Code search is still the strongest pitch
Sourcebot gives a team one place to search code across GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit, Gitea, generic Git hosts, and local repositories. Underneath the interface is Zoekt, a trigram index built for fast regular-expression search. The web UI adds filters, Boolean queries, file browsing, and symbol navigation.
That package solves a mundane but expensive problem. Engineers often know a function, configuration key, or error string exists but not which repository owns it. Sourcebot clones configured repositories, refreshes them in background jobs, and presents one query language across hosts.
Ask Sourcebot builds on that useful base rather than replacing it. A reasoning model receives search, navigation, and file-reading tools, then returns an answer with inline code citations. You choose and fund the provider, with hosted and OpenAI-compatible options available. Quality still depends on the model and indexed evidence, but citations make answers easier to check than generic code chat.
The first deployment is refreshingly small
For a trial, Sourcebot has the right shape. npx setup-sourcebot can generate configuration and Docker Compose files, or an operator can download the compose file, write a short JSON configuration, add secrets, and run one command. The application appears on port 3000. A search-only pilot does not require an LLM provider.
The single container includes the Next.js server, indexing workers, Zoekt, Postgres, Redis with BullMQ, and a persistent cache. That convenience explains the four-gigabyte minimum and need to preserve volumes. Sourcebot recommends external managed Postgres and Redis for more stable deployments, and teams need backups for business data and indexes.
Storage planning matters. The sizing guide suggests disk equal to two or three times the source being indexed. Enabling many branches can triple index storage in the project's testing. Memory directly affects search because the operating-system page cache keeps hot index data available. Recommendations grow from 4 GB of RAM for up to 100 repositories to 64 GB or more beyond 2,000.
Access control changes the price calculation
Self-hosted does not mean every feature is included without a subscription. On the free plan, all signed-in users become Owners and role management is unavailable. Repository permission syncing, which limits search, browsing, Ask, and MCP results to repositories a user can access on the original host, is paid. That boundary matters when teams share one instance but not one source-code permission set.
The Sourcebot MCP server is also marked as paid. It exposes search, file reading, definitions, and references over streamable HTTP to Claude Code, Codex, Cursor, VS Code, and other clients. API-key authorization is available, while OAuth is paid too. This can be a strong company-wide context layer, but it belongs in the subscription comparison.
Telemetry is enabled by default. The project says it sends sanitized usage and performance metadata through PostHog, not code, queries, credentials, or IP addresses. A single environment variable disables it.
The license is source-available, with a timer
Most code uses Functional Source License 1.1 with an Apache 2.0 future license. Internal use, education, research, modification, and redistribution are permitted, but using it to provide a competing commercial product or service is prohibited. Each version becomes available under Apache 2.0 on the second anniversary of its publication.
Enterprise directories use a separate commercial license, and third-party components retain their own terms. This is workable for internal deployment, but it is not equivalent to an immediately permissive open-source project. Vendors and anyone redistributing modifications should review the exact files and version dates.
Search correctness and scale need testing
Open issue #504 is the most important functional caveat. Zoekt has limits on matches and wall time, but Sourcebot does not currently tell the user when those limits stop a query. A search that looks exhaustive may be incomplete. That is dangerous for questions such as whether a pattern exists anywhere or how many instances remain. Audits need another method or an explicit check of limits.
Index health can also be too quiet. Issue #1361 describes ctags failure producing no symbols while the interface reports successful indexing. Issue #1025 reports deleted or renamed branches remaining searchable after a successful sync. Both concern older v4 builds, so reproduce them against v5.1.6, but acceptance tests should still cover symbol failure, branch deletion, and missing shards.
Horizontal scale remains a work in progress. The official sizing guide describes vertical scaling, while an open RFC notes that heavy indexing has made the web application unresponsive or caused out-of-memory errors. A large buyer should test indexing and search together at realistic load.
Health and the decision
The latest release, v5.1.6, shipped on August 10, 2026, and the repository was pushed again on August 11. It included query fixes, private-repository review support, MCP compatibility work, a Zoekt update, and many dependency security upgrades. The 101 open issues and pull requests combined sit beside fast-moving merged work and new contributors, signaling an active product.
Sourcebot deserves a trial when multi-repository search is the actual pain. Its basic experience is focused, its documentation is excellent, and AI features rest on a credible search engine. Access control, MCP, licensing, exhaustive-query behavior, and large-scale operation may change the economics. Test those boundaries with your own code before declaring it the company search layer.