AUTH_TOKEN` (at least 16 characters). If you set none, a random token is generated on every start and printed with a ready-to-open `?token=` link, so old links stop working after a restart. Set a fixed token if you need stable links.\n- **Domains, reverse proxies and port forwarding need `TARKO_ALLOWED_HOSTS`.** Requests whose `Host` header is not a loopback name, an IP address or the configured `--host` are rejected with `403 Invalid Host header`. Add your hostname, comma-separated: `TARKO_ALLOWED_HOSTS=agent.example.com`.\n- **A Web UI served from a non-localhost origin needs `TARKO_ALLOWED_ORIGINS`.** Otherwise creating a session fails with `403 Origin not allowed`. Use the full origin: `TARKO_ALLOWED_ORIGINS=https://agent.example.com`.\n- **`agentOptions` from requests and URLs only accepts `agentMode`.** This applies to `/creating?agentOptions=...`, welcome cards and `POST /api/v1/sessions/create`. Any other key (`mcpServers`, `model`, `aioSandbox`, ...) is rejected with `400`. Configure those on the server instead.\n- **Direct API calls need a CSRF token.** Fetch one from `GET /api/v1/csrf-token` and send it as the `x-csrf-token` header on `POST` requests. When the server requires an access token, also send `Authorization: Bearer <token>`.\n\nExample for a remote server behind a domain:\n\n```bash\nTARKO_AUTH_TOKEN=<a long random string> \\\nTARKO_ALLOWED_HOSTS=agent.example.com \\\nTARKO_ALLOWED_ORIGINS=https://agent.example.com \\\nagent-tars --host 0.0.0.0 --port 8888\n```\n\nSee the [CLI docs](https://agent-tars.com/guide/basic/cli) for details.\n\n## Security\n\n- Block request-body injection into agent constructor options; the server now binds to `127.0.0.1` by default (#1939)\n- Require an access token once the server leaves loopback (#2026)\n- Validate the `Host` header to prevent DNS rebinding (#1975)\n- Add CSRF protection, a CORS allowlist and security headers (#1853)\n- Stop HTML previews from escaping their iframe sandbox (#1938)\n\n## Bug Fixes\n\n- Answer a disallowed origin with 403 instead of 500 (#2044)\n- Repair unterminated strings in truncated tool call JSON (#1836)\n- Handle unknown model providers by defaulting to OpenAI-compatible (#1823)\n- Support streaming usage on LLM responses (#1737)\n\n## Features\n\n- Add embed-frame support for nav items (#1761)\n- Optimize the session status action design (#1766)\n- Set the remote browser viewport to the default viewport (#1748)\n- Add `@gui-agent/cli`, a CLI for GUI Agent automation (#1741)\n\n## Documentation\n\n- Document remote access settings for the agent server (#2043)\n\n**Full Changelog**: https://github.com/bytedance/UI-TARS-desktop/compare/v0.3.0...v0.3.1\n"},"readme":true,"readme_zh":true,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}