OpenMAIC: Turning Documents into Multi-Agent AI Classrooms

Table of Contents

Why This Repo, Why Now

Checking github.com/trending today, the top repository is THU-MAIC/OpenMAIC, described by its maintainers as an “Open Multi-Agent Interactive Classroom.” It turns a topic prompt or a set of uploaded documents into an interactive lesson: slides, quizzes, whiteboard-driven discussions, and project-based-learning activities, narrated by AI “teachers” and “classmates” that can talk, draw, and respond in real time.

The project just shipped v1.0.0 on August 27, 2026, adding a chat-first “Pro workbench” with durable, resumable agent sessions on top of the existing one-click generator — a release that lines up closely with today’s trending spike. It’s also notable for shipping a genuinely provider-neutral stack: the README documents support for over a dozen LLM providers (OpenAI, Anthropic, Bedrock, Gemini, DeepSeek, Qwen, GLM, and more) plus fully local options (Ollama, Lemonade, FunASR) for teams that don’t want to depend on a single vendor. As always, a trending position reflects visibility and momentum around a fresh release, not a verdict on quality, security, or production-readiness — those are checked independently below.

What the Technology Actually Is

Per the README and repository structure, OpenMAIC is a Next.js 16 / React 19 / TypeScript application under the MIT license (relicensed from AGPL-3.0 at v0.3.0). Styling uses Tailwind CSS 4, and the multi-agent logic is orchestrated with LangGraph 1.1.

Key architectural pieces visible in the repository’s own project-structure documentation:

• Generation pipeline (@openmaic/generation) — a two-stage pipeline: outline generation, then per-scene content generation (slides, quizzes, interactive HTML, PBL activities).
• Multi-agent orchestration (lib/orchestration/) — a LangGraph state machine (the “director graph”) that manages agent turns and in-classroom discussions between AI teachers and AI classmates.
• Agent runtime (lib/server/agent-runtime/) — PostgreSQL-backed durable sessions for the new Pro workbench, with lease-based execution so a session can be resumed or steered after a restart.
• Pluggable persistence layer (@openmaic/storage) — swappable browser, HTTP, PostgreSQL, and S3-backed stores for documents, runtime state, and assets.
• Playback and action engines (lib/playback/, lib/action/) — a state machine driving classroom playback (idle → playing → live) and an engine executing 28+ action types (speech, whiteboard drawing, spotlight, laser pointer, etc.).
• Workspace packages (packages/@openmaic/*) — a versioned slide DSL, a React renderer, a composable editor core, a PPTX importer, and a PPTX generator, published as separate npm packages.

At a high level: a prompt or uploaded document goes into the generation pipeline, which produces a structured lesson (via the @openmaic/dsl contract); the LangGraph orchestrator then drives AI agents through that lesson in real time, while the playback/action engines render speech, whiteboard actions, and UI state to the learner’s browser.

Purpose and Use Cases

The primary purpose is generating and delivering an interactive, presented lesson from minimal input, rather than a static slide deck:

• Educators and trainers who want to turn a topic, PDF, or slide deck into a narrated, discussion-driven classroom without manually building slides.
• Corporate/vocational training teams, per the README’s use-cases section, that need repeatable, document-grounded onboarding or compliance content.
• Teams standardizing on multiple LLM/media providers — the provider-neutral design (bring-your-own OpenAI/Anthropic/Bedrock/Gemini/local models) fits organizations that don’t want to hard-code a single AI vendor.
• Developers integrating classroom generation into chat tools, via the documented OpenClaw skill, which lets a classroom be requested from Feishu, Slack, Telegram, and other messaging apps.

It is not a general-purpose LMS or a hosted SaaS by default — the project is self-hosted (or deployable to Vercel), and per the README, production deployments handling multiple learners require replacing the default authentication stub with real session verification (see Security Review below).

Installation

Per the project’s README Quick Start section:

Prerequisites

• Node.js >= 20
• pnpm >= 10
• At least one LLM provider API key (or a local provider such as Ollama/Lemonade — none require a key)

Clone & install

git clone https://github.com/THU-MAIC/OpenMAIC.git
cd OpenMAIC
pnpm install

Configure

cp .env.example .env.local

Fill in at least one LLM provider key, for example:

OPENAI_API_KEY=sk-...

The README documents many alternative providers (Azure OpenAI, Anthropic, Amazon Bedrock, Google Gemini, DeepSeek, Qwen, Kimi, MiniMax, Grok, OpenRouter, Doubao, Tencent Hunyuan, Xiaomi MiMo, GLM, and local Ollama/Lemonade), configurable via .env.local or server-providers.yml.

Run (development)

pnpm dev

Then open http://localhost:3000.

Production build

pnpm build && pnpm start

Alternative: Docker

cp .env.example .env.local
# Edit .env.local with your API keys, then:
docker compose up --build

Alternative: Vercel

The README provides a one-click Deploy with Vercel button, requiring at least one LLM provider key set as an environment variable at deploy time.

The README recommends the pnpm/Node.js quick-start path as the primary, maintainer-documented method; Docker and Vercel are documented as alternatives for containerized or hosted deployment.

Quick Verification

Based on the documented Quick Start flow:

1. Local server check — after pnpm dev, opening http://localhost:3000 should load the OpenMAIC home page with a generation input, confirming the Next.js app is running.
2. Generation smoke test — entering a topic prompt and submitting it should kick off the documented two-stage generation pipeline and produce a playable classroom.
3. Provider check — if no LLM key is configured, the app should surface a configuration error rather than silently failing, since at least one provider key (or a local provider) is required per the README.
4. Production build check — pnpm build && pnpm start completing without errors confirms the production build path works before deploying.
5. Docker check — docker compose up --build completing and exposing the app on the configured port confirms the container path works, per the Docker Deployment section.

Security Review

Verified from the repository itself:

• SECURITY.md documents a private disclosure process via GitHub Private Vulnerability Reporting (Security tab → Advisories → “Report a vulnerability”), explicitly asking that vulnerabilities not be filed as public issues.
• The repository’s Security Advisories page currently shows no published advisories.
• License is MIT (the project relicensed from AGPL-3.0 to MIT at v0.3.0, per the README’s news log), a permissive license with no warranty. Some bundled workspace packages (e.g. packages/pptxgenjs) keep their own separate license terms, per the README’s “Third-Party Components” section.
• The project has an active, frequent release cadence — ten tagged releases from v0.1.0 (2026-03-26) through v1.0.0 (2026-08-27), plus separately versioned npm packages under @openmaic/*.
• Supported versions per SECURITY.md: main and the latest release; older versions are explicitly marked unsupported.

Security considerations to weigh yourself (not verified as vulnerabilities, just documented factors that matter for this class of tool):

• The README’s own Server-backed persistence (PostgreSQL) section states plainly that PERSISTENCE_DEV_TOKEN / NEXT_PUBLIC_PERSISTENCE_TOKEN provide “no confidentiality and no user isolation whatsoever” — the token is compiled into the public JS bundle, and anyone who can load the page can read or write every learner’s data. The maintainers explicitly call this “suitable only for localhost or trusted-network, single-user deployments” and instruct operators to replace lib/persistence/server-auth.ts with real session verification before any multi-user or production use.
• ACCESS_CODE is documented as a site-level shared password, not per-user authentication — it gates access to the deployment as a whole, not individual learner data.
• The app depends on external LLM/media provider API keys (OpenAI, Anthropic, Bedrock, etc.); these are standard third-party credentials and should be handled with the same care as any other API secret.
• The Docker Compose setup and optional server-persistence profile bring up a PostgreSQL container; the README notes that changing PERSISTENCE_POSTGRES_PASSWORD after the data volume is initialized does not rotate the existing database role’s password.
• The optional MP4 video export path runs Chromium + FFmpeg in an isolated render-service container specifically because of the elevated dependencies that combination requires — evaluate that service’s exposure separately if you enable it.
• As with any actively developed project pulling in many optional third-party integrations (media providers, ASR/TTS services, MinerU document parsing), review which providers you actually enable and audit their own data-handling practices.

Practical recommendations:

• Pin a specific tagged release (e.g. v1.0.0) rather than tracking main for anything beyond local evaluation.
• Treat the default dev-mode persistence tokens exactly as the README warns: fine for solo/local use, not acceptable for any deployment reachable by other users until server-auth.ts is replaced with real authentication.
• Run first evaluations in a container or isolated environment, especially before wiring in production LLM provider keys.
• Scope and rotate any LLM/media provider API keys used, and prefer environment-variable injection over hardcoding them in server-providers.yml.
• Review docker-compose.yml and the optional server-persistence/render-service profiles before enabling them in any shared environment.
• If self-hosting for multiple users, complete the maintainers’ own documented step of implementing real session verification before going beyond a single trusted user.

Should You Use It?

Strengths: actively released (ten tagged versions in five months, with v1.0.0 shipping days before this trending spike), MIT-licensed, genuinely provider-neutral (over a dozen LLM providers plus fully local options), a documented private vulnerability-disclosure process, and an unusually detailed README that is explicit about the security limitations of its own default configuration.

Limitations: the maintainers themselves document that the out-of-the-box persistence/auth setup is not safe beyond localhost or trusted-network, single-user use; multi-user production deployment requires custom authentication work; and the project is young enough (first tag in March 2026) that its operational track record is still short.

Good fit for: educators, trainers, and platform teams evaluating an open-source, self-hostable lesson-generation tool with flexible AI-provider choice, and developers exploring LangGraph-based multi-agent orchestration in a real application.

Evaluate alternatives if: you need a multi-tenant, production-ready classroom platform out of the box without implementing your own authentication layer, or you require a longer-established maintenance track record before adopting a fast-moving, pre-1.x-mindset project for production use.

Primary sources used: GitHub repository · README · SECURITY.md · Security Advisories · Releases · LICENSE · CHANGELOG