Open-source, on-prem knowledge index for law firms. LegalMemory builds a continuously synced shadow index over the firm's document estate — without changing a single source file — and exposes it to AI tools through an MCP server, with the firm's permissions enforced on every query.

Documents are not just embedded and retrieved by similarity. An insertion pipeline first converts every document to structured data, assigns it to a matter, links related documents (draft→final chains, annexes, referenced contracts), extracts typed metadata from final versions, and captures anonymized decision rationale from correspondence and redlines. Retrieval runs inside a permission-compiled candidate set — identity → project grants → mirrored source ACLs → search scope, deny wins, unknown fails closed.

Try it: legalmemory.eigenweltlabs.com — a document browser and a chat over a live index. Ask a question, and the document the answer came from opens beside it. The same application is in demo/ and runs against your own index with five containers.

Documentation: the docs/ folder is a Starlight site — run npm install && npm run dev inside docs/, or read the pages directly under docs/src/content/docs/. Deployments set KI_DOCS_URL so the admin UI links to the hosted docs.

• Source connectors — SharePoint Online, OneDrive, Google Drive, Clio and local folders, plus a plugin contract for customer DMS exports. All read-only, bring-your-own-client OAuth, permissions mirrored (including group expansion for ethical walls).
• Durable sync with tombstones, checkpoints, ACL snapshots, deletion confirmation across scans, and provider change events (Azure Event Hubs, Google Pub/Sub) with scheduled reconciliation.
• Seven-stage resumable pipeline: conversion with German OCR and a raw-OOXML tracked-changes overlay, agentic matter classification, agentic version chains and typed relations, metadata extraction against a pluggable ontology, anonymized decision records, and hybrid indexing. Failing stages retry with backoff and quarantine; nothing degrades silently.
• Permission compiler applied before any ranking — project and document grants intersected with mirrored source ACLs, deny wins, verified under concurrent load.
• Retrieval built for legal work: four RRF-fused legs (lexical, dense, exact identifiers, decision records), version-status decay instead of age decay, and collapse to the one binding version of each document.
• Identity-bound MCP tools (search, matters, traversal, decisions, billing, entity resolution) behind OAuth 2.1 with audience binding, an append-only access ledger, and an admin console covering connectors, pipeline, ontology, data, access, identity, models, costs, external clients, activity and backup.
• Structured legal knowledge kept distinct from document metadata: LEDES/UTBMS billing (invoices, line items, timekeepers) and typed entity identifiers, with MCP tools to query them.
• Full-appliance backup — every store, encrypted, read back and re-verified before a run reports success, GFS retention, and a staged restore that refuses to run under the wrong credential key.
• Retrieval benchmark with frozen gold labels and a naive-dense baseline gate, so retrieval changes are regression-tested.

Each retrieval decision here is a choice among published alternatives. The short version with sources; the full evidence base, including where the literature disagrees, is in Design evidence.

Filters and permissions are applied before ranking, never after. Filtering a global nearest-neighbour set afterwards degrades as the filter gets selective — the effect a per-matter or per-client scope always produces:

• Gollapudi et al., Filtered-DiskANN, WWW 2023 — post-hoc filtering baselines "fail to achieve any meaningful accuracy, and have almost a 1000x lower QPS for the low specificity labels".
• Patel et al., ACORN, SIGMOD 2024 — pre-filtering "always achieves perfect recall"; post-filtering degrades toward a full scan when the predicate is clustered.
• Li et al., Attribute Filtering in ANN Search, SIGMOD 2026 — across 10 algorithms, applying the predicate before distance computation "consistently handles 0.1% selectivity across all datasets".
• Chronis et al., Filtered Vector Search, VLDB 2025 — "A vector search execution method tuned for unfiltered queries will fail to achieve high recall when filters are added."

Authorization is part of the query, not a post-filter. Büttcher & Clarke, A Security Model for Full-Text File System Search, USENIX FAST '05, shows that ranking over the whole corpus and removing forbidden files afterwards lets a user infer the content of files they cannot read. Retrieval scope is also a confidentiality boundary: embeddings leak their inputs (Song & Raghunathan, CCS 2020 — inversion recovers 50–70% of input words) and RAG datastores are extractable through the generation interface (Zeng et al., Findings of ACL 2024).

Retrieval is hybrid and fused, not dense-only. In BEIR (NeurIPS 2021) every dense retriever tested scored below BM25 averaged over 18 out-of-domain datasets, while BM25 plus a reranker led at +11% nDCG@10 — and a firm's own corpus is by definition out of domain. Legs are combined with reciprocal rank fusion (Cormack, Clarke & Büttcher, SIGIR 2009); an exact-identifier leg exists because fixed-length dense vectors have bounded capacity for exact terms (Luan et al., TACL 2021). Reranking follows the multi-stage cascade (Wang, Lin & Metzler, SIGIR 2011; Sun et al., EMNLP 2023) and is off by default, for latency rather than doubt.

Types come from a controlled vocabulary, and the ontology is pluggable. Free-text labelling fails because people do not choose the same word: two people pick the same term for the same object with probability below 0.20 (Furnas et al., CACM 1987), and controlled vocabularies recover results that keyword search alone misses (Gross & Taylor, C&RL 2005). The shipped taxonomy aligns with SALI LMSS and carries stable IRIs, but the ontology is data, not code — any OWL/SKOS-shaped taxonomy can replace it, and it maps cleanly to LKIF-Core, LegalRuleML, ELI and CUAD.

Answers carry citations, and retrieval changes are gated by a benchmark. Public models asked verifiable questions about federal cases hallucinate 58–88% of the time (Dahl et al., Journal of Legal Analysis 2024), and a preregistered study of retrieval-augmented legal research systems measures 17–33% (Magesh et al., Journal of Empirical Legal Studies 2025) — retrieval augmentation reduces the problem without removing it. Hence provenance to a specific document version on every result, and a frozen-gold benchmark gate rather than asserted accuracy (cf. LegalBench-RAG, which scores the retrieval step directly).

cp .env.example .env    # fill in the required values — see the docs Quick start
python3 -m venv .venv && .venv/bin/pip install -e '.[dev]'
docker compose up -d --build
bash scripts/bootstrap-hatchet.sh
docker compose exec app ki add-source /path/to/documents --name "First estate"
docker compose exec app ki sync

Open http://127.0.0.1:8000 (admin console) and http://127.0.0.1:8888 (pipeline runs). The docs' Quick start page covers the required environment and the first-run configuration in detail; cloud sources connect from the console after registering a provider app (see the docs' connector guides).

LegalMemory is assembled from other people's work. Named here in full, with licences, because several of these are load-bearing rather than incidental.

Code that ships inside this repository

The data model

Services we run alongside — PostgreSQL + pgvector (system of record), OpenSearch (Apache-2.0; chosen over Elasticsearch on licence), Docling Serve (MIT; conversion and German OCR), LiteLLM (MIT core; model gateway), Hatchet (MIT; orchestration), Keycloak and oauth2-proxy (identity), FastMCP (Apache-2.0; the MCP server).

Design we borrowed without taking code — Onyx (MIT outside ee/): our SyncSource contract adopts its permissive connector model — full crawl, incremental batches, cheap identity observations, opaque cursors, per-item failures. Its enterprise permission-sync code is out of bounds and was not read.

Evaluation corpora — CUAD, MAUD and ContractNLI (CC BY 4.0, attributed per fixture); the EDRM Enron slice; Open Legal Data dumps (ODbL) and German official works under §5 UrhG; LEXam and BenGER for German regression sets.

See CONTRIBUTING.md. Security reports: see SECURITY.md.

Licensed under the GNU Affero General Public License v3.0. Private and internal use are unrestricted; the copyleft obligations attach when you distribute a copy or offer a modified version to users over a network. Code in this repository derived from MIT-licensed projects keeps its own notices — see NOTICE. Upstream components we studied but do not ship remain separate works under the licences and pinned revisions recorded in external/README.md.

A commercial licence is available for organisations that cannot take on the AGPL's terms. Contact Eigenwelt Labs.