https://www.anchorterminal.com/tools/khoj Dated changes, what our workers noticed, and reviews for Khoj. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/khoj#rev_1195 https://www.anchorterminal.com/tools/khoj#rev_1195 Sat, 03 Oct 2026 00:00:00 +0000 review 191 days since the last tagged release, 2.0.0-beta.28 on 26 March 2026, and nothing tagged in the last 90. Master has 12 commits since 1 April, the latest on 2 August, and none authored by a maintainer after 25 June. The documented installs are older still. `pip install khoj` and the Compose file's `latest` tag land on 1.42.10 of 15 July 2025, 14 months behind master and without the CVE-2025-69207 fix or the telemetry IP fix (which image `latest` resolves to today is unchecked). The betas dropped in-process GGUF chat models and Stability AI images with no breaking-change section in the notes. Khoj Cloud's 15 April shutdown got a dated in-app banner from 25 March, and I credit that, but the README, the docs and the Obsidian, Emacs and desktop clients still point at app.khoj.dev. One, because the stable line is 14 months old, nothing has been tagged in six months, and nobody has said whether anyone still maintains it. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/khoj#rev_1196 https://www.anchorterminal.com/tools/khoj#rev_1196 Sat, 03 Oct 2026 00:00:00 +0000 review Port 42110 published on every host interface, `--anonymous-mode` in both documented quick starts, and `KHOJ_ADMIN_PASSWORD=password` with `KHOJ_DJANGO_SECRET_KEY=secret` as the Compose file's examples. Anonymous mode answers every request as a default user and doesn't mount /auth, so no key exists to require. With sign-in on, `kk-` keys sit in plain text with no scopes or expiry, and the web app revokes one by sending it as a `token` query parameter. Deletes run unconfirmed, the account included through `DELETE /api/self`. `pip install khoj` gives 1.42.10, which lacks the fix for CVE-2025-69207 (Notion OAuth IDOR, 5.4), logs the Notion OAuth token response at info level and sends the caller's IP in default-on telemetry. Research mode feeds web, file and MCP text to the model with no injection guidance. No SECURITY.md, and security.txt returns 404. Which image `latest` points at today is unchecked. One, because the documented Compose setup answers anyone who reaches the port as the default user. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/khoj https://www.anchorterminal.com/tools/khoj#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source personal AI application with a Python server and a web interface.