chatwoot/chatwoot

Selection

Select when

• You need a shared inbox spanning chat, email, and social or messaging channels.
• You want to self-host a customer-support platform.
• You need support-team assignment, capacity, collaboration, and automation features.
• You need a built-in help center for articles and FAQs.
• You need contact history, segmentation, campaigns, and custom attributes.
• You need operational and CSAT reporting.
• You want an integrated support AI agent and can evaluate Captain's edition requirements.
• You need documented Slack, Dialogflow, Shopify, translation, Linear, or dashboard-app integrations.
• You can operate the deployment, data stores, channels, credentials, upgrades, and backups.
• You are selecting a standalone support system rather than a Claude Code extension.

Boundaries

Avoid when

• You specifically need a Claude Code plugin, skill, hook, MCP integration, or tool server.
• You need a coding agent or developer-focused orchestration runtime.
• You want a narrowly scoped component with little operational overhead.
• You cannot maintain the latest release despite latest-only security support.
• You require proof from supplied files that every feature is available under the community license.
• You need SAML without verifying cloud or enterprise eligibility and feature policy.
• You cannot send customer conversations or knowledge content to configured third-party services.
• You need a supplied independent security audit or privacy assessment.
• You require a fully evidenced deployment architecture or compatibility matrix from the provided files.
• You need certainty about current state despite future-dated metadata relative to the analysis context.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected files were supplied, so the full architecture, authorization model, channel implementations, APIs, deployment manifests, tests, and Captain runtime were not inspected.
• Uncertainty: metadata update and push timestamps extend into 2026 relative to this analysis context, so current activity and release state cannot be independently reconciled.
• Uncertainty: GitHub metadata reports an unresolved license while the README states MIT, and enterprise files indicate edition-specific code whose licensing was not supplied.
• Uncertainty: no supplied first-party file documents any integration or compatibility with Claude Code.
• Uncertainty: Captain's model providers, retrieval path, pricing, availability, evaluation results, and production guardrails are not established by the supplied files.
• Only the latest version is listed as security-supported, increasing upgrade pressure for self-hosters.
• Self-hosting a multichannel support system requires infrastructure, persistent data, credentials, backups, upgrades, monitoring, and channel-provider configuration.
• SAML is restricted by administrator permissions, installation type, feature flags, and paywall policy in the supplied frontend code.
• Optional onboarding registration sends company, administrator name, and email to ChatwootHub when the subscription checkbox remains selected.
• Configured Firecrawl use sends scrape requests to an external service and requires an API key stored in installation configuration.
• Customer conversations, contact details, credentials, and knowledge content are sensitive and require deployment-specific access and retention controls.
• No independent security audit, privacy assessment, AI-quality benchmark, or complete compatibility matrix was supplied.

The repository provides private disclosure through GitHub Security Advisories and names RCE, SQL injection, authentication bypass, privilege escalation, XSS, unauthorized admin actions, and CSRF as priorities. It asks researchers to test self-hosted instances rather than production services and supports only the latest version. Supplied frontend files gate SAML settings by administrator role, installation type, feature flag, allowed login methods, and paywall policy. Uncertainty: no independent audit, complete threat model, dependency policy, encryption design, or authorization review was supplied.