Private Knowledge Base Q&A Site (RAG)

Productivity

A self-hosted RAG service where you upload documents and ask questions directly against them: a vector store and a local embedding engine are built in, with a web interface; the quickstart pins the official image by digest.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed5 / 5

Who it is for

Small and medium teams, consultants, and internal-policy or compliance document settings that want a privately deployed knowledge base for question answering: they do not want to assemble a vector store, an embedding engine and a front end themselves, and they do not want to hand internal documents to a cloud SaaS; which LLM to use, and how much to spend on it, is the buyer's decision.

How to start

$ cd quickstart
$ cp .env.example .env && chmod 666 .env
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸browser-extension23

.gitignore
LICENSE
README.md
index.html
package.json
postcss.config.js
public/
src/
tailwind.config.js
vite.config.js

▸cloud-deployments30

aws/
digitalocean/
gcp/
helm/
huggingface-spaces/
k8/
openshift/

▸collector76

.env.example
.gitignore
.nvmrc
__tests__/
convertAudioToWav/
eslint.config.mjs
extensions/
hotdir/
index.js
middleware/
…

▸docker10

.env.example
Dockerfile
HOW_TO_USE_DOCKER.md
docker-compose.yml
docker-entrypoint.sh
docker-healthcheck.sh
vex/

▸embed62

.gitignore
LICENSE
README.md
index.html
jsconfig.json
package.json
postcss.config.js
scripts/
src/
tailwind.config.js
…

▸extras12

scripts/
support/
translator/

▸frontend706

.env.example
.gitignore
.nvmrc
eslint.config.js
index.html
jsconfig.json
package.json
postcss.config.js
public/
scripts/
…

▸images8

deployBtns/
promo.png
screenshots/
wordmark.png
youtube.png

▸locales4

README.fa-IR.md
README.ja-JP.md
README.tr-TR.md
README.zh-CN.md

▸open-computer451

.gitignore
.gitmodules
DEVELOPMENT.md
LICENSE
README.md
assets/
cli/
master/
open-computer
open-computer.cmd
…

▸quickstart2

.env.example
docker-compose.yml

▸server572

.env.example
.flowconfig
.gitignore
.nvmrc
__tests__/
endpoints/
eslint.config.mjs
index.js
jobs/
jsconfig.json
…

▫ATTRIBUTION.md

▫BARE_METAL.md

▫CONTRIBUTING.md

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫TERMS_SELF_HOSTED.md

▫delivery-manifest.txt

▫eslint.config.js

▫jest.config.cjs

▫package.json

▫pull_request_template.md

▫Config and hidden files 28

Latest passing run

Clone → Checkout → Toolchain → Pull image → Run probe → Teardown clean

Pre-purchase Disclosure

What you are buying

A self-hosted private knowledge base question-answering service (RAG): upload documents and ask questions against them; a web interface, with a vector database and a local embedding engine built in, started with docker compose.

Derived from an MIT-licensed open source all-in-one RAG application; the quickstart that pins the official image by digest, the Traditional Chinese documentation and the vetting are ours, and every change made to an upstream file is listed one by one in the ATTRIBUTION.md inside the zip. Delivery is a frozen snapshot: one zip file, taken from the product repository at revision 0d773d9.

Known limitations

The quickstart configuration serves port 3001 over HTTP, with no TLS, domain or reverse proxy configuration included
Asking questions needs an LLM you bring yourself: a cloud provider key, or a local Ollama / LM Studio; without one it still starts and the interface can be viewed
Interface settings and keys are written back to quickstart/.env; documents and the vector store live in a volume, and down -v clears them along with it
The first start fetches from the network: it downloads the official release image pinned by digest
The page’s sharing preview tags (og:image / og:url) point at upstream’s website and at an external image address
Upstream usage statistics are on by default and sent to PostHog; the delivered configuration has them turned off, and that can be changed back in the interface or in .env
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit c8bd644. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

4 PASS1 WARN0 FAIL

Source ReviewPASS

Not a file-by-file review (the whole tree holds 5,740 tracked files, counted with git ls-tree at the evidence commit); the method was as follows and its scope is recorded as it stands: (1) pattern scanning of server/collector — eval( 0 occurrences, postinstall across all package.json files 0 occurrences; (2) every child_process use inside server / collector was read by hand: ffmpeg detection (execSync which ffmpeg), git rev-parse HEAD, @vscode/ripgrep file search ×2, and the MCP hypervisor — for the last of these upstream notes of itself that "MCP is basically arbitrary code execution", which is a matter of what the feature does (it runs the MCP servers the buyer configures) and is not triggered while nothing is configured, as is the case by default; (3) the files we added were read line by line (the quickstart compose file, .env.example, QUICKSTART and LICENSE-99LL); (4) upstream is a public repository and its SECURITY.md is present (vendored as SECURITY.upstream.md).

Script SafetyPASS

docker/docker-entrypoint.sh (28 lines) was read line by line: prisma generate plus migrate deploy, then it starts the two node processes for server and collector, with nothing downloaded and executed and no sudo; docker/docker-healthcheck.sh (13 lines) only curls localhost:3001/api/ping; the quickstart work we added contains no script at all.

RecencyPASS

At the time of vetting (2026) upstream's pinned commit c8bd6442 was the master HEAD as it then stood, the official image was rebuilt on that same push, and the image label revision and the pinned commit were consistent (actually checked); this snapshot is pinned and does not follow upstream.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream is MIT: the GitHub REST API judges it MIT and the root LICENSE is word for word "The MIT License" (Copyright Mintplex Labs Inc.), kept as it stands and not to be removed (ATTRIBUTION.md sets out that obligation, and the zip must contain it); the parts we added carry the 99LL product licence template v1 as additional sale and liability terms (LICENSE-99LL.md; the only difference from the template being the self-referential rewriting of the delivery version field, listed item by item at the end of that file). spdx expresses the custom licence of the product as a whole in LicenseRef form.

Dependency LicensesWARN

Several hundred npm dependencies (three package.json files, for server / frontend / collector) were not verified item by item; this is honestly flagged as uncertain and not dressed up. Upstream is itself MIT and distributes the same set of dependencies through its official Docker Hub image (the quickstart uses that image, pinned by digest), so the distribution obligations for those dependencies fall first on upstream's image release. No SBOM-level inventory was taken; raising the confidence of that reading would require scanning all three lockfiles item by item.