Open-source bots

Repo health is the feature list

Bot	Type	Open source	Backtest	Paper	Custom code	Exchanges	Price	US
Freqtrade	Self-hosted	yes	yes	yes	yes	11	free	US
Hummingbot	Self-hosted	yes	yes	yes	yes	50	free	US
Jesse	Self-hosted	yes	yes	yes	yes	12	$0-1599/mo	US
OctoBot	Self-hosted	yes	yes	yes	yes	12	$0-29.99/mo	US
Superalgos	Self-hosted	yes	yes	yes	yes	15	free	US
Passivbot	Self-hosted	yes	yes	yes	yes	8	free	US

Live values from our database - details and caveats in each review. "-" = not documented.

Feature matrices go stale the day a vendor edits them; repository activity cannot be faked. Our 2026-10-21 GitHub API snapshot of the six open-source bots we track - 6 frameworks, all with 6 public code - reads like this:

The pattern is consistent across years: Freqtrade and Hummingbot behave like funded vendors - monthly-ish releases, issue triage, migration notes[1][2]. Passivbot is a lean single-maintainer project with public-domain licensing that nonetheless pushes constantly[6]. Jesse iterates on master without tagged releases[3], OctoBot ships betas on schedule[4], and Superalgos - pushed recently but with a November 2024 tag - sits in the warning zone where recent commits no longer guarantee packaged, tested releases[5].

Repo health also prices the real cost of "free": every framework here needs the ops layer from our self-hosted lane and a venue fee schedule that dwarfs licensing questions - the median entry price across subscription platforms, n/a/mo, is what "free" is usually compared against, and the comparison is volume-dependent by nature[1][2].

What auditability actually covers

Reading the code lets you verify three properties vendors cannot sell: no key exfiltration (every network call is inspectable), order semantics (how retries, partial fills and rate-limit backoffs actually behave - Freqtrade documents this instead of hiding it[7]), and cost model truth (fees are whatever the exchange charges - the same schedule a paid platform hides behind its subscription). It cannot verify strategy profitability, and it will not stop you from overfitting your own backtests.

The ecosystem point matters for longevity: most of these frameworks sit on CCXT's unified exchange API, so exchange-side breaking changes get patched once in the library and inherited by everyone upstream. When you evaluate a smaller OSS bot not on this page, its first question should be: does it ride CCXT or maintain its own connectors?

Which framework for which case

Strategy development, general trading: Freqtrade. Python, backtesting, dry-run, hyperparameter optimization, the largest community - the default for a reason[1][7].

Market making and multi-venue presence: Hummingbot. 318 connectors, maker-focused strategy templates, institutional-grade activity[2][8]. Heavier than you need for simple grid/DCA.

Futures parameter research: Passivbot. Futures-native optimization across grid/DCA parameter sets, public-domain code, active development[6]. The math-first interface repels beginners - by design.

Research-grade backtesting: Jesse. MIT, clean statistics API, no tagged releases (master-only)[3]. Use it as a research instrument, not a production daemon.

Visual strategy building: OctoBot (web UI over an open core[4]) and Superalgos (node-based editor[5]). Both trade CLI simplicity for interface comfort; check their repo health before committing long-running capital.

The r/algotrading comparison threads repeat one conclusion every year: public strategies underperform, and the community exists to help you build your own - not to hand you an edge[9].

License and governance, read like an investor

The funding model predicts the roadmap. Hummingbot runs on foundation sponsorship - releases and connector work track sponsor priorities[2][8]. OctoBot sells managed cloud hosting of its free core, so the open-source version is also the funnel[11]. Jesse sells pro licenses on top of the MIT core[10]. Passivbot is donation-funded and public-domain - the purest community model, and the most dependent on one maintainer's continued interest[6]. Superalgos uses a token incentive model - contributors are paid in the project's own currency, which aligns contributors with the token's health as much as with the software's[5][9].

Read your framework's model before depending on it: the release cadence in the figure above is the output of these incentives, not a coincidence. GPL copyleft (Freqtrade, OctoBot) also means your modifications stay open if you distribute - irrelevant for personal trading, decisive if you build a service on a fork.

Tips that separate users from victims

• Pin versions and read the changelog before every update - exchange API changes break connectors silently; the frameworks that document migration steps (Freqtrade) are the ones that respect your capital[1].
• Fork the repo you run. Your running version should match a tag you control; git describe belongs in your monitoring dashboard.
• Backtest on regimes you did not tune on. Every framework here has a backtester; none has a cure for overfitting. The bot-vs-hodl guide shows how differently the same strategy scores across five regimes.
• Contribute upstream when you hit a bug. It is the cheapest support contract available: your fix ships to every future version, and the maintainer learns your exchange pair exists.
• Cost comparison belongs to the calculator, not the license. Free software plus VPS (~$120/yr) versus cloud subscriptions is volume-dependent - the bot cost calculator prices your case, including the per-trade lanes that look free.

What the numbers say

• 6 frameworks pass our open-source filter; 6 of them cost nothing to run beyond a VPS, and 6 are open source by definition on this page.
• 100% document US availability - licensing has nothing to do with jurisdiction.
• Median entry price across this lane: n/a/mo - driven entirely by the optional paid layers (managed hosting, pro licenses), not the frameworks themselves.
• The oldest operator in the lane dates to 2017; across the whole tracked universe 2 platforms have gone under, which is the risk this lane's transparency lets you price.

Warnings

• Abandoned-repo risk is existential, not theoretical. An unpatched bot facing an exchange API change fails silently - orders that never place, stops that never trigger. Superalgos' release gap is today's cautionary example[5]; check push dates the day you deploy.
• Copy-pasted strategies from marketplaces and repos are the leading self-inflicted loss - not because the code is malicious, but because overfitted parameters meet live spreads. Validate or ignore.
• OSS on a VPS inherits the ops bill. The self-hosted ops reality - supervision, updates, backups, key hygiene - applies to every project in this table[7].
• "Open source" is not a security audit. Reading code is a capability, not a service. If nobody has audited the connector you use, assume the audit is yours to do.

The maintenance questions to ask on day zero

Before committing capital to any framework on this page - or any OSS bot not on it - five questions with objective answers: when was the last commit (not the last star)? When was the last tagged release, and does the project tag at all? Is the issue backlog growing faster than it closes? How many contributors merged in the last quarter? And does the project publish a changelog with migration notes, or raw diffs? Every one of these is visible in the repositories this page cites[1][2][3][4][5][6], and together they predict how the next exchange API break goes for you.

The same diligence applies to your own deployment: pin the version you audited, watch the project's release feed, and schedule updates as deliberately as you schedule strategy changes. Open source gives you the right to know - the responsibility to look comes with it.

Finally, a note on what these frameworks share underneath: most sit on CCXT's unified API layer, so connector fixes propagate library-wide and no single project maintains every exchange alone. That shared infrastructure is why the lane survives exchange churn at all - and why an OSS bot that rolls its own connectors deserves extra scrutiny on every health question above.

• Token-incentivized governance (Superalgos model) aligns contributors differently than donations or paid hosting - understand which incentive structure funds the code you depend on before it funds your trading.