SurfSense: Private, Offline NotebookLM Alternative (GitHub, Scanned)

SurfSense is a desktop app in the spirit of Google's NotebookLM that keeps your documents on your machine. Drop in files or folders and an AI agent answers questions with citations, and it goes further than NotebookLM by working on the files themselves: redlining a Word contract with tracked changes, filling PDF forms, building spreadsheets with formulas and charts, and producing slides, web pages, mind maps, flashcards and podcasts. Edits always produce a new file, so the original is never changed.

You choose the model: a local one (it can download GGUF models from Hugging Face and run them itself) or any OpenAI-compatible API. Network access is off by default and granted per destination, so nothing leaves the machine until you allow a specific host. Recordings are transcribed locally and scanned pages go through OCR.

The app is Apache-2.0, with about 16,600 stars, at v2.2.4. The hosted web version shut down on 18 October 2026, so it is now a desktop app for Windows, macOS on Apple Silicon and Linux. A set of first-party plugins for reading Google, YouTube, TikTok, Amazon and other sites sits under a separate source-available licence and needs a SurfSense licence, with a free 30-day trial.

• Repository: github.com/MODSetter/SurfSense
• Licence: Apache-2.0 (Apache License 2.0)
• Language: Python. Stars: 16.6K. Forks: 1,596. Last push: Oct 25, 2026.
• Scan: safe, Oct 26, 2026, commit c2231c5

Who it is for

People who work with documents they cannot upload to a cloud service, such as contracts, client files or research notes, and anyone who wants NotebookLM-style answers from a local model.

Getting started

1. macOS or Linux: install the desktop app from its GitHub release

curl -fsSL https://www.surfsense.com/install.sh | sh

2. Windows (PowerShell)

irm https://www.surfsense.com/install.ps1 | iex

Both scripts download from the project's GitHub release and check every file against its SHA256SUMS; the Windows one also checks the installer's signature. On Linux they use sudo to add an apt repository or install the rpm, or fall back to an AppImage in your home folder. Ordinary installers are on surfsense.com/downloads.

Safety scan

We cloned MODSetter/SurfSense at commit c2231c5 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The one secret hit is YouTube's public InnerTube web key in backend/plugins/proprietary/youtube/innertube.py, the key YouTube's own site sends to every visitor; the code labels it as such. The 4 bare-IP URLs are tests of a guard that blocks private addresses.
• Network access goes through one consent check (docs/architecture/egress.md): every outside host is off until you allow it. Per the project's telemetry contract, usage statistics are opt-in and unticked, and update checks carry the app version and platform but no identifier.
• The four pattern hits are the curl | sh installer and comments about it. surfsense_local/packaging/install/install.sh verifies downloads against SHA256SUMS and uses sudo only to add the apt repository or install the deb or rpm.
• backend/plugins/proprietary holds the licensed plugins (Google Search and Maps, YouTube, TikTok, Instagram, Amazon, Walmart, Indeed, Reddit, web crawl) under the Business Source License, with a licence check through Keygen. The scraping code is built to use proxies and captcha-solving services (CapSolver or 2Captcha), which may conflict with those sites' terms.
• 144 advisories, 12 critical. Most are in the desktop backend's surfsense_local/backend/uv.lock (74, 6 critical, mainly Pillow image-decoding bugs and certifi), which ships with the app; the rest are in the Electron shell, the front end and the website. 13 workflows, none using pull_request_target; 2 of 27 third-party actions pinned; security policy and code of conduct present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 279.3K, JSON 179.8K, TypeScript 126.2K, Markdown 52.7K, HTML 11.7K, JavaScript 6,566.

Questions

Is SurfSense free?

The app is free and open source under Apache-2.0, and works fully with your own local or remote model. The first-party web plugins (Google Search, YouTube, Amazon and others) need a SurfSense licence after a free 30-day trial; third-party MCP plugins need none.

Does SurfSense work offline?

Yes. With a local model it runs air-gapped, and the index stays on your disk. Anything that needs the network, such as downloading a model from Hugging Face, a remote model API or a plugin, asks for your permission for that specific host first.

What happened to the SurfSense web app?

The hosted web app shut down on 18 October 2026. The project asked users to export their workspaces before then and import them into the desktop app, which is where development continues.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.