A developer has released CaseCite, a free, open-source legal AI platform you host yourself, and framed it with a cheeky Hacker News headline: "Sorry Harvey!" The project page, sorryharvey.com, positions it as an alternative to Harvey, the legal AI company, while conceding it is not as polished. Underneath the joke is a real piece of software with a long README, an Apache 2.0 license and a design that tells you a lot about what legal AI actually needs.
This article explains what CaseCite does, how to run it, where the privacy claim needs care, and how it fits next to the commercial and big-lab legal tools we have been tracking, including Claude for Legal's new Artifacts and Z.ai's GLM-Legal.
TL;DR: the questions people ask first
| Question | Answer |
|---|---|
| What is it? | Self-hosted legal research, contract review, drafting and matter management in one app |
| Who made it? | Thomas Unise, a solo maintainer; support and private installs available from him |
| License | Apache 2.0 (versions up to 1.3.0 were Elastic License 2.0) |
| Price | Free software; you pay hosting and your own AI provider usage |
| Models | Bring your own keys: OpenAI, Anthropic or Gemini for chat; OpenAI, Voyage or Cohere for embeddings |
| Does data leave? | Stored locally, but AI calls send text to your chosen provider unless you self-host the models |
| Compared with Harvey | The project itself says "Not yet" on polish; no independent benchmark found |
What does CaseCite actually do?
According to the repository README, there are several tools behind one login, all reading from the same document corpus:
- Research: chat over your documents using hybrid retrieval, vector search plus a full-corpus keyword index merged by rank fusion, over chunks that know their section and page. Answers carry inline citations, and each claim is checked against the passage it cites. A deep-research mode produces an editable plan of sub-questions, researches each over your documents and CourtListener, verifies every quote against its source text and keeps a step log.
- Documents: upload and organize a corpus, with imports from Google Drive, OneDrive, Box, Dropbox, Filevine or Clio. iManage and NetDocuments connectors exist but are marked experimental and untested against a live tenant.
- Contracts: analyze an indexed contract, chat with one contract, compare two to four contracts clause by clause against a baseline, and export a redline, draft or analysis.
- Tabular review: review hundreds of contracts at once, one row per document with each value tied to a supporting passage, reviewer approval or flags, and export to Excel, CSV or JSON.
- Workflows: saved multi-step processes with conditions, approval steps, versioning and starter templates for NDA intake, lease review and a due-diligence pass.
- Drafting: documents grounded in up to four chosen references, with a section plan for long agreements and scoped revisions.
- Matters: a workspace per client engagement with access control and an audit-trail activity feed.
There is also a Word add-in that analyzes the open document, inserts suggested rewrites as tracked changes and inserts researched answers as footnoted paragraphs. It signs in with a short code approved in the web app, so the task pane never holds browser cookies.
A green lens enlarging one fold of an accordion document, picturing CaseCite open-source legal AI reviewing a contract clause
A notable design choice is the "practice profile." Nothing about a practice area is baked in: you state what you practice, CaseCite drafts a profile of what matters, and you edit it; it then rides along as standing context on every review, redline and draft.
What leaves your infrastructure?
This is the section a law firm should read first. The README is direct: documents, the vector index, chat history and analyses are stored only on your deployment. But using AI features transmits content to third parties you choose:
- Uploading a document sends its text to the embeddings provider (OpenAI by default; Voyage or Cohere if configured).
- Asking a question, analyzing or drafting sends the question and relevant document text to the LLM provider (OpenAI, Anthropic or Gemini).
- Case-law tools send search queries and citations to CourtListener.
To keep text entirely on your network you must run both models yourself, setting OPENAI_BASE_URL for chat and EMBEDDING_BASE_URL for embeddings to OpenAI-compatible servers you host. Setting only the first still sends document text to OpenAI for embedding. So "self-hosted" describes the application, not the AI, by default. That is the same trade-off we describe in our guides to local models and in the Archestra self-hosted release notes: control of the app does not equal control of the model.
At-rest security is documented with candor. The app encrypts per-user API keys and uploaded document originals at the application layer with AES-256-GCM, but derived text (vector chunks, chat history, analyses) sits in cleartext in the app, Postgres and Redis volumes. You must set DISK_ENCRYPTION_ACKNOWLEDGED=true to boot, acknowledging that full-disk encryption of the host is your responsibility. Env-configured fallback keys are shared by all users, so per-user cost attribution needs per-user keys.
How do you run it?
The README quick start needs Docker with Docker Compose, openssl and an AI provider key (OpenAI is the simplest, covering chat and embeddings).
git clone https://github.com/thomasunise/casecite.git
cd casecite
cp .env.example .env
openssl rand -hex 32 # SECRET_KEY
openssl rand -hex 32 # AUDIT_HMAC_KEY
openssl rand -hex 16 # ENCRYPTION_SALT
docker compose -f docker-compose.prod.yml up -d
You also set the domain (use localhost to try it), the Postgres and Redis passwords and a registration bootstrap token, which the first account needs to become admin. The stack fails closed on startup if required secrets are missing or left as placeholders, which is a sensible default for software handling client documents. A script, setup_production.py, can generate secrets and write .env. For a localhost trial, expect a browser warning from Caddy's self-signed certificate.
How does it compare with Harvey and the big labs?
The project page says plainly that it covers a substantial part of everyday legal workflows and that it is "not yet" as polished as Harvey's enterprise platform. We found no independent evaluation. Harvey publishes its own benchmark work, and as we reported, Z.ai's GLM-Legal scored 19.2% on Harvey's LAB with gated access, which is a reminder that real legal-agent benchmarks are hard and low. Meanwhile OpenAI pitched Astra for law and Anthropic added artifacts, a cite checker and more than 60 connectors to Claude for Legal.
What CaseCite offers instead is the shape of the product you can inspect: every citation checked against the passage, every quote verified, an audit trail, human approval steps. Whether the retrieval quality matches a commercial vendor's is unknown, because it depends on your chosen model and your documents. Its own notice says every AI answer should be verified against source documents and current law.
The hallucination problem is the real test
Legal AI lives or dies on fabricated citations, and courts have been sanctioning lawyers for them; see our reporting on lawyers sanctioned for AI hallucinations and the State Farm lawyer fined for fake citations. CaseCite's approach, checking each claim against the cited passage and verifying quotes against source text, is the right direction, and a citation-check tool that returns a negative-treatment badge is included. But the README itself says it is not a citator. A passing verification step in software cannot replace reading the case.
How should you evaluate it before trusting it?
Because no public benchmark exists, build a small test of your own before putting client work through it. Take ten contracts you already know well and plant a few traps: a liability cap buried in a schedule, a termination clause that contradicts the main body, an unusual governing-law choice. Ask CaseCite to surface each one and check whether the cited passage is really the one that supports the answer. Then run the citation-check tool on five authorities you know are good law and two you know have negative treatment, and see whether the badge agrees with you.
Repeat the same test with each model you plan to configure, since retrieval quality, refusal behavior and cost differ between providers. Record how long each answer takes and what each run costs on your keys. Finally, test the failure paths: delete a document and confirm it vanishes from answers, and confirm that a user outside a matter cannot see its files. These checks take an afternoon and tell you more than any launch claim.
What this means for what you build or pay
- Small firms and solo practitioners: the licensing cost is zero, but the true cost is a Linux host, someone who can run Docker and maintain it, and the AI usage bill. Commercial support from the maintainer exists.
- Developers: the repository is a useful reference architecture for regulated-document RAG: hybrid retrieval, clause-aware chunking, quote verification, matter-scoped access and an audit chain.
- Compliance teams: treat it as you would any vendor: review
docs/subprocessors.md, decide on provider data terms and confirm disk encryption.
Honest limits
- A solo-maintained project; the license changed from Elastic License 2.0 to Apache 2.0 after 1.3.0, so check which version you deploy.
- Some connectors are experimental.
- The project's page does not publish accuracy numbers.
- The Hacker News thread had little discussion when we checked, so there is no community stress test yet.
- By default, document text reaches a third-party model provider.
Bottom line
CaseCite is an interesting, candid piece of open-source legal software, and the "free Harvey" framing is a marketing line, not a measured claim. If you are a technologist at a firm, the README is worth reading for its data-flow honesty alone. If you are a lawyer, try it on non-sensitive documents with a locally hosted model first, and keep a human in the verification loop.
Related reading
- Claude for Legal Artifacts, cite checker and connectors
- GLM-Legal and the Harvey LAB score
- OpenAI Astra for law
- AI hallucination sanctions in legal cases
- State Farm lawyer and fake citations
- QuickReview: a self-hosted AI code reviewer
- Official: CaseCite repository and project page
Details are accurate as of October 29, 2026, from the project README and page.