Maxun is a self-hostable web data platform. You build robots that extract data from websites, either by recording what you do in a built-in browser (click the list, the price, the next-page button) or by describing what you want in plain language and letting an LLM work it out. Robots can also scrape whole pages to Markdown, HTML or screenshots, crawl a site, run web searches, parse documents and watch pages for changes, on a schedule.
The results come out as tables, spreadsheets or an API, with integrations for Google Sheets and Airtable, a CLI, an SDK and an MCP server so AI agents can call your robots. For people who need recurring data from sites that have no API, it is one of the more complete open-source alternatives to paid scraping services.
It is a full stack to run: Postgres, MinIO object storage, a backend and a frontend, configured through a .env file. The team also runs a hosted version at app.maxun.dev, and the README's sponsors are proxy providers. Scraping is subject to each site's terms and local law, which is on you.
- Repository: github.com/getmaxun/maxun
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: TypeScript. Stars: 18K. Forks: 1,562. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 7f5fa98
Who it is for
Analysts, researchers and small businesses who need recurring data from websites without writing scrapers, and developers who want a self-hosted extraction API for their agents.
Getting started
1. In an empty folder, create .env from the project's ENVEXAMPLE file, then fetch the compose file
curl -O https://raw.githubusercontent.com/getmaxun/maxun/develop/docker-compose.yml2. Start Maxun, then open http://localhost:5173
docker-compose up -dSETUP.md in the repository lists every environment variable and a no-Docker install with Node.js, PostgreSQL, MinIO and Redis. Set MAXUN_TELEMETRY=false in .env if you do not want to send usage data.
Safety scan
We cloned getmaxun/maxun at commit 7f5fa98 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no install hooks and no binaries across 275 files, about 74,000 lines of them TypeScript. The only installer is server/start.sh, 10 lines that start the server.
- server/src/utils/analytics.ts sends anonymous events (OS, architecture, Node version, Maxun version and event names) to PostHog's US servers, but only when MAXUN_TELEMETRY is true. The ENVEXAMPLE file you copy sets it to true and asks you to keep it on; change it to false to opt out.
- The other hosts are the services it integrates with by design: OpenAI, DeepSeek, OpenRouter, Ollama and Baidu Qianfan for AI extraction, Google Sheets and Airtable for exports, and DuckDuckGo for search robots.
- No lockfiles were committed, so dependency advisories could not be checked from the repository. No GitHub workflows. Licence, security policy, contributing guide and code of conduct present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | No GitHub Actions workflows. |
| Network hosts | 30 distinct hosts referenced from source; most often docs.maxun.dev, api.openai.com, github.com, playwright.dev. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- server/start.sh, 10 lines
By the numbers
| Stars | 18K |
|---|---|
| Forks | 1,562 |
| Contributors | 60 |
| Commits | 7,767 |
| Open issues | 52 |
| Open pull requests | 31 |
| Releases | 50 |
| Latest release | v0.1.0 |
| Licence | AGPL-3.0 |
| Main language | TypeScript |
| Project age | 3 years |
| Last push | Oct 26, 2026 |
| Tracked files | 275 |
| Lines of code | 86.9K |
| Checkout size | 3 MB |
Lines by language: TypeScript 73.9K, JSON 6,469, JavaScript 5,318, Markdown 820, YAML 210, Shell 143.
Questions
Is Maxun free?
The self-hosted version is free and AGPL-3.0-licensed, which means that if you offer a modified Maxun to others over a network, you must share your changes. There is also a hosted version at app.maxun.dev for people who would rather not run the stack.
Do I need to know how to code to use Maxun?
No. Recorder mode lets you build a robot by clicking the data you want in a browser, and AI mode lets you describe it in a sentence. Code only comes in if you use the API, SDK or CLI.
Can it scrape sites that need a login?
The recorder works in a real browser, so robots can include the steps you take,. Whether you may scrape a site, logged in or not, depends on that site's terms and your local law.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.