What it is
RAGFlow is a complete RAG application you run yourself. It parses documents with its own layout and table recognition (DeepDoc), builds knowledge bases, and lets you chat over them or build agents in a web interface.
Version 1.0 rewrites the backend in Go for lower resource use. Release candidates shipped on 29 September and 16 October 2026; a final 1.0 was not out at the time of checking. The 0.x line still ships: v0.27.3 arrived on 23 October 2026 with a long list of authorisation and SSRF fixes. Upgrading to 1.0 runs a data migration that cannot be rolled back.
Recent features include Knowledge Compilation, which turns documents into wikis, graphs, timelines and similar structures, and an Agentic chat mode that in rc2 replaced the earlier Low to Ultra thinking levels.
Our review
RAGFlow is the self-hosted RAG product with the widest following, at about 92,700 GitHub stars, and the question for adopters in late 2026 is exposure rather than capability. GitHub lists eight security advisories for the project, five rated critical: two server-side template injection flaws leading to remote code execution in April and May 2026, a zip-slip code execution bug in the MinerU parser in January, a predictable-token authentication bypass and an SQL injection. In October a high-severity advisory showed the OpenAI-compatible agent endpoint could bypass private-canvas authorisation.
The reason people accept that is the product. DeepDoc keeps tables and page layout that plain text extraction flattens, chunks can be inspected and corrected in the UI, and the agent builder sits in the same app, so a team can stand up a knowledge assistant without writing a pipeline. The README's starting point is modest: 4 CPU cores, 16 GB of RAM and 50 GB of disk, with Docker 24 or later.
The Go rewrite is ambitious and not finished. According to the rc1 notes it swaps Redis for NATS, uses Kvrocks for cache and checkpoints, drops deprecated API aliases and the local sandbox, and runs DeepDoc on CPU only. The upgrade requires being on 0.27.2 first and is irreversible. rc2 kept compatibility with rc1 data and added arm64 images, and v0.27.3 a week later shows the 0.x line is still being fixed, although the project publishes no support policy for it.
Against code frameworks such as LlamaIndex or Haystack, RAGFlow trades flexibility for a finished interface. Non-engineers can upload files and check chunks, but changing retrieval logic beyond the UI's settings means working in a fast-moving codebase with more than 1,300 open issues and pull requests.
Where it earns its place
An IT lead at a 150-person engineering consultancy
Give staff a searchable assistant over project reports, specs and spreadsheets
Run the Docker Compose stack on one internal server (4 cores, 16 GB RAM, 50 GB disk is the README's starting point), connect a hosted or local LLM, and let teams upload documents. Licence cost is nil; keep it on the internal network given the project's code-execution advisories.
A platform engineer with a production RAGFlow 0.27 deployment
Move to the Go backend without losing knowledge bases
Upgrade to v0.27.2 first, back up everything, then start 1.0; the migration runs at startup and cannot be rolled back. Scripts that call deprecated HTTP API aliases will break, though the Python SDK is unaffected.
A compliance team at a mid-size insurer with scanned policy PDFs
Answer questions over documents where the tables carry the meaning
DeepDoc's layout and table recognition keeps table structure, and chunks can be checked and edited in the UI before anyone relies on the answers. Parsing runs on CPU in the 1.0 candidates, so plan ingestion of a large back catalogue accordingly.
Before you commit
- Setup
- Clone the repo, check out a release tag and run docker compose up -d with Docker 24.0.0+ and Compose v2.26.1+; raise vm.max_map_count to 262144 if you use Elasticsearch. The Docker image does not support macOS. Then add LLM, embedding and reranker providers in the web UI on port 80.
- Integrations
- Python SDK and HTTP API, an OpenAI-compatible agent completion endpoint, MCP tools inside agents, many hosted model providers, and data sources including sitemaps, BigQuery, Feishu, MySQL, PostgreSQL and Zotero.
- Data and privacy
- Documents, chunks and chats stay in your own MySQL, MinIO and Elasticsearch or Infinity containers; text goes to whichever model providers you configure. The README does not mention telemetry. Eight GitHub advisories, five critical, have been published, and v0.27.3 added further tenant-scoping and SSRF fixes.
- Cost at scale
- No paid edition is listed in the repo, so the cost is the server plus model calls. A 4-core, 16 GB VM is the documented floor; local models or GPU embeddings add to it.
- Limits
- More than 1,300 open issues and pull requests. 1.0 removes the local sandbox and deprecated API aliases and runs DeepDoc on CPU only; until 1.0 is final, production deployments sit on 0.27.x.
What's good
- Layout- and table-aware parsing with chunk inspection in the UI
- Agent builder and Knowledge Compilation in the same app
- Apache 2.0, fully self-hosted
- Very active: 0.x and 1.0 releases in the same month
What's not
- Five critical advisories since 2025, including remote code execution
- 1.0 still in release candidates; the migration is one-way
- Docker image needs 16 GB RAM and does not support macOS
- Less flexible than code-first frameworks
Best for
Teams that want a self-hosted document Q&A and knowledge assistant without building a pipeline.
Alternatives
RAGFlow: common questions
- Is RAGFlow worth it?
- A finished document-to-answer product you can run on one server, whose security record says it belongs behind a VPN rather than on the open internet. We rate it 4.0 out of 5.
- How much does RAGFlow cost?
- Free and open source under the Apache 2.0 licence. You pay for the server and the model calls.
- What are the downsides of RAGFlow?
- Five critical advisories since 2025, including remote code execution; 1.0 still in release candidates; the migration is one-way; docker image needs 16 GB RAM and does not support macOS; less flexible than code-first frameworks.
- Who is RAGFlow best for?
- Teams that want a self-hosted document Q&A and knowledge assistant without building a pipeline.
- How much does RAGFlow cost for a team or in production?
- No paid edition is listed in the repo, so the cost is the server plus model calls. A 4-core, 16 GB VM is the documented floor; local models or GPU embeddings add to it.
- Is RAGFlow safe for company data?
- Documents, chunks and chats stay in your own MySQL, MinIO and Elasticsearch or Infinity containers; text goes to whichever model providers you configure. The README does not mention telemetry. Eight GitHub advisories, five critical, have been published, and v0.27.3 added further tenant-scoping and SSRF fixes.
- What are the best RAGFlow alternatives?
- The closest alternatives we have reviewed are LlamaIndex, Haystack and GraphRAG.
Answers checked Oct 23, 2026.
Make RAGFlow? Show this rating on your site
