SHSelfHostIndex
R2

R2R

Production-ready RAG engine with a RESTful API

Self-Hosted AI ★ 8k stars Medium setup MIT

R2R (RAG to Riches) is a retrieval-augmented generation engine that bundles ingestion, hybrid search, knowledge graphs, and agentic reasoning behind a single API. It is designed for self-hosted production deployment of document question answering.

Official siteSource code

Key features

  • Hybrid and graph search
  • Document ingestion pipeline
  • Agentic RAG endpoints
  • User and collection management

Strengths

  • Released under the MIT license
  • First-class Docker support for quick deployment
  • Mature project with 8k GitHub stars
  • Written in Python

Is R2R secure?

No confirmed vulnerabilities affect R2R's latest release (v3.6.5). OSV.dev lists 3 advisories for the project and links 2 of them to this release, but their version data doesn't confirm them. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

2 unconfirmed matches

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2026-82526CriticalR2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
CVE-2026-82527HighR2R 3.6.6 SQL Injection via Retrieval Search Filter Key
  • Most recent fixed advisory CVE-2026-82271, published 2026-08-28 (47 days ago), fixed in 3.6.5

Source: OSV.dev, checked 2026-10-14. How this is measured.

R2R replaces

Self-hosted OpenAI Assistants alternatives

Health badge

Maintain R2R? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 59 · fair

Markdown
[![SelfHostIndex health score for R2R](https://selfhostindex.com/badge/r2r.svg)](https://selfhostindex.com/app/r2r/)
HTML
<a href="https://selfhostindex.com/app/r2r/"><img src="https://selfhostindex.com/badge/r2r.svg" alt="SelfHostIndex health score for R2R"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/r2r.svg
   :alt: SelfHostIndex health score for R2R
   :target: https://selfhostindex.com/app/r2r/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare R2R

6 head-to-head comparisons.

Similar self-hosted ai apps