What it is
LightRAG uses a language model to extract entities and relationships from documents into a knowledge graph, stores them alongside vector embeddings, and retrieves at two levels: specific entities (local) and broader themes along relationship chains (global). Unlike Microsoft GraphRAG it skips community reports, which cuts LLM calls.
It has five query modes, with mix (graph plus plain vector search) as the default. New documents can be added without a rebuild, and deletions trigger a targeted repair of the graph. Storage is pluggable; the defaults are file-based and not for production, and the project recommends PostgreSQL, which can hold all four of its stores. It ships a REST server with an admin web UI, and since May 2026 includes RAG-Anything for multimodal documents.
The method was published at EMNLP 2025.
Our review
LightRAG is the graph RAG framework to try first, because it updates incrementally, runs on plain Postgres and is far simpler than Microsoft GraphRAG. It has about 40,300 GitHub stars, and v1.5.7 shipped on 2 September 2026 with commits continuing into October.
The savings are smaller than the paper suggests. Indexing still runs an LLM entity-extraction pass over every chunk, as GraphRAG does; the gain is in skipping community reports and in cheap incremental updates. Query cost is the bigger surprise. The paper's claim of fewer than 100 tokens per query counts only the retrieval call; the GraphRAG-Bench study (Xiang et al.) measured an average of 100,832 prompt tokens per question reaching the answering model against 879 for vector RAG, and Zhou et al. timed 19.28 seconds per MultihopQA question against 2.35 seconds for vanilla RAG, with Llama-3-8B.
Security needs work before deployment. The server binds to 0.0.0.0 with every endpoint public unless you set LIGHTRAG_API_KEY or AUTH_ACCOUNTS, and the Ollama-compatible /api routes stay open even then unless you change WHITELIST_PATHS. GitHub lists 23 advisories for the project in 2026, three rated critical: a wildcard CORS policy with credentials, no rate limiting on /login, and an authentication bypass triggered by certain API prefixes. Most of the rest are denial-of-service bugs in document parsing, now patched.
Graphs earn their keep when an evaluation set shows multi-hop or whole-corpus questions that hybrid search fails and someone owns the entity model. If few real questions need that, a graph is a cost centre. Where one is justified, LightRAG on a single Postgres is a cheaper thing to operate than GraphRAG's batch rebuilds.
Where it earns its place
A knowledge-management lead at a 300-lawyer firm
Answer questions that link clauses, parties and matters across thousands of contracts
Index with a cheap non-thinking extraction model and query in mix mode on Postgres. Run the same question set against hybrid vector search first; with more than 100 times the prompt tokens per question in GraphRAG-Bench, answer-model input costs scale accordingly.
A platform engineer self-hosting RAG for an internal wiki on one GPU server
Keep a knowledge graph current as pages change daily
Run lightrag-server with Docker Compose, Qwen3-30B-A3B-Instruct for extraction and Postgres for all four stores; new pages insert without a rebuild. Bind to 127.0.0.1 or set LIGHTRAG_API_KEY before anyone else can reach it.
A research engineer comparing graph RAG frameworks
Reproduce published results before committing to one
The repo includes a Reproduce guide and RAGAS evaluation. Expect results near GraphRAG on the paper's own sets; the decision usually turns on update cost and Postgres support rather than accuracy.
Before you commit
- Setup
- uv tool install "lightrag-hku[api]", copy env.example to .env with LLM and embedding settings, run lightrag-server; or docker compose up. A setup wizard (make env-server) writes the .env.
- Integrations
- OpenAI-compatible, Ollama and other LLM providers per role (extract, query, keywords, VLM); PostgreSQL, MongoDB, OpenSearch, Neo4j, Memgraph, Milvus and Qdrant storage; MinerU or Docling parsing; RAGAS evaluation and Langfuse tracing; an Ollama-compatible chat API.
- Data and privacy
- Documents go to whichever LLM and embedding providers you configure. The server binds to 0.0.0.0 with no auth by default. 23 GitHub advisories in 2026, three critical (CORS, /login brute force, auth bypass).
- Cost at scale
- MIT, no paid edition. Indexing pays for LLM extraction over the whole corpus, and answering sends about 100,000 prompt tokens per question in GraphRAG-Bench against under 1,000 for vector RAG; a local Qwen3-30B-A3B extraction model swaps API spend for GPU time.
- Limits
- 402 open issues and pull requests; default file stores are not for production; slow models (under about 50 tokens a second) hit extraction timeouts; switching embedding models needs lightrag-rebuild-vdb.
What's good
- Incremental inserts and deletes without a rebuild
- Runs on a single Postgres for production
- Cheaper to maintain than Microsoft GraphRAG
- Built-in server, web UI and multimodal parsing
What's not
- Answer-time context is more than 100 times vector RAG's
- Server binds to all interfaces with no auth by default
- 23 security advisories in 2026, three critical
- Changing the embedding model means rebuilding vectors
Best for
Teams whose evaluations show multi-hop questions failing with hybrid search and who want a graph on Postgres.
Alternatives
LightRAG: common questions
- Is LightRAG worth it?
- The sensible way to try graph RAG, cheaper to maintain than Microsoft GraphRAG, but most teams should prove they need a graph before adding one. We rate it 3.9 out of 5.
- How much does LightRAG cost?
- Free and open source under the MIT license. Indexing and queries use your own LLM and embedding credits.
- What are the downsides of LightRAG?
- Answer-time context is more than 100 times vector RAG's; server binds to all interfaces with no auth by default; 23 security advisories in 2026, three critical; changing the embedding model means rebuilding vectors.
- Who is LightRAG best for?
- Teams whose evaluations show multi-hop questions failing with hybrid search and who want a graph on Postgres.
- How much does LightRAG cost for a team or in production?
- MIT, no paid edition. Indexing pays for LLM extraction over the whole corpus, and answering sends about 100,000 prompt tokens per question in GraphRAG-Bench against under 1,000 for vector RAG; a local Qwen3-30B-A3B extraction model swaps API spend for GPU time.
- Is LightRAG safe for company data?
- Documents go to whichever LLM and embedding providers you configure. The server binds to 0.0.0.0 with no auth by default. 23 GitHub advisories in 2026, three critical (CORS, /login brute force, auth bypass).
- What are the best LightRAG alternatives?
- The closest alternatives we have reviewed are GraphRAG, Graphiti, Cognee, RAGFlow and LlamaIndex.
Answers checked Oct 23, 2026.