AnythingLLM - Hardened Self-Hosted Private ChatGPT for Documents (RAG)
Lynxroute · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS ANYTHINGLLM
Show the rest of the publisher’s description (24 more lines)
AnythingLLM is an open-source, self-hosted ChatGPT-style application that turns any document collection into a private, queryable workspace. The server is a Node.js application that ingests PDFs, DOCX, HTML, plain text, audio transcripts, and code, chunks and embeds the content into a vector database, and serves a multi-user web UI for chat and AI agents. It supports any LLM provider through a single switch in the admin UI - OpenAI, Anthropic Claude, AWS Bedrock, Azure OpenAI, Google Gemini, Cohere, Mistral, Groq, OpenRouter, Ollama, LM Studio, vLLM, LiteLLM, and many more. AI agents can browse the web, run SQL, call tools, and execute multi-step workflows. Operators get team workspaces with per-workspace document scope, role-based access, public chat embeds, REST API for programmatic access, an OpenAI-compatible developer API, and a built-in admin UI. Persists users, workspaces, chats, documents, and vectors in embedded SQLite and LanceDB - no external database required. MIT license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- Admin user with unique password (EC2 Instance ID) generated at first boot - never baked into the AMI
- JWT signing key, encryption signing key, and salt (>=32 chars each) generated at first boot
- AnythingLLM container bound to 127.0.0.1:3001 only - reachable only through the Nginx reverse proxy with TLS
- Multi-user mode enabled at first boot - the bootstrap auth window closes immediately after admin creation
- No provider API keys baked in - operator configures OpenAI, Anthropic, Bedrock, Ollama, etc. in the admin UI after login
- Anonymous telemetry disabled by default
- Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, WebSocket support for streaming chat, security headers
- UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
- fail2ban, AppArmor
- CVE scan - every image is scanned for vulnerabilities before release
Out of the box, with no external services:
- Embedded LanceDB vector database - file-based, no separate container or network call
- Native embedder (Xenova/all-MiniLM-L6-v2) running inside the container - no external embedding API key required for RAG
- SQLite storage for users, workspaces, chats - no external database to provision
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
Highlighted by the publisher on AWS Marketplace.
Security baked in: admin user with unique password at first boot, JWT and encryption keys per instance, container bound to 127.0.0.1 behind Nginx TLS - unlike bare AnythingLLM AMIs that ship without TLS, with port 3001 open to the world, and with no admin auth.
RAG works out of the box - no external embedding service or vector DB to provision: ships with the native embedder (Xenova/all-MiniLM-L6-v2) inside the container and embedded LanceDB on a persistent host volume. Just upload documents and chat. Add provider API keys later in the admin UI.
CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included. MIT license - fully auditable, no vendor lock-in.
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment · as of 2026-08-29
Plans and pricing as listed
5 listed- Hrs
- Hrs
- Hrs
- Hrs
- Hrs
Refund terms
As stated by the publisher on AWS Marketplace.
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Sources
Publisher resources
1 linkLinked repositories
1 repoUnknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.