LightRAG: Fast Knowledge-Graph RAG for Your Documents (GitHub, Scanned)

LightRAG answers questions about your documents by building a knowledge graph from them. As it indexes a file, a language model pulls out the entities and the relationships between them, and LightRAG stores those alongside ordinary vector embeddings of the text. At question time it can search the precise local facts around an entity, the broad themes across documents, plain text chunks, or all three at once, which handles questions like how two people or projects are connected far better than chunk search alone.

It began as a research paper from the University of Hong Kong as a lighter, cheaper alternative to Microsoft's GraphRAG, and has grown into a full server: a web UI for uploading files and exploring the graph, a REST API, an Ollama-compatible chat endpoint so tools like Open WebUI can talk to it, document parsing with MinerU or Docling, multimodal handling of images and tables, and storage backends from local files up to PostgreSQL, Neo4j and Milvus. It works with OpenAI, Gemini, Bedrock, Ollama and other providers.

It is MIT-licensed, with about 40,200 stars and 353 contributors, at v1.5.7 when scanned, and installs from PyPI as lightrag-hku.

• Repository: github.com/HKUDS/LightRAG
• Licence: MIT (MIT License)
• Language: Python. Stars: 40.2K. Forks: 5,706. Last push: Oct 15, 2026.
• Scan: safe, Oct 19, 2026, commit aaebfe1

Who it is for

Developers building a question-answering system over company documents, research papers or notes, and anyone who has found plain vector RAG missing connections that span several documents.

Getting started

1. Install the server (with uv, or pip install "lightrag-hku[api]")

uv tool install "lightrag-hku[api]"

2. Get the example settings and add your LLM and embedding keys

curl -o .env https://raw.githubusercontent.com/HKUDS/LightRAG/main/env.example

3. Start the server and web UI

lightrag-server

4. Open the web UI

open http://localhost:9621

Before starting, set HOST=127.0.0.1 in .env unless you have also set LIGHTRAG_API_KEY or AUTH_ACCOUNTS: the example file binds to every interface. Indexing uses an LLM call for every chunk, so a large document set costs real money on a paid API or takes time on a local model.

Safety scan

We cloned HKUDS/LightRAG at commit aaebfe1 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no committed binaries across 1,331 files and about 489,000 lines. The 3 pattern hits are the Dockerfile installing Rust with rustup's official installer and two Makefile lines printing the uv and Bun install commands. The one bare-IP URL is an Ollama server in an unofficial community example.
• The server binds to 0.0.0.0 by default, and with neither LIGHTRAG_API_KEY nor AUTH_ACCOUNTS set every endpoint is open, including uploads and deletes; the README and the example settings say so in capitals. It does refuse to start with logins configured but the default token secret.
• 147 known advisories (6 critical, 63 high) in uv.lock, which the Docker image installs exactly. Most are in libraries LightRAG uses narrowly: the NLTK criticals concern loading untrusted pickle files, the PyJWT and python-jose ones affect apps verifying tokens with public keys while LightRAG signs with a shared secret, and the AnyIO one concerns IDNA host names. Installing from PyPI pulls newer versions within its ranges, which avoids most of them.
• The installer scripts are Kubernetes deployment helpers and an interactive setup.sh that writes a .env file; none uses sudo or edits shell profiles.
• 11 workflows, none using pull_request_target; only 3 of 21 third-party actions are pinned to commits. Licence, security policy, contributing guide and Dependabot present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 406.1K, TypeScript 37.6K, Markdown 25.8K, Shell 8,631, JSON 7,355, YAML 2,672.

Questions

Is LightRAG free?

Yes. LightRAG is MIT-licensed and free to self-host. You pay for the language model and embedding calls it makes, unless you run models locally with Ollama or a similar server.

How is LightRAG different from GraphRAG?

Both build a knowledge graph from documents. LightRAG skips GraphRAG's community reports and multi-step reasoning, so it needs far fewer LLM calls to index and answer, and it can add or delete documents without rebuilding everything. GraphRAG can do better on very broad summary questions across a whole corpus.

Can I use LightRAG with a local model?

Yes. It supports Ollama and other OpenAI-compatible servers for both the LLM and the embeddings. Entity extraction is demanding, so the README suggests a capable model with a long context window; very small models produce a thinner graph.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.