anarlog: Open-Source Granola Alternative for Meeting Notes (GitHub, Scanned)

anarlog is a meeting notepad in the style of Granola. Instead of sending a bot into Zoom, Meet or Teams, it captures audio on your own computer, transcribes it, and turns your rough notes plus the transcript into a clean summary you can edit like a document and export as Markdown. Notes, transcripts and recordings sit in a local SQLite database and plain files, and there is a CLI and MCP server so agents can read them.

Its selling point is choice over where your conversations go. On supported Macs transcription can run fully on-device; summaries and chat can use a local model through Ollama or LM Studio, your own API key, or the optional paid cloud. CloudSync and sharing are off by default. The desktop app is built with Tauri, Rust and React for macOS, Windows and Linux, and it is MIT-licensed, with commercially licensed enterprise parts kept in a separate folder.

History worth knowing: the project began as Hyprnote and the team now also builds a separate product called char. The README states that anarlog stays open source and maintained, and a new desktop release shipped the day before the scan.

• Repository: github.com/fastrepl/anarlog
• Licence: MIT (MIT License)
• Language: Rust. Stars: 9,599. Forks: 803. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit 341ccb3

Who it is for

People who want AI meeting notes without a recording bot in the participant list or their calls stored in someone else's cloud, and teams that need a notetaker that can pass a security review.

Getting started

1. Download the app for macOS, Windows or Linux from anarlog.so/download, or clone the source

git clone https://github.com/fastrepl/anarlog.git && cd anarlog

2. Install the workspace (needs Node.js 22+, pnpm, Rust and the Tauri prerequisites)

pnpm install --frozen-lockfile

3. Start the desktop app in development mode

pnpm dev:desktop

On Linux, bash scripts/setup-linux.sh installs the build dependencies first, using sudo. The local desktop app starts without any secrets; cloud AI, sync and billing need extra services.

Safety scan

We cloned fastrepl/anarlog at commit 341ccb3 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The 3 private-key hits are one throwaway EC test key, repeated in the test modules of apps/api/src/tests.rs, crates/api-cloud/src/routes.rs and crates/supabase-auth/src/server/mod.rs to sign OAuth test tokens. No real key is present.
• The 4 pattern hits: a 9,000-character line in a generated API client, and scripts/setup-devtools.sh, a maintainer script that pipes the dprint, Taskfile and Infisical installers to a shell, two of them with sudo. The other sudo scripts install Linux build packages. 59 Cargo build scripts are normal for a Tauri app with this many plugins.
• 12 committed binaries are prebuilt builds of the SQLite Sync extension (cloudsync) from sqliteai/sqlite-sync 1.2.0 for each platform, used by the opt-in CloudSync feature. They are compiled third-party code you cannot review in the repository.
• plugins/analytics sends product usage events unless an opt-out flag is set, and checks that flag before every send. Hosted transcription and AI (Deepgram, AssemblyAI, OpenAI, OpenRouter and others among the hosts) are used only for the providers you pick.
• 117 known advisories (4 critical): 79 hits in Cargo.lock (2 critical, in the zip crate), 14 in the enterprise Cargo.lock and 26 in pnpm-lock.yaml (dompurify and shell-quote among the critical ones). 32 workflows, none using pull_request_target; 7 of 32 third-party actions pinned. Security policy, Dependabot, CodeQL and contributing guide present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 423.5K, Rust 420.5K, JSON 289K, SQL 82.2K, Markdown 49.8K, JavaScript 19K.

Questions

Is anarlog free?

Yes. The community app is MIT-licensed and free, including local transcription and bring-your-own model or API key. There is an optional paid Pro plan for hosted transcription and AI, and the enterprise components in the enterprise folder are under a commercial licence.

Does anarlog send my meetings to the cloud?

Only if you choose a cloud provider. Audio is captured on your device, transcription can run on-device on supported Macs, summaries can use a local model, and CloudSync is off by default. The app does send product usage analytics unless you opt out.

Do I need to tell people I am recording?

Yes, you should. No bot joins the call, so other participants will not see a recorder, but recording laws in many places require consent from everyone on the call. Say at the start that you are taking AI notes.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.