Khoj is a personal assistant built around your own files. Point it at Markdown, org-mode, PDFs, Word documents, Notion or a GitHub repository and it indexes them for semantic search, then answers questions in chat with references, pulling in web results when your notes run out. On top sit custom agents with their own knowledge and persona, scheduled automations that email you research digests, image generation and voice. You reach it from a web app, a desktop app, Obsidian, Emacs, a phone or WhatsApp.
It works with any model: a local one through Ollama or another OpenAI-compatible server, or OpenAI, Anthropic and Gemini with your own keys. The project comes from Khoj Inc., which runs a hosted version at app.khoj.dev, and the self-hosted server is AGPL-3.0. Activity has slowed: the last commit in this scan is from August 2026, the latest release is a beta from March, and the team's newest project is a separate desktop agent called Pipali.
- Repository: github.com/khoj-ai/khoj
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: Python. Stars: 37.5K. Forks: 2,498. Last push: Aug 2, 2026.
- Scan: safe, Aug 2, 2026, commit ae229ca
Who it is for
Note-takers with a large Obsidian, org-mode or Markdown collection who want to ask questions of it, and privacy-minded users who want a research assistant running on their own machine.
Getting started
1. Download the Docker Compose file, then set the admin login and model settings in it
wget https://raw.githubusercontent.com/khoj-ai/khoj/master/docker-compose.yml2. Start Khoj in the same directory, then open http://localhost:42110
docker-compose up3. Or install with pip (the docs list CMAKE_ARGS for GPU builds)
python -m pip install 'khoj[local]'4. And start the pip install with an embedded database, for a single user
USE_EMBEDDED_DB="true" khoj --anonymous-mode--anonymous-mode turns off login, which is fine on one machine and not on a shared network. Anonymous usage telemetry is on by default; set KHOJ_TELEMETRY_DISABLE=True to turn it off.
Safety scan
We cloned khoj-ai/khoj at commit ae229ca on Aug 2, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no self-decoding code and no bare-IP URLs across about 100,000 lines of Python and TypeScript. The one binary is the Android app's Gradle wrapper jar, standard in any Android project.
- One pattern hit: the development container's Dockerfile installs Bun with its curl | bash script. That runs when a contributor builds the dev container, not when you install Khoj. The one npm hook sets up Husky git hooks for contributors.
- Telemetry is documented and on by default: the server batches usage metadata (client, API used, content types, host) and posts it to a telemetry endpoint run by the Khoj team, which the docs say forwards to PostHog. KHOJ_TELEMETRY_DISABLE=True turns it off. Separately, the web app and the Obsidian plugin call ipapi.co from your browser for your city and timezone, which shares your IP address with that service.
- 194 known advisories, 3 critical. In uv.lock, anyio is pinned at 4.8.0 as a runtime dependency (a TLS host-name issue), and GitPython is a test-only dependency. torch, Django and PyMuPDF are also pinned exactly, so fixes arrive only with a Khoj release. The desktop app's lockfile carries Electron 39 advisories, and the documentation site's yarn.lock holds the third critical.
- 11 workflows, none using pull_request_target; none of the 18 third-party actions is pinned to a commit. Licence present; no security policy, contributing guide, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 11 workflows. None use pull_request_target. 18 of 18 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, assets.khoj.dev, app.khoj.dev, docs.djangoproject.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 194 advisories across 1,572 pinned packages: 3 critical, 106 high, 63 moderate, 19 low, 3 unrated. documentation/yarn.lock: 1,178 packages, 50 advisories; src/interface/desktop/yarn.lock: 192 packages, 30 advisories; src/interface/obsidian/yarn.lock: 122 packages, 12 advisories; uv.lock: 213 packages, 108 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| .devcontainer/Dockerfile:5 | download-piped-to-shell | RUN curl -fsSL https://bun.sh/install | bash && mv /root/.bun/bin/bun /usr/local/bin/bun |
npm lifecycle scripts (1)
src/interface/web/package.jsonprepare:husky
Committed binaries (1)
src/interface/android/gradle/wrapper/gradle-wrapper.jar: JAR, 56 KB
Worst known vulnerabilities (24 of 194)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-xv26-6w52-cph6 | critical | websocket-driver@0.7.4 | websocket-driver: Message corruption via abuse of protocol length headers |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.8.0 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.50 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-73wf-gq98-2v4g | high | browserslist@4.28.1 | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
| GHSA-c83g-rgw3-j3cx | high | browserslist@4.28.1 | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
| GHSA-4c8g-83qw-93j6 | high | fast-uri@3.1.2 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| GHSA-7p8r-x3mc-p8w7 | high | fast-uri@3.1.2 | fast-uri vulnerable to host confusion via backslash authority introducer |
| GHSA-f65p-4m7j-42xc | high | fast-uri@3.1.2 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
| GHSA-fph4-wmhf-6fwf | high | fast-uri@3.1.2 | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
| GHSA-jqff-g426-hqxp | high | fast-uri@3.1.2 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
| GHSA-v2hh-gcrm-f6hx | high | fast-uri@3.1.2 | fast-uri vulnerable to host confusion via literal backslash authority delimiter |
| GHSA-5p2g-fcmc-qvqq | high | image-size@2.0.2 | image-size: JXL and HEIF parsers allow denial of service through infinite loops |
| GHSA-w3rx-r6r6-pgpr | high | image-size@2.0.2 | image-size: ICNS parser allows denial of service through an infinite loop |
| GHSA-2883-xcg3-v3hh | high | js-yaml@3.14.2 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@3.14.2 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@3.14.2 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.1.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@4.1.1 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@4.1.1 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-28wg-ghj8-5hjv | high | nanoid@3.3.11 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.11 | nanoid: custom generators can loop indefinitely when size is zero |
By the numbers
| Stars | 37.5K |
|---|---|
| Forks | 2,498 |
| Contributors | 76 |
| Commits | 5,180 |
| Open issues | 107 |
| Open pull requests | 55 |
| Releases | 173 |
| Latest release | 2.0.0-beta.28 |
| Licence | AGPL-3.0 |
| Main language | Python |
| Project age | 5 years |
| Last push | Aug 2, 2026 |
| Tracked files | 702 |
| Lines of code | 99.8K |
| Checkout size | 85 MB |
Lines by language: Python 42.5K, TypeScript 27.3K, JavaScript 13.7K, CSS 6,195, HTML 4,349, Markdown 2,553.
Questions
Is Khoj free?
Self-hosting is free. The server is AGPL-3.0, so you can run and modify it, and if you offer a modified version to others over a network you must publish your changes. Khoj Inc. also runs a hosted version at app.khoj.dev with a paid subscription. Model costs depend on what you connect; a local model through Ollama costs nothing per question.
Can Khoj run fully offline?
Mostly. Embeddings can be generated on your machine and chat can use a local model through Ollama or llama.cpp, so your documents never leave it. For a fully offline setup, also set KHOJ_TELEMETRY_DISABLE=True and leave web search unconfigured, and note that the web client still attempts a location lookup at ipapi.co when it loads.
How does Khoj compare with Open WebUI?
Open WebUI is a chat front end first, with document upload as one feature. Khoj is built around indexing your notes continuously, with plugins that keep an Obsidian vault or Emacs files in sync, plus scheduled research automations. If you mainly want a shared chat interface for models, use Open WebUI. If you want an assistant that knows your notes, Khoj fits better.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.