Repo brief: Mrs4s/go-cqhttp

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T09:34:00.772Z · commit a5923f179b36

Verdict

Healthy — Strong maintenance signals

• Last commit 6w ago
• 30+ active contributors
• Distributed ownership (top contributor 32% of recent commits)
• AGPL-3.0 licensed
• 2 more receipts on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

go-cqhttp is a Go implementation of the OneBot v11 protocol that emulates a QQ bot framework, enabling programmatic interaction with QQ messaging through HTTP APIs, WebSocket connections (both forward and reverse), and CQ code parsing/generation. It bridges the Mirai/MiraiGo QQ protocol libraries with a standardized bot interface for cross-platform bot development. Monolithic Go application structured as cmd/gocq/ (main CLI entry), coolq/ (CoolQ API compatibility layer + event handling), internal/ (modular concerns: msg parsing, caching, self-diagnosis, updates), pkg/onebot/ (OneBot protocol abstraction), and db/leveldb/ (message storage via LevelDB). The API generator in…

Start here

Read these in order:

• global/buffer.go — Foundation: doesn't import anything internally and is imported by 21 other files. Read first to learn the vocabulary.
• internal/base/feature.go — Foundation: imported by 18, no internal dependencies of its own.
• internal/download/download.go — Built on the foundation; imported by 9 downstream files.
• db/database.go — Built on the foundation; imported by 9 downstream files.
• coolq/api.go — Layer 2 — composes lower-level code into reusable abstractions (imported 9×).

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone and build using Go 1.20+:

git clone https://github.com/Mrs4s/go-cqhttp.git
cd go-cqhttp
go build ./cmd/gocq

Verify go mod download succeeds with the go.mod file present. Note: the project is not recommended for new deployments per the official README.

Daily commands:

No development server; this is a bot runtime. Start the compiled binary:

./gocq

The application reads configuration (inferred from internal/param/param.go and config parsing logic) and connects to QQ via MiraiGo, exposing APIs on configured HTTP/WebSocket ports. Configuration via YAML (gopkg.in/yam…

…shortened for this brief.

Key cautions & unknowns

• AGPL-3.0 is copyleft — check downstream compatibility
• Scorecard: default branch unprotected (0/10)
• 1 moderate-severity advisory on direct dependencies
• Critical: MiraiGo dependency is pinned to August 2023 (v0.0.0-20230823050531-...). QQ's protocol encryption evolves constantly; this binary will likely fail QQ login within months of the package's date.…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.