Automation & agent frameworks CrewAI
Is CrewAI safe?
Short answer: Caution. StackGrade's weekly scan of crewAIInc/crewAI gives it a Caution label for 8 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 31 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove CrewAI is exploitable in your setup. Automated scan of commit 86dca29 on 2 Nov 2026, not a manual audit.
Updated : the last week its score, rank or safety result changed.
Python framework for orchestrating role-playing, autonomous AI agents that collaborate on tasks.
- 60,400 stars
- pushed 1 Nov
- MIT
- Python
#18of 52 overall#3in Automation & agent frameworks▲ 1 vs Week 44
- Maintenance 30%62
- Adoption 30%45
- Docs 20%69
- Community 20%–
Score over the last 4 weeks: 52, 53, 56, 57.
8 critical-severity known vulnerabilities in runtime dependencies (OSV).
How this score works
Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.
- Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 25 days (about 11 per 30 days), latest release 1 Nov 2026. Issue close time: fewer than 5 closed issues, so not used.
- Adoption: 60,400 stars (70%), 8,998 forks (30%).
- Docs: README 32,680 characters, 55 headings, 23 code blocks, install section: yes.
#3 of 14 in Automation & agent frameworks
Ranked by score. The yellow row is this tool.
- 1n8n#3 overall70Caution
- 2AutoGPT#14 overall62Caution
- 3CrewAI#18 overall57Caution
- 4Dify#20 overall56Caution
- 5LangChain#23 overall54Caution
- 6Pydantic AI#31 overall46Caution
Show the other 8
- 7Mastra#33 overall44No issues found
- 8LangGraph#34 overall44No issues found
- 9Agent Development Kit (ADK, Python)#36 overall43Caution
- 10OpenBot#39 overall41Caution
- 11AutoGen#41 overall40Caution
- 12OpenAI Agents SDK (Python)#42 overall39Caution
- 13smolagents#47 overall30No dependencies scanned
- 14artemis#50 overall25Caution
Safety scan, 2 Nov 2026
Automated scan of commit 86dca29, 2,453 files. Not a manual audit.
Caution
- 8Critical dependency advisories31 high, 18 medium, 2 low. OSV, runtime dependencies only.
- 0Install hooksNo npm install scripts found.
- 0Remote-code patternsFor example eval(fetch(…)).
- 199Agent files checked0 phrases flagged for review.
- 2curl | sh installersIn docs or program code. Information only.
Why this label?
Why this label:
- 8 critical-severity known vulnerabilities in runtime dependencies (OSV)
Known vulnerabilities in runtime dependencies (OSV): 8 critical, 31 high, 18 medium, 2 low
chromadb@1.5.9 (PYSEC-2026-311) in uv.lockchromadb@1.5.9 (PYSEC-2026-3814) in uv.lockpillow@12.3.0 (PYSEC-2026-4330) in uv.lockpillow@12.3.0 (PYSEC-2026-4332) in uv.lockpillow@12.3.0 (PYSEC-2026-4339) in uv.lock
Also found (informational, does not change the label):
- 31 high-severity known vulnerabilities in runtime dependencies (OSV)
- Documents curl|sh style installer (2 occurrences, e.g. README.md)
- Skill scripts contact: test-api-base.com, api.openai.com, localhost, mcp.example.com, github.com, mcp.exa.ai
Notes:
- Telemetry/analytics references in code: telemetry
Automated scan of commit 86dca29 on 2 Nov 2026, not a manual audit. 2,453 files checked. What we check
Repo activity
From the GitHub API, fetched 2 Nov 2026.
- 10+Releases, 90 daysLatest 1.15.34, 1 Nov
- –Median issue closeFewer than 5 closed issues
- 60.4kStars+291 since 26 Oct
- 9kForks992 open issues
- 2023Repo created27 Oct 2023
10 releases in the last 30 days (GitHub releases feed, last 10 entries):
Questions about CrewAI
Answers use this week's StackGrade data.
Is CrewAI safe to use?
Caution. StackGrade's weekly scan of crewAIInc/crewAI gives it a Caution label for 8 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 31 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove CrewAI is exploitable in your setup. Automated scan of commit 86dca29 on 2 Nov 2026, not a manual audit.
How does StackGrade score CrewAI?
CrewAI scores 57 out of 100 in Week 45: #18 of 52 tracked tools overall and #3 in Automation & agent frameworks. The score combines maintenance (62), adoption (45) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.
What are the alternatives to CrewAI?
What licence does CrewAI use?
The licence listed for crewAIInc/crewAI is MIT. Read the licence text before commercial use.
Compare and use it
Used in 1 AI use case
All facts and sources
- Type
- Agent framework
- License
- MIT
- Language
- Python
- Created
- 27 Oct 2023
- Owner
- crewAIInc (Organization)
- Forks
- 8,998
- Homepage
- crewai.com
GitHub description: “Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.”
Sources: github.com/crewAIInc/crewAI, api.github.com/repos/crewAIInc/crewAI, raw.githubusercontent.com/crewAIInc/crewAI/main/README.md. Fetched 2 Nov 2026.
Know when CrewAI changes label
One email a week: the new top 10, the biggest score changes and every safety label that changed.
Free. Double opt-in: you confirm by email first, unsubscribe in one click.