Meilisearch

Why it's ranked here

The engineering here is serious. Production mode refuses to boot without a master key of a minimum length, API keys are scoped to index patterns with expiry dates, and tenant tokens intersect with those keys so the more restrictive rule wins. Upgrades get their own declarative test format that starts an older released binary, replays commands, then swaps the binary in place against the same database to prove it still reads. Two things keep this from being a clean recommendation: part of the server is licensed under Business Source License 1.1 rather than MIT, and personalized reranking calls an outside vendor.

What's good

Defaults lean strict where it counts. Outbound requests deny local IP ranges unless you list exceptions, so server-side request forgery takes a deliberate opt-in. Search carries an abort timer and a queue whose depth you set, which stops a traffic spike from becoming unbounded work. The upgrade tests chain real binaries against one long-lived database rather than fresh temporary ones, the failure mode most projects never cover. Reranking retries up to ten times but returns the original ordering once the deadline passes, so personalization degrades quietly instead of failing the query.

Tradeoffs

Cross-origin handling is wide open by default: any origin, any header, any method, with a 24 hour preflight cache. That is fine behind a proxy and risky if you expose the port directly. Anonymous telemetry is on unless you pass the flag that turns it off. Windows gets a lower default limit on simultaneously open indexes and refuses one indexing memory option outright. Many behaviours sit behind experimental flags and environment variables, so two deployments can differ in ways the API surface does not advertise.

How to use it well

Reach for this when database full text search stops giving good relevance and running a search cluster is more operations than you want. It fits behind your own API: your service owns the source of truth, pushes documents in, and hands out scoped keys per tenant. Poll the task queue rather than assuming a write is immediately visible. It does not crawl or ingest for you, it is not a general document store or an analytics engine, and the bundled dashboard only runs in development mode, so a customer-facing search interface is still yours to build.

Observed

License

MIT for most of the work, Business Source License 1.1 for the enterprise-edition parts (SPDX: MIT AND BUSL-1.1)

Language

Rust, a single Cargo workspace of 23 member crates

Storage

Embedded LMDB via heed, memory-mapped on local disk, no external database service

Interface

HTTP REST API served by actix-web; documented local server is http://localhost:7700

Auth model

Master key required in production, plus API keys scoped to index patterns with expiry, plus tenant tokens

Vector and hybrid search

Embedding and nearest-neighbour crates are compiled into the core engine, not a separate service

Testing surface

Declarative JSON workloads executed by a cargo xtask command, including binary swaps that exercise dumpless upgrades

Platform notes

Windows supported with a lower default open-index limit and one indexing memory flag rejected

Telemetry

Anonymous analytics enabled unless the no-analytics option is set

Third-party coupling

Personalized reranking is disabled unless a Cohere API key is supplied

Contribution stance

The repository ships a notice asking AI agents not to modify it, use its forge features, or train on it