Big-AGI is a chat interface for AI models that you run with your own API keys. It connects to OpenAI, Anthropic, Google, DeepSeek, OpenRouter, local servers such as Ollama and LocalAI, and many more, and keeps your conversations in the browser. On top of normal chat it has personas, voice input and output, image generation, web search with citations, PDF import and a request inspector that shows exactly what was sent to each model.
Its signature feature is Beam: send one question to several models side by side, then merge the best parts of their answers into one. For checking facts or comparing how models handle a hard problem, that is quicker than juggling tabs. It is built as a fast Next.js web app, MIT-licensed, and updated within days of new model releases.
The limits: you pay each provider for what you use, since the open version has no models of its own. The hosted big-agi.com has a free tier and a $10.99 a month Pro plan for syncing across devices; self-hosting gives you the open version without sync.
- Repository: github.com/enricoros/big-AGI
- Licence: MIT (MIT License)
- Language: TypeScript. Stars: 7,154. Forks: 1,594. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit cc29d9d
Who it is for
People who already pay for API access to more than one AI provider and want one workspace for all of them, and teams who want a self-hosted chat front end they control.
Getting started
1. Run the prebuilt Docker image (see the telemetry note below)
docker run -d -p 3000:3000 ghcr.io/enricoros/big-agi2. Or build and run from source (needs Node.js)
git clone https://github.com/enricoros/big-AGI.git && cd big-AGI && npm install && npm run build && npx next start --port 3000Open http://localhost:3000 and add your API keys in the model settings. You can also use the hosted version at big-agi.com without installing anything.
Safety scan
We cloned enricoros/big-AGI at commit cc29d9d on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs in about 218,000 lines, mostly TypeScript.
- docs/deploy-analytics.md states that official prebuilt images report page views and feature-usage events, without prompts or conversation content, to a Google Analytics property for self-hosted deployments. The ID is baked in at build time, so passing an environment variable to docker run does not turn it off; building from source without it does. PostHog support exists too, but only when a deployer sets its key.
- One install hook: package.json runs prisma generate after npm install, which generates database client code and is standard for Prisma projects.
- package-lock.json covers 867 npm packages with one critical advisory (DOMPurify 3.4.14, a sanitiser bypass in its template-safe mode) and 70 high ones, most of them axios 1.13.2. Worth watching on a public deployment; less pressing on a private one.
- Four workflows, none using pull_request_target; 7 of 9 third-party actions pinned to a commit. Security policy and Dependabot present; no CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | None. |
| CI workflows | 4 workflows. None use pull_request_target. 2 of 9 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, big-agi.com, openrouter.ai, phosphoricons.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 139 advisories across 839 pinned packages: 1 critical, 70 high, 57 moderate, 11 low. package-lock.json: 867 packages, 139 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file. Missing CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (1)
package.jsonpostinstall:prisma generate --no-hints
Worst known vulnerabilities (24 of 139)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-cg2g-xh64-v4q7 | critical | dompurify@3.4.14 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output mo… |
| GHSA-7h2j-956f-4vf2 | high | @isaacs/brace-expansion@5.0.0 | @isaacs/brace-expansion has Uncontrolled Resource Consumption |
| GHSA-35jp-ww65-95wh | high | axios@1.13.2 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| GHSA-3g43-6gmg-66jw | high | axios@1.13.2 | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| GHSA-3pq3-5fj3-cg6v | high | axios@1.13.2 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
| GHSA-43fc-jf86-j433 | high | axios@1.13.2 | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
| GHSA-542g-h47m-68v8 | high | axios@1.13.2 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
| GHSA-6chq-wfr3-2hj9 | high | axios@1.13.2 | Axios: Header Injection via Prototype Pollution |
| GHSA-777c-7fjr-54vf | high | axios@1.13.2 | Allocation of Resources Without Limits or Throttling in Axios |
| GHSA-hfxv-24rg-xrqf | high | axios@1.13.2 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| GHSA-j5f8-grm9-p9fc | high | axios@1.13.2 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
| GHSA-p92q-9vqr-4j8v | high | axios@1.13.2 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
| GHSA-pf86-5x62-jrwf | high | axios@1.13.2 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| GHSA-pmwg-cvhr-8vh7 | high | axios@1.13.2 | Axios: Incomplete Fix for CVE-2025-62718 - NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax… |
| GHSA-q8qp-cvcw-x6jj | high | axios@1.13.2 | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
| GHSA-hmw2-7cc7-3qxx | high | form-data@4.0.4 | form-data: CRLF injection in form-data via unescaped multipart field names and filenames |
| GHSA-23c5-xmqv-rm74 | high | minimatch@10.1.1 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| GHSA-3ppc-4f35-3m26 | high | minimatch@10.1.1 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
| GHSA-7r86-cg39-jmmj | high | minimatch@10.1.1 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@5.0.7 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@5.0.7 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@5.0.7 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@5.0.7 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-27p8-2357-5qqv | high | @xmldom/xmldom@0.8.11 | xmldom: DocType `name` Injection Bypasses requireWellFormed |
By the numbers
| Stars | 7,154 |
|---|---|
| Forks | 1,594 |
| Contributors | 68 |
| Commits | 9,038 |
| Open issues | 159 |
| Open pull requests | 21 |
| Releases | 24 |
| Latest release | v2.1.2 |
| Licence | MIT |
| Main language | TypeScript |
| Project age | 3 years |
| Last push | Oct 26, 2026 |
| Tracked files | 1,351 |
| Lines of code | 217.9K |
| Checkout size | 22 MB |
Lines by language: TypeScript 172.9K, Markdown 29.9K, JavaScript 5,695, JSON 4,161, CSS 1,994, HTML 1,317.
Questions
Is Big-AGI free?
The open-source version is MIT-licensed and free to self-host. You pay the AI providers for usage with your own API keys. The hosted big-agi.com has a free tier and a Pro plan at $10.99 a month that adds sync across devices.
What is Beam in Big-AGI?
Beam sends the same prompt to several models at once, shows their answers side by side, and can merge them into one combined answer. It is useful for comparing models and catching an answer that only one of them gets wrong.
Does Big-AGI work with local models?
Yes. It connects to Ollama, LocalAI, LM Studio and other OpenAI-compatible servers, so you can use it with no cloud provider at all.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.