RAG and workflows live in the same web application
MaxKB is a self-hosted builder for document-backed assistants and agents. Users can upload files or crawl online material, split and vectorize the text, connect public or private models, then expose the result through a chat interface. A visual workflow engine adds functions and MCP tools for jobs that need more than one retrieval-and-answer step. The README lists text, image, audio, and video input or output support.
The technical stack is Vue on the front, Python and Django on the back, LangChain around model work, and PostgreSQL with pgvector for stored data and embeddings. That makes MaxKB a product rather than a Python library. A team gets accounts, agent design, knowledge management, workflow editing, and a browser experience, but it also owns databases, storage, secrets, upgrades, and the quality of every connected model.
The one-container start publishes a default password
The README's quick start runs 1panel/maxkb on port 8080 and mounts persistent state under ~/.maxkb. It also publishes the initial username admin and password MaxKB@123... Change that credential before exposing the port beyond a temporary local test. Put trusted TLS and access controls in front of the service, then confirm that anonymous, ordinary, and administrative users see only their intended agents and knowledge.
A useful installation needs more than a running login screen. Model providers require credentials or private inference endpoints. Uploaded documents and generated artifacts need storage, retention, and backups. PostgreSQL and pgvector need monitoring and restore tests. Crawl targets may contain private or hostile text, so retrieval content and MCP tools should be treated as untrusted inputs rather than instructions the agent may follow.
What happened when we ran it
Our sandbox installed MaxKB at commit b10105d in 125 seconds. The environment added 224 Python packages and consumed 1,794 MB on disk. The build succeeded in 8 seconds. There was no test script or target, so we skipped tests; no passing count exists for this checkout. Pip-audit reported 7 known vulnerabilities in the installed dependency set.
The repository contained 2,191 files, about 239,402 source lines, and occupied 57.1 MB before dependencies. Our scan found 8 CI workflow files, no Dockerfile, and no tests directory. The absence of a Dockerfile describes the measured repository signal, while the README separately points users to a published container image. We did not download models, ingest documents, or measure retrieval quality.
The 1,794 MB result is the immediate planning number. Embedding models, local language models, uploaded files, PostgreSQL growth, and conversation records can raise it considerably, but our run did not measure those additions. Start with disk alerts and a backup location rather than assuming the container's first successful boot represents steady-state storage.
v2.10.5-lts fixed four serious access-control flaws
The latest GitHub release was v2.10.5-lts on August 6, 2026. Its notes list four security fixes: a missing ownership check on chat-sharing links, cross-workspace user information access, arbitrary file deletion using another user's API key, and exposure of user email addresses. These were fixed in that release, so they are not reasons to claim v2.10.5-lts remains vulnerable to the same paths.
They are reasons to test authorization after every upgrade. Build a small matrix for owner, other workspace member, ordinary user, shared-link visitor, and invalid API key. Cover file deletion, document preview, chat sharing, user lookup, and exported content. Older installations should not remain on a pre-fix build merely because they are private; an internal user or leaked key can still cross a broken authorization boundary.
Our dependency audit's 7 findings are separate from those release-note flaws. The measurement block does not provide package names or severities, so the review cannot claim which component is affected. Export the exact environment, run an audit with full advisory details, and decide whether each finding is reachable in your deployment before accepting or remediating it.
Import success does not always mean usable knowledge
Open issue 6756 reports that MaxKB 2.10.15 can show a large CSV as imported even when one field exceeds 131,072 bytes and the backend parser rejects it. The document then shows 0 characters and 0 segments. A knowledge pipeline should reject that state rather than letting an empty source look healthy. Test representative CSVs, PDFs, office files, images, and crawled pages before migrating a corpus.
Issue 6758 says images were not updated during a knowledge-document migration in v2.10.5-lts, causing image display failures for an authenticated agent. Issue 6740 reports that a hyphenated identifier such as sensor-temperature-TH01 returned no full-text result even with a zero similarity threshold. These are narrow user reports, but both affect the promise that stored knowledge can be found and displayed.
Create retrieval tests from your actual identifiers, tables, long cells, and embedded media. Record expected source passages, not only whether the model produced an answer. A fluent response can hide an empty import, missed exact term, or broken image reference. For customer support or internal policy, that difference matters more than how quickly the workflow was drawn.
Activity is high, while the test surface remains unclear
GitHub recorded 22,612 stars, 28 combined issues and pull requests, and a last push on August 26, 2026. The issue list and dependency pull requests were active the same week. The main README is English with a Simplified Chinese counterpart, while several current reports are written in Chinese. That is a large, active user and contributor signal rather than evidence that every path is stable.
MaxKB is worth evaluating if visual RAG, workflows, and MCP tools can replace months of internal UI and orchestration work. The 8-second build is encouraging, but the 1,794 MB dependency footprint, 7 audit findings, and missing test target keep the recommendation conditional. Pin v2.10.5-lts or newer, change the default login, import a hostile and representative test corpus, and prove authorization plus restore behavior before wider use.