AnythingLLM

Why it's ranked here

MIT licensed, with a public security policy that spells out exactly which attack classes count as bugs and which are accepted trust boundaries rather than leaving that judgment implicit. The provider list runs past thirty chat backends and nine vector databases, so a deployment is not locked to one vendor. Agent behavior runs through an internal orchestration layer rather than bolted-on prompt tricks, and no-code flows are blocked from carrying unsupported step types across platforms. That combination of license clarity, provider breadth, and a written threat model is unusual for a project this size.

What's good

The codebase separates concerns cleanly: a dedicated collector process isolates untrusted document parsing and web scraping from the main server, and the agent runtime treats every external tool the same way, whether it is a locally defined skill, a saved no-code flow, or a call out to an external tool server over a standard protocol. The security policy is unusually specific about intended behavior, spelling out which admin-configured capabilities are deliberate rather than bugs, which keeps the threat model honest instead of vague. Per-provider credential checks run before an agent session is even allowed to start.

Tradeoffs

Multi-user support and the embeddable chat widget are called out in the documentation as available only through the Docker deployment, so running from source or on bare metal narrows what an instance can actually do. The bare-metal path itself carries an explicit warning that the core team will not support or answer issues raised against it. The security policy also states plainly that skipping password or multi-user setup leaves an instance reachable by anyone who has the address, which is a real operational risk if an administrator forgets that step during setup.

How to use it well

Run it in Docker if more than one person needs access: several features, including multi-user permissioning and the embeddable widget, do not exist outside that path. Before turning on admin-only agent tools such as database or filesystem access, scope the underlying credentials narrowly yourself, a read-only database account, a limited file path, since the application will not stop an enabled tool from doing whatever that credential allows. Skip it if you need a vendor-backed support agreement: the self-hosted terms explicitly rule out a service-level guarantee outside a separate enterprise contract.

Observed

License

MIT (LICENSE).

Architecture

Server and collector run as two separate Express processes; the frontend is a separate build served statically in production (server/index.js, collector/index.js, frontend/index.html).

Interfaces

A browser UI, a versioned HTTP developer API (server/endpoints/api/index.js), and an MCP client layer that converts external MCP servers into callable agent tools (server/utils/MCP/index.js).

Deployment

Primary supported deployment is Docker; a bare-metal Node.js deployment path is documented but explicitly marked unsupported by the core team (BARE_METAL.md).

Platform support

Desktop builds are distributed for Mac, Windows and Linux in addition to the server-based deployment (README).

Agent flows

No-code agent flows are stored as individual JSON files and validated against a fixed set of supported step types before they can run (server/utils/agentFlows/index.js).

Security posture

The published security policy documents intended trust boundaries rather than a defect list: admin-configured outbound connections and unauthenticated instances are declared by-design (SECURITY.md).