ceos/unsloth: Unsloth is a local UI for training and running Gemma 4, Qwen3.6, DeepSeek, Kimi, GLM and other models.

Unsloth is a local UI for training and running Gemma 4, Qwen3.6, DeepSeek, Kimi, GLM and other models. https://unsloth.ai/docs

agent deepseek fine-tuning gemma gemma3 gpt-oss llama llama3 llm llms mistral openai qwen reinforcement-learning self-hosted text-to-speech tts ui unsloth

Python 71.5%
TypeScript 22.7%
Shell 1.9%
PowerShell 1.6%
Rust 1.5%
Other 0.7%

Find a file

Daniel Han 6818318867 Gate the sed commands that run a shell (#7483 ) * Gate the sed commands that run a shell GNU sed executes a shell through its `e` command, both as a standalone command (`sed -n '1e CMD' file`) and as an `s///e` flag that runs the pattern space. It goes through popen(), so it is a literal `sh -c`, but the terminal scan only ever saw `sed` at command position and treated the program text as an ordinary argument. That left `sed -n '1e rm -f victim' /etc/hosts` running with no prompt in auto mode, and `_find_blocked_commands` returning nothing for it, so the hard blocklist that applies in every mode missed `rm` as well. Screens the program the same way the awk arm does. `-e` values are joined with newlines first, since that is how sed assembles them: `sed -e '1a\' -e 'e CMD'` appends a literal line and runs nothing, so judging the pieces separately would prompt on a benign script. The scan then steps over every region where `e` is data rather than a command: address and substitution regexes, replacements, `a/i/c` text, `r`/`w` filenames, `b`/`t` labels and comments. That keeps the common idioms silent, including `:e;N;$!be` loop labels, `s/e/E/g`, and `s/a/b/we out.txt` where the `e` belongs to the `w` filename and sed does not execute. The blocklist scan recurses into a literal `e` payload the same way it already does for `bash -c`. A bare `e` or an `s///e` can only be prompted, since what they run is the pattern space, which is input-file text that is not knowable statically. Verified against real GNU sed 4.9 rather than the manual: 80 commands run for real with a marker payload, comparing what sed actually executed against the classifier, with no mismatches in either direction. * Close five ways a sed program hid its shell payload Review found five shapes the first pass missed. All five execute on GNU sed 4.9, checked by running them rather than reading the manual. A payload line ending in a backslash continues onto the next line, so the scan now ends an `e` at an unescaped newline and unescapes the text the way sed's read_text does. That is what resolves `r''m` back to `rm` for the blocklist. A sed comment ends at a real newline, but the terminal scan had already replaced every newline with `;`, including newlines inside quotes, so `# comment` swallowed the rest of the program. The sed arm now also sees a variant where only unquoted newlines become separators, built on a character-by-character quote scanner rather than a regex: an apostrophe in a double-quoted word mis-pairs under a regex and inverts the state, which opened a bypass while this was being written. Everything attached to `-i` is a backup suffix, so reading `-ifoo` as an attached `-f` lost the real script. Replaced the shared short-flag helper with sed's own option grammar, which also fixes `-l 5` and `--line-length 5` eating the script as their operand. A sed child of `find -exec` was never recorded, so the blocklist skipped its payload. Substituted text splices straight into the program, and an address is as good a place as any to open `;e CMD`, so a command substitution anywhere in the program is treated as unresolvable. Scoped to the program: a substitution in a file operand still runs, a `$(` or backtick inside single quotes is literal, and parameter and arithmetic expansion are untouched. The cost is that a substitution used to build a program now asks. Bounding the -exec walk keeps the blocklist linear; without it a repeated `-exec sed` line went quadratic. Verified against real GNU sed across 103 commands run for real, no mismatch in either direction. * Fail closed on padded sed lines, and stop gating sed --sandbox Four more from review, each checked by running it rather than reading the manual. The cap that keeps the argument walk linear was itself the bypass: padding a line with 128 valid options pushes the script past it, and an empty program read as proof the command only edits text. The budget is now shared across the sed words on a line, so a lone sed reads its whole argument list while a line packed with sed words keeps the floor that holds the walk linear, and overflow fails closed instead of falling through. The substitution scan counted parentheses without consulting quote state, so a quoted paren in the substitution body left the span unterminated and the program never matched. It now balances through the same quote scanner used elsewhere, since a substitution body reopens quoting. A wrapper between -exec and its child hid the child from the blocklist. Following the wrapper also fixes the neighbouring blocked-name check, which missed find . -exec env rm the same way. The wrapper's own name is still screened: -exec sudo rm reports both. sed --sandbox and --posix refuse e outright and exit 1, so gating them was prompting for something that cannot run. They are now inert, except after --, where the flag is an input filename and the script still executes. env -u still hides a child from the blocklist, on this path and at top level. That is pre-existing and left alone here. * Resolve the sed program through find, wrappers, globs and variables Five more from review, each run against real sed rather than read off the manual. find's -exec ends at + or ;, but the sed argument walk ran past it into the next predicate, where a following -exec grep -e safe was read as sed's own -e and discarded the real script. Stopping at the terminator also removes a false prompt, since -exec was being parsed as -e xec and inventing a payload. Hopping a wrapper skipped its name but not an option that takes a separate operand, so env -u FOO sed returned FOO as the child. The table this file already keeps for wrapper options covers it, moved up so both layers share it. That also settles the top level: env -u PATH rm -rf x now reports rm, as do env --unset, stdbuf -o L and xargs -I {}. Two false positives go with it, timeout -s KILL 5 rm blaming the signal name and env -u kill blaming a variable name, while timeout -s KILL 5 kill -9 1 still reports kill. A program held in a variable was invisible: the assignment regex stops its value at whitespace, so a program containing a newline never entered the map in any pass. Resolved at the token level instead, where the value is already whole. Both the written and the resolved program are screened, since either can hold the e. A command-position glob that can resolve to sed is treated as sed. The auto gate already asks about any unresolved command glob; this is for the blocklist, which did not know the name. Inside double quotes a backslash makes the next character literal, so sed "s/\$(CC)/gcc/" runs no substitution and should never have asked. The quote scanner now reports an escaped character under its own state. Left open: on Windows the blocklist lexer keeps quoting in its tokens, so a multiline program held in a variable resolves there but not to a name the blocklist reads. The prompt still fires on every platform. * Ask when the sed program is not a literal we can read Two from review, and the second one changes the default rather than adding another case. sed --sandbox and --posix were being read as disabling e for the whole invocation. They disable exactly the scripts written after them: sed compiles each -e as that option is parsed, and the positional script only after the option list, so sed -e '1e CMD' input --sandbox runs the payload with no POSIXLY_CORRECT needed. Suppression is now positional. Reading POSIXLY_CORRECT out of the command text was considered and dropped as unsound, since export or an outer bash -c puts it somewhere the text does not show. A program built by a parameter transformation was invisible: only bare $NAME and ${NAME} were resolved, so ${p#x } passed through untouched. Rather than add operators one at a time, a program that still holds a live expansion after resolution is treated as unreadable and asks. Unhandled expansion forms are now safe by default instead of silent, which also closes ${p%Z}, array elements, printf -v, read, and p=$(...) whose binding shlex had been truncating to a bare $. Arithmetic is collapsed rather than exempted. It can only ever evaluate to an integer, so it cannot spell a sed command, but leaving it as written let "$((c+1))e CMD" read as an append-text command that swallowed the payload. The cost is that a double-quoted program holding an unassigned variable now asks: sed "s/$OLD/$NEW/g" f. Measured at 24 of 169 realistic invocations, all of that one shape. Exempting it would trade enumerating expansion operators for enumerating assignment forms, and four of the bypasses above sit outside the assignment pattern, so the blanket rule stays. Left open: -f prog.sed is still unscreened, since the program is in a file. * Decide where a sed scan stops by context, not by token text Four from review, two of them exploiting fixes from earlier rounds. Stopping the sed walk at a + or ; token read the text after shlex had already removed its quoting, so a quoted file operand looked exactly like a find terminator and the scan gave up before the -e that followed. sed still compiles that -e, because getopt permutes. Termination is now decided by token index: a separator counts only if it was unquoted, and + or ; only while a find or fd exec action is open, which is the only place quoting does not matter. The same shape works with & \| ( ) and }, so all of them are covered. The assignment map kept the first binding for a name, but the shell uses the most recent one before the command. Bindings are now ordered and only those preceding a given sed are folded in, with a later one replacing an earlier. A value that is not itself literal clears the name rather than leaving the older literal standing, which would otherwise have dressed an unread program up as a safe one. Exhausting the wrapper budget under find -exec returned the same answer as finding no child at all, so a long enough chain of wrappers hid whatever followed. It now reports overflow and blocks the chain word. This was hiding more than sed: the same shape hid a plain rm. fd spells its exec flags -x, -X, --exec and --exec-batch, none of which were routed into the nested scan. They are now, but only while a find or fd word is in scope and no action is already open, so a -x that belongs to a child command is left alone. Prompt rate is unchanged at 45 of 169 realistic invocations; this round adds no new prompts. * Drop the words the shell removes before a command runs Two from review, both verified to run for real. A redirection is performed by the shell and never reaches the command, but the words stayed in the token list and the first of them was taken for sed's positional script, so the real one behind it was never read. `sed </dev/null '1e touch MARKER' input` creates the file, and so do the `>`, `2>`, `2>&1`, `&>`, `>\|` and here-string spellings. Redirections are now recognised as spans and skipped: the target may be glued on, be the next word, or sit one further along when a punctuation character splits the operator. A skip is honoured only where sed would take the word as an argument, so a pending -e/-f/-l value is still read. The same words also hid a command outright. `> out.txt rm -rf victim` and `2>&1 rm -rf victim` both really delete, because the redirection target was read as the command word and the rm behind it landed in argument position, where the always-on blocklist does not look. shlex emits a RUN of punctuation characters as one token, so bash's `\|&` matched no separator and a sed scan ran on into the NEXT command, taking its `-e safe` for the real script and dropping the payload. Any token built only from those characters now ends an invocation, and a quoted one is excluded the same way a quoted `';'` already was. The third item from that review, `-l N` eating the script as its length operand, was already closed in `9a5cfddb`. Prompt rate is unchanged at 45 of 169 realistic invocations; this round adds no new prompts. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Read a sed program from what the shell really hands it Five from an independent review pass, each verified by executing it. sed joins its -e and -f sources with newlines, but a source boundary also closes a line continuation open across it. Reading every -e as one uninterrupted text let an unreadable -f in the middle hide the piece behind it: `sed -e '1a\' -f /dev/null -e 'e CMD' input` runs CMD while the same line without the -f only appends text. A program flag ahead of the positional script makes that word an input file. One behind it does so only while getopt permutes, and POSIXLY_CORRECT turns permutation off from outside the command text, so the positional is now read as a script as well. The suppression that a flag written first performs is unchanged. xargs builds the argv of the command behind it, appending what it reads on stdin and substituting it into an -I placeholder, so the program need not be in the text at all. A sed whose program is empty or is only the placeholder is failed closed. The ordinary idioms are untouched: their program is present and the placeholder stands where the file goes. Only a word that really changes shell state rebinds a program held in a variable. An assignment-shaped argument, one inside a subshell and one used as a command's environment prefix all leave the variable alone, and recording them replaced a payload with a value bash never assigned. A conditional assignment after && or \|\| may or may not run, so it clears the name rather than being guessed at. Exec-flag forwarding now starts only at a command word. Any token spelled fd or find used to turn it on, so a -x or -exec in the text after one was read as an exec flag and its neighbour hard-blocked; `echo fd -x rm` and `grep fd -x rm file` were refused outright. A command-position glob bash resolves to find is still recognised. Prompt rate is unchanged at 45 of 169 realistic invocations. * Judge a sed program against what getopt and find really do Seven from review, each verified by executing it. A redirection is removed wherever it stands, including where an option value goes, so `sed -n -e >out '1e CMD' input` takes the word behind it as the script. The skip is now honoured ahead of a pending value rather than after it. The target of a detached redirection may itself look like an option or a quoted operator, and the shell hands it to open() either way, so `sed > --sandbox '1e CMD' input` and its `> ';'` twin no longer leave that word standing as a sed flag or script. Only a bare operator is refused, which is a malformed line. A program flag written behind the positional script and the positional itself are ALTERNATIVES, since permutation decides which sed compiles and nothing in the text settles it. They were joined into one program, where an unterminated command in the one swallowed the other: `-e safe` is an `s` with delimiter `a` and no closing one, and it ate the payload behind it. Each source is now scanned on its own. find closes its batched form at `{} +` only, so a `+` anywhere else is an ordinary argument it hands the child. Stopping at one threw away the script behind it. The `;` spellings need no such test: a quoted `';'` and an escaped `\;` reach find as the same word and it stops at either, which the `;` twin of that line confirms by not executing. An `-f` naming a stream (`-`, /dev/stdin, /dev/fd/N) takes the script off stdin, which the same command line may well supply through a heredoc. That is ignorance rather than safety, so the sed fails closed. A named program file is unreadable in a different way and is unchanged. bash expands the program word before sed is started, so in a directory holding a suitably named file `sed ` runs whatever that file contains. A program word carrying an unexpanded glob now fails closed. Quoted programs expand nothing and a glob among the file operands is not the program, so ordinary work is untouched. Prompt rate is unchanged at 45 of 169 realistic invocations. [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Keep command position and quoting intact through the sed scan Six from review, two of them regressions the previous commit introduced. Scoping exec-flag forwarding to a command word lost that position at a shell keyword and across a wrapper's own operands, so `if true; then find . -exec rm ...` and the `env -u FOO find ...` and `timeout 5 find ...` shapes stopped blocking rm entirely. Keywords now keep the position and wrapper options and their operands are stepped over, the way the command walk already does. Reading any operator-shaped token as a separator did the opposite: a QUOTED one is data the command receives, so `printf '%s' '\|&' rm` and `grep '\|&' rm file` were refused although they run nothing. The walk now applies the same quoted-index exclusion the layout pass does, which also clears the older `printf '%s' ';' rm` false positive. ANSI-C decoding flattened the word's whitespace, and a sed program ends its comment at exactly the newline that flattening destroyed. The decoded text is re-quoted instead, keeping the spaces and the `#` around it, with the newline standing as a mark so it stays data for whatever command receives it rather than a place a new one begins. An assignment inside a function body has not run and may never run, so it is no longer recorded as the current value; the name is cleared instead, which is right whether or not the function is later called. An `-f` taking a process substitution is a generated /dev/fd/N script, and the lexer ends the invocation at the `(` before the operand is read at all. A still-pending program operand now fails the sed closed. Live expansions were compared against the raw command spelling while the sed program carried the post-lex one, so an escaped expansion read as already resolved. Both sides are keyed without their escaping, which can only make a spelling match and so errs closed. Prompt rate is unchanged at 45 of 169 realistic invocations. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Read the sed program from the word the shell actually passes Six from review, four of them bypasses and two false alarms. find rewrites `{}` with the pathname it found before the child ever starts, so a sed whose whole program is that placeholder was never read. Nested under xargs it really runs whatever a suitably named file contains. A `{}` among the file operands, which is the ordinary idiom, is not the program and is untouched. A quoted redirection is a word the command receives rather than something the shell performs, and it was being removed either way, so a `-f` script file named `>prog` disappeared and took the `-e` behind it out of view. Quoting is now read from the operator the token opens with, which leaves `2>'/dev/null'` a redirection with a quoted target. An apostrophe in an ANSI-C word sent it down the flattening path, which destroys the newline a sed comment ends at. The apostrophe is re-quoted the way a shell does it instead. fd takes the command attached to its short exec option, and only the exact `-x` and `-X` spellings opened an action, so `-xrm` reached neither layer. Conversely nothing behind a bare `--` is an option at all, and reading one there refused `fd -- -x rm`, which merely lists a file. The set of live expansions covers the whole command, so matching a sed program against it by text alone attributed an expansion another command performs to a program that only spells the same thing. Which occurrence it was decides it now, and single quoting keeps its meaning while double quoting does not. Prompt rate is unchanged at 45 of 169 realistic invocations. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Tighten the comments this PR added Every comment kept says why a rule exists and, where the reason is a real tool behaviour, names the one command that proves it. What went is narration of the code, the history of how each fix evolved, and the same mechanism re-explained at each site that uses it: it is stated once at the definition now and referred to from there. Docstrings on the private helpers give what they return and the one fact that is not obvious; the worked examples they carried are in the tests, which already run them. The longest block is 8 lines, from 19. 229 lines off the diff. No code changed. --------- Co-authored-by: danielhanchen <unslothai@gmail.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>		2026-07-28 05:49:51 -07:00
.github	Studio: preserve durations across reasoning blocks (#7520 )	2026-07-28 04:53:26 -07:00
images	images: use narrower Discord button and drop duplicate (#5552 )	2026-05-18 05:00:59 -07:00
scripts	tests: read checked-in files as UTF-8 instead of the platform default (#7438 )	2026-07-26 23:31:56 -07:00
studio	Gate the sed commands that run a shell (#7483 )	2026-07-28 05:49:51 -07:00
tests	Fix image and file paste in Studio desktop (#7543 )	2026-07-28 13:46:51 +02:00
unsloth	avoid Hub metadata probe when loading tokenizers with local_files_only (#7482 )	2026-07-27 05:59:48 -07:00
unsloth_cli	feat(studio): run chats in parallel in the Chat tab (#7455 )	2026-07-28 04:40:38 -07:00
.gitattributes	Replace standalone Studio wording with Unsloth (#7221 )	2026-07-19 00:47:04 -07:00
.gitignore	gitignore: match the stray "~" TMPDIR dir at any depth, plus /temp/ (#7499 )	2026-07-27 06:04:08 -07:00
.pre-commit-ci.yaml	pre-commit CI config (#3565 )	2025-11-07 14:44:18 -08:00
.pre-commit-config.yaml	[pre-commit.ci] pre-commit autoupdate (#6587 )	2026-06-23 03:01:11 -07:00
build.sh	Replace standalone Studio wording with Unsloth (#7221 )	2026-07-19 00:47:04 -07:00
cli.py	Rename cli/ to unsloth_cli/ to fix namespace collision with stringzilla (#4393 )	2026-03-17 20:40:21 -07:00
CODE_OF_CONDUCT.md	Update CODE_OF_CONDUCT.md	2025-10-25 19:31:05 -07:00
CONTRIBUTING.md	docs: repository cleanup (#5617 )	2026-06-12 11:07:04 +01:00
COPYING	Rename cli/ to unsloth_cli/ to fix namespace collision with stringzilla (#4393 )	2026-03-17 20:40:21 -07:00
install.ps1	Surface actionable installer failures in Studio desktop (#7529 )	2026-07-28 10:19:44 +02:00
install.sh	Surface actionable installer failures in Studio desktop (#7529 )	2026-07-28 10:19:44 +02:00
LICENSE	Rename cli/ to unsloth_cli/ to fix namespace collision with stringzilla (#4393 )	2026-03-17 20:40:21 -07:00
pyproject.toml	Studio: detect an interrupted dependency install instead of launching a backend that cannot import (#7492 )	2026-07-28 10:57:20 +02:00
README.md	Studio: add UNSLOTH_STUDIO_DISABLE_PUBLIC_CHECK to switch off the startup public lookups (#7433 )	2026-07-27 00:16:53 -07:00
unsloth-cli.py	feat(studio): add DoRA support to studio (#7315 )	2026-07-24 03:24:16 -07:00

README.md

Unsloth Studio lets you run and train models locally.

Features • News • Quickstart • Notebooks • Documentation

⚡ Get started

macOS, Linux, WSL:

curl -fsSL https://unsloth.ai/install.sh | sh

Windows:

irm https://unsloth.ai/install.ps1 | iex

Community:

⭐ Features

Unsloth Studio (Beta) lets you run and train text, audio, embedding, vision models on Windows, Linux and macOS.

Inference

Search + download + run models including GGUF, LoRA adapters, safetensors
Export models: Save or export models to GGUF, 16-bit safetensors and other formats.
Tool calling: Support for self-healing tool calling and web search
Code execution: lets LLMs test code in Claude artifacts and sandbox environments
API inference endpoint: Deploy and run local LLMs in Claude Code, Codex tools with Unsloth
Auto set inference settings and customize chat templates.
We work directly with teams behind gpt-oss, Qwen3, Llama 4, Mistral, Gemma 1-3, and Phi-4, where we’ve fixed bugs that improve model accuracy.
Chat with images, audio, PDFs, code, DOCX and more. Connect API providers (OpenAI, Anthropic) or servers (vLLM, Ollama).
Compare any two models side by side with the same prompt.
OpenAI/Anthropic-compatible APIs: Serve local models through /v1/chat/completions, /v1/responses and /v1/messages.
Connect local models to agents: Use unsloth start with Claude Code, Codex, Hermes and more.
Web/PDF search can read PDF papers, manuals and other PDF results.
GGUF hardware controls: Choose GPUs/layers, offload MoE experts, use multi-GPU or Tensor Parallelism.
The opt-in MCP control endpoint lets AI clients manage models, training, recipes and exports.

Training

Train and RL 500+ models up to 2x faster with 70% less VRAM; MoE up to 12x faster.
Train and run RL on AMD GPUs across Windows, WSL and Linux.
Data Recipes: Auto-create datasets from PDF, CSV, DOCX etc. Edit data in a visual-node workflow.
Reinforcement Learning uses 80% less VRAM for GRPO, FP8 and vision RL, with 7x longer contexts.
Long-context training: 3x faster, 30% less VRAM and 500K+ context.
Supports LoRA/QLoRA, full fine-tuning, RL, pretraining, 4-bit, 16-bit and FP8.
Custom Triton and mathematical kernels built with PyTorch and Hugging Face.
Observability: Monitor training live, track loss and GPU usage and customize graphs.
Multi-GPU training is supported, with major improvements coming soon.

🚀 Unsloth Start

Unsloth Start connects Claude Code, Codex and other agents to local models with one command.

Start Unsloth, load a model, open your project folder, then run:

unsloth start claude

Replace claude with any supported agent:

Agent	Command
Claude Code	`unsloth start claude`
OpenAI Codex	`unsloth start codex`
Hermes Agent	`unsloth start hermes`
OpenClaw	`unsloth start openclaw`
OpenCode	`unsloth start opencode`
Pi Coding Agent	`unsloth start pi`

Claude Code, Codex, OpenCode and Pi can keep their current model and use Unsloth as a local subagent:

unsloth start claude --as-subagent --model unsloth/model-GGUF:quant

📥 Install

Unsloth can be used in two ways: through Unsloth Studio, the web UI, or through Unsloth Core, the code-based version. Each has different requirements.

Unsloth Studio (web UI)

Unsloth Studio (Beta) works on Windows, Linux, WSL and macOS.

CPU: Supported for Chat and Data Recipes currently
NVIDIA: Training works on RTX 30/40/50, Blackwell, DGX Spark, Station and more
macOS: Training, MLX and GGUF inference are ALL supported.
AMD: Training, RL, chat and deployment work on Windows, WSL and Linux. Read the AMD guide.
Vulkan: GGUF inference is supported on compatible GPUs, including Intel GPUs. Vulkan accelerates GGUF inference only; training still requires a supported PyTorch or MLX backend.
Multi-GPU: Available now, with a major upgrade on the way

macOS, Linux, WSL:

curl -fsSL https://unsloth.ai/install.sh | sh

Use the same command to update.

To force the Vulkan llama.cpp backend, set UNSLOTH_FORCE_VULKAN=1 before installing or updating. The setting selects the llama.cpp binary bundle, so setting it only when launching Studio cannot replace an existing CPU bundle:

export UNSLOTH_FORCE_VULKAN=1
curl -fsSL https://unsloth.ai/install.sh | sh

Windows:

irm https://unsloth.ai/install.ps1 | iex

Use the same command to update.

To force the Vulkan llama.cpp backend, set the environment variable before running the installer or updater:

$env:UNSLOTH_FORCE_VULKAN=1
irm https://unsloth.ai/install.ps1 | iex

Re-running the current installer replaces a previously selected CPU bundle when the backend differs. A separate Vulkan SDK is not required; the GPU driver must provide a working Vulkan runtime.

Launch

unsloth studio -p 8888

For LAN or cloud access, add -H 0.0.0.0 (raw port only; add --cloudflare for a public URL). By default, Unsloth is accessible only locally.

To reach Unsloth over HTTPS, use unsloth studio --secure. Unsloth stays bound to localhost and is reached only through a free Cloudflare tunnel, which publishes it at a public https://*.trycloudflare.com URL (it fails closed if the tunnel can't start, so the raw port is never exposed). This makes Unsloth reachable from the internet, so anyone with the link and API key can use it and run code: keep your API key private (see Remote access below).

Docker

Use our Docker image unsloth/unsloth container. Run:

docker run -d -e JUPYTER_PASSWORD="mypassword" \
  -p 8888:8888 -p 8000:8000 -p 2222:22 \
  -v $(pwd)/work:/workspace/work \
  --gpus all \
  unsloth/unsloth

Developer, Nightly, Uninstall

To see developer, nightly and uninstallation etc. instructions, see advanced installation.

Unsloth Core (code-based)

Linux, WSL:

curl -LsSf https://astral.sh/uv/install.sh | sh
uv venv unsloth_env --python 3.13
source unsloth_env/bin/activate
uv pip install unsloth --torch-backend=auto

Windows:

winget install -e --id Python.Python.3.13
winget install --id=astral-sh.uv  -e
uv venv unsloth_env --python 3.13
.\unsloth_env\Scripts\activate
uv pip install unsloth --torch-backend=auto

For Windows, pip install unsloth works only if you have PyTorch installed. Read our Windows Guide. You can use the same Docker image as Unsloth Studio.

AMD, Intel:

For RTX 50x, B200, 6000 GPUs: uv pip install unsloth --torch-backend=auto. Read our guides for: Blackwell and DGX Spark.
To install Unsloth on AMD and Intel GPUs, follow our AMD Guide and Intel Guide.

📒 Free Notebooks

Train for free with our notebooks. You can use our new free Unsloth Studio notebook to run and train models for free in a web UI. Read our guide. Add dataset, run, then deploy your trained model.

Model	Free Notebooks	Performance	Memory use
Gemma 4 (E2B)	▶️ Start for free	1.5x faster	50% less
Qwen3.5 (4B)	▶️ Start for free	1.5x faster	60% less
gpt-oss (20B)	▶️ Start for free	2x faster	70% less
Qwen3.5 GSPO	▶️ Start for free	2x faster	70% less
gpt-oss (20B): GRPO	▶️ Start for free	2x faster	80% less
Qwen3: Advanced GRPO	▶️ Start for free	2x faster	70% less
embeddinggemma (300M)	▶️ Start for free	2x faster	20% less
Mistral Ministral 3 (3B)	▶️ Start for free	1.5x faster	60% less
Llama 3.1 (8B) Alpaca	▶️ Start for free	2x faster	70% less
Llama 3.2 Conversational	▶️ Start for free	2x faster	70% less
Orpheus-TTS (3B)	▶️ Start for free	1.5x faster	50% less

See all our notebooks for: Kaggle, GRPO, TTS, embedding & Vision
See all our models and all our notebooks
See detailed documentation for Unsloth here

🦥 Unsloth News

AMD training: Train, run RL, chat and deploy on AMD GPUs across Windows, WSL and Linux. Guide
GGUF hardware controls: Choose GPU/layer placement, offload MoE experts and use multi-GPU or Tensor Parallelism. #6414
Local models for any agent: Use unsloth start with Claude Code, Codex, Hermes, OpenCode, OpenClaw, Pi and more through Unsloth's OpenAI- and Anthropic-compatible APIs. Guide
MCP control endpoint: Let compatible clients manage models, training, recipes, checkpoints and exports. #7191
Local inference reliability: Resume long chats faster, recover stalled downloads and reuse existing GGUF files. #7204 • #6858 • #7209
New models: Qwen-AgentWorld, Ornith, Kimi K2.7 Code and MiniMax M3
GLM-5.2: Run Z.ai's 744B-parameter, 1M-context open model locally with Unsloth Dynamic GGUFs. Guide
DeepSeek-V4: Run DeepSeek-V4-Flash locally with corrected multi-turn and tool-calling behavior. Guide
DiffusionGemma: Run and fine-tune Google's diffusion language model with 1.8x faster inference in Unsloth Studio. Guide
Qwen3.6: Run and train Qwen3.6 with MTP for 1.4-2.2x faster inference and NVFP4 quants for supported GPUs. Guide
Gemma 4: Run and train Gemma 4 text, image and audio models with QAT, MTP, GGUF and MLX support. Guide
MCP servers: Connect local models to files, apps, databases and external tools through Model Context Protocol. Guide
Connections: Mix local models with API providers (OpenAI, Anthropic) or servers (vLLM, Ollama) in the same interface. Guide
Introducing Unsloth Studio: our new web UI for running and training LLMs. Blog
Train MoE LLMs 12x faster with 35% less VRAM - DeepSeek, GLM, Qwen and gpt-oss. Blog
Embedding models: Unsloth now supports ~1.8-3.3x faster embedding fine-tuning. Blog • Notebooks
New 7x longer context RL vs. all other setups, via our new batching algorithms. Blog
New RoPE & MLP Triton Kernels & Padding Free + Packing: 3x faster training & 30% less VRAM. Blog
500K Context: Training a 20B model with >500K context is now possible on an 80GB GPU. Blog
FP8 & Vision RL: You can now do FP8 & VLM GRPO on consumer GPUs. FP8 Blog • Vision RL

📥 Advanced Installation

The below advanced instructions are for Unsloth Studio. For Unsloth Core advanced installation, view our docs.

Developer / Nightly / Experimental installs: macOS, Linux, WSL:

The developer install builds from the main branch, which is the latest (nightly) source.

git clone https://github.com/unslothai/unsloth
cd unsloth
./install.sh --local
unsloth studio -p 8888

To install into an isolated location (its own virtual env, auth/, studio.db, cache and llama.cpp build), set UNSLOTH_STUDIO_HOME and pass it again at launch:

UNSLOTH_STUDIO_HOME="$PWD/.studio" ./install.sh --local
UNSLOTH_STUDIO_HOME="$PWD/.studio" unsloth studio -p 8888

Then to update :

cd unsloth && git pull
./install.sh --local
unsloth studio -p 8888

Developer / Nightly / Experimental installs: Windows PowerShell:

The developer install builds from the main branch, which is the latest (nightly) source.

git clone https://github.com/unslothai/unsloth.git
cd unsloth
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\install.ps1 --local
unsloth studio -p 8888

To install into an isolated location (its own virtual env, auth/, studio.db, cache and llama.cpp build), set UNSLOTH_STUDIO_HOME and pass it again at launch:

$env:UNSLOTH_STUDIO_HOME="$PWD\.studio"; .\install.ps1 --local
$env:UNSLOTH_STUDIO_HOME="$PWD\.studio"; unsloth studio -p 8888

Then to update :

cd unsloth; git pull
.\install.ps1 --local
unsloth studio -p 8888

Remote access: `--secure` (HTTPS tunnel) vs raw port

By default unsloth studio binds to 127.0.0.1 (this machine only). To reach it from another device, pick one of:

--secure (recommended): serve only through a free Cloudflare HTTPS link. Unsloth stays bound to localhost and the tunnel provides the public URL; it fails closed (does not start) if the tunnel can't come up, so the raw port is never exposed.

unsloth studio --secure -p 8888

-H 0.0.0.0: bind the raw port on all network interfaces, reachable from anywhere on the network (subject to your firewall). It does not create a public internet URL; add --cloudflare to also publish an internet-reachable https://*.trycloudflare.com link even behind a firewall. Only use this on a network you trust.

unsloth studio -H 0.0.0.0 -p 8888

The Cloudflare tunnel is off by default: -H 0.0.0.0 exposes the raw port only, not a public internet URL. Pair the wildcard bind with --cloudflare (unsloth studio -H 0.0.0.0 --cloudflare) to also publish a public https://*.trycloudflare.com link, or prefer --secure (above), which keeps the raw port private. --cloudflare has no effect on a loopback bind.

On a wildcard bind Unsloth works out the address to share by asking ifconfig.me for the public IP, then asks check-host.net whether that port is reachable so it can tell you if a firewall is in the way. Both contact a third party. Set UNSLOTH_STUDIO_DISABLE_PUBLIC_CHECK=1 to skip them; the banner then shows the LAN address and no reachability line.

The first time Unsloth is published on a public URL (--secure or --cloudflare) with the auto-generated admin password still in place, it asks for a new admin password in the terminal (masked input with confirmation) before the public link goes up. Without an attached terminal it warns instead and keeps the bootstrap deadline: Unsloth shuts down after UNSLOTH_STUDIO_BOOTSTRAP_TIMEOUT (default 1 hour) unless the password is changed in the web UI.

For headless setups that cannot answer that prompt, set the initial admin password non-interactively with --password (only takes effect when no password is set yet; if one already exists it is a hard error, so rotate later with unsloth studio reset-password):

unsloth studio --secure --password 'your-strong-password'        # visible in `ps`/history
UNSLOTH_STUDIO_PASSWORD='your-strong-password' unsloth studio --secure   # via env var
printf '%s\n' 'your-strong-password' | unsloth studio --secure --password -   # via stdin

A literal --password VALUE is visible in the process list and shell history, so prefer the UNSLOTH_STUDIO_PASSWORD env var or --password - (stdin) for automation. This applies to any launch (public or a headless -H 0.0.0.0 bind), and the password is set in the parent before the server binds, so it never reaches a re-executed child process.

Server-side tools (web search, Python and terminal code execution) run as your user and are on by default. Anyone who can reach the server with the API key can run code on this machine, so keep your API key private and pass --disable-tools when exposing Unsloth.

Advanced launch options

Installer options can be passed as environment variables. On macOS, Linux and WSL place the variable after the pipe so the shell passes it to sh; on Windows set it with $env: before piping to iex.

Skip PyTorch (GGUF-only mode):

curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_NO_TORCH=1 sh

$env:UNSLOTH_NO_TORCH=1; irm https://unsloth.ai/install.ps1 | iex

Skip the post-install prompt that starts Unsloth (useful for automated installs):

curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_SKIP_AUTOSTART=1 sh

$env:UNSLOTH_SKIP_AUTOSTART=1; irm https://unsloth.ai/install.ps1 | iex

Pin the Python version:

curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_PYTHON=3.12 sh

$env:UNSLOTH_PYTHON='3.12'; irm https://unsloth.ai/install.ps1 | iex

Install to a custom location with UNSLOTH_STUDIO_HOME:

curl -fsSL https://unsloth.ai/install.sh | UNSLOTH_STUDIO_HOME=/abs/path sh

$env:UNSLOTH_STUDIO_HOME='C:\path'; irm https://unsloth.ai/install.ps1 | iex

On macOS, the installer defaults to the system certificate store (UV_SYSTEM_CERTS=1) so uv trusts the CAs in your Keychain, needed behind TLS-inspecting proxies (Cisco Umbrella, Zscaler, etc.). Opt out with:

curl -fsSL https://unsloth.ai/install.sh | UV_SYSTEM_CERTS=0 sh

Point the frontend build at a corporate npm mirror/proxy with UNSLOTH_NPM_REGISTRY (for the developer install behind a firewall that blocks registry.npmjs.org):

UNSLOTH_NPM_REGISTRY=https://artifactory.example.com/api/npm/npm/ ./install.sh --local

$env:UNSLOTH_NPM_REGISTRY='https://artifactory.example.com/api/npm/npm/'; .\install.ps1 --local

It is threaded as --registry into the Unsloth frontend npm/bun installs; the supply-chain locks (7-day min-release-age, exact version pins) stay in force.

Cap Unsloth's native CPU thread pools on high-core hosts: UNSLOTH_CPU_THREADS=8 unsloth studio -p 8888.

Uninstall

The recommended way to fully remove Unsloth Studio is the matching uninstall script for your OS. It stops any running servers, removes the install dir, the launcher data dir, the desktop shortcut, and any platform-specific entries (macOS .app bundle + Launch Services on Mac; Start Menu, HKCU\Software\Unsloth registry key and user PATH entries on Windows):

MacOS, WSL, Linux: curl -fsSL https://raw.githubusercontent.com/unslothai/unsloth/main/scripts/uninstall.sh | sh
Windows (PowerShell): irm https://raw.githubusercontent.com/unslothai/unsloth/main/scripts/uninstall.ps1 | iex

If you only want to drop the install dir and keep the launcher/shortcut for a later reinstall, you can instead run rm -rf ~/.unsloth/studio (Mac/Linux/WSL) or Remove-Item -Recurse -Force "$HOME\.unsloth\studio" (Windows). The model cache at ~/.cache/huggingface is not touched by any of these.

For more info, see our docs.

Deleting model files

You can delete old model files either from the bin icon in model search or by removing the relevant cached model folder from the default Hugging Face cache directory. By default, HF uses:

MacOS, Linux, WSL: ~/.cache/huggingface/hub/
Windows: %USERPROFILE%\.cache\huggingface\hub\

💚 Community and Links

Type	Links
Discord	Join Discord server
r/unsloth Reddit	Join Reddit community
📚 Documentation & Wiki	Read Our Docs
Twitter (aka X)	Follow us on X
🔮 Our Models	Unsloth Catalog
✍️ Blog	Read our Blogs

Citation

You can cite the Unsloth repo as follows:

@software{unsloth,
  author = {Daniel Han, Michael Han and Unsloth team},
  title = {Unsloth},
  url = {https://github.com/unslothai/unsloth},
  year = {2023}
}

If you trained a model with 🦥Unsloth, you can use this cool sticker!

License

Unsloth uses a dual-licensing model of Apache 2.0 and AGPL-3.0. The core Unsloth package remains licensed under Apache 2.0, while certain optional components, such as the Unsloth Studio UI are licensed under the open-source license AGPL-3.0.

This structure helps support ongoing Unsloth development while keeping the project open source and enabling the broader ecosystem to continue growing.

Thank You to

The llama.cpp library that lets users run and save models with Unsloth
The Hugging Face team and their libraries: transformers and TRL
The Pytorch and Torch AO team for their contributions
NVIDIA for their NeMo DataDesigner library and their contributions
And of course for every single person who has contributed or has used Unsloth!

README.md Unescape Escape

Unsloth Studio lets you run and train models locally.

⚡ Get started

macOS, Linux, WSL:

Windows:

Community:

⭐ Features

Inference

Training

🚀 Unsloth Start

📥 Install

Unsloth Studio (web UI)

macOS, Linux, WSL:

Windows:

Launch

Docker

Developer, Nightly, Uninstall

Unsloth Core (code-based)

Linux, WSL:

Windows:

AMD, Intel:

📒 Free Notebooks

🦥 Unsloth News

📥 Advanced Installation

Developer / Nightly / Experimental installs: macOS, Linux, WSL:

Developer / Nightly / Experimental installs: Windows PowerShell:

Remote access: --secure (HTTPS tunnel) vs raw port

Advanced launch options

Uninstall

Deleting model files

💚 Community and Links

Citation

License

Thank You to

README.md

Remote access: `--secure` (HTTPS tunnel) vs raw port