Scira is an AI search engine in the style of Perplexity. Ask a question and it plans the research, runs several searches in parallel, reads the results and writes an answer with inline citations you can click. It has 17 modes, from plain web search to academic papers, Reddit, X, YouTube transcripts, GitHub, stocks and prediction markets, and an extreme mode for longer multi-step research.
It is worth knowing for two reasons. You can use it free at scira.ai, and the whole app is open source under AGPL-3.0, built on Next.js and the Vercel AI SDK, so you can host your own and pick the model, from OpenAI, Anthropic and Google to xAI, Mistral, Qwen and DeepSeek.
About 11,900 stars and 20 contributors, formerly called MiniPerplx. The honest limit is self-hosting: it is wired to many paid services (Exa, Firecrawl, Tavily, Daytona, Upstash and more), so a full copy needs a dozen API keys, and the repository has no tagged releases.
- Repository: github.com/zaidmukaddam/scira
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: TypeScript. Stars: 11.9K. Forks: 1,496. Last push: Aug 12, 2026.
- Scan: safe, Oct 26, 2026, commit e1692f5
Who it is for
People who want cited answers instead of a page of links, researchers who like seeing every source, and developers who want a working open-source answer engine to study or adapt.
Getting started
1. Get the code
git clone https://github.com/zaidmukaddam/scira.git && cd scira2. Create your settings file, then fill in your API keys
cp .env.example .env3. Start it with Docker Compose
docker compose upIt then runs at http://localhost:3000. Without Docker, copy .env.example to .env.local, then run bun install and bun dev. To just use it, scira.ai needs no setup.
Safety scan
We cloned zaidmukaddam/scira at commit e1692f5 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs in about 138,000 lines of TypeScript.
- The one pattern hit, a curl | bash install of Bun in lib/tools/build-tools.ts, runs inside the Daytona cloud sandbox the code interpreter uses, not on your machine.
- The many hosts in the code are the services its tools call: Google Maps, TMDB, OpenWeatherMap, CoinGecko, Exa and the model providers. Each one only works with your API key, and each receives the queries sent to it.
- No lockfile the scanner could read, so known advisories were not looked up. No GitHub workflows, so there is no CI to abuse and also no automated checks. Licence present; no security policy or contributing guide.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | No GitHub Actions workflows. |
| Network hosts | 40 distinct hosts referenced from source; most often www.google.com, scira.ai, x.com, storage.googleapis.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| lib/tools/build-tools.ts:892 | download-piped-to-shell | 'curl -fsSL https://bun.sh/install | bash && ln -sf "$HOME/.bun/bin/bun" /usr/local/bin/bun 2>/dev/null || true', |
By the numbers
| Stars | 11.9K |
|---|---|
| Forks | 1,496 |
| Contributors | 20 |
| Commits | 777 |
| Open issues | 17 |
| Open pull requests | 11 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | AGPL-3.0 |
| Main language | TypeScript |
| Project age | 2 years |
| Last push | Aug 12, 2026 |
| Tracked files | 451 |
| Lines of code | 138.2K |
| Checkout size | 29 MB |
Lines by language: TypeScript 123.7K, JSON 11.5K, CSS 1,621, SQL 589, Markdown 374, JavaScript 194.
Questions
Is Scira free?
The code is free and open source under AGPL-3.0, and scira.ai has a free tier with a paid Pro plan for features such as connectors, memory and voice. Self-hosting is free apart from the API costs of the services you connect.
Is Scira a Perplexity alternative?
Yes. It does the same core job, searching live sources and answering with citations, and it is open source, so you can see how answers are produced and run it yourself.
Which AI models does Scira support?
Many: OpenAI, Anthropic, Google Gemini, xAI Grok, Mistral, Qwen, DeepSeek, GLM, Kimi and others, through the Vercel AI SDK. You choose the model per question.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.