// the find
apocas/restai
RESTai is an AIaaS (AI as a Service) open-source platform. Supports many public and local LLM suported by Ollama/vLLM/etc. Precise embeddings usage, tuning, analytics etc. Built-in image/audio generation with dynamic loading generators. Live chat deployment. Built-in block based graphical language. Prompt versioning and much more...
RESTai is a self-hosted FastAPI platform that puts RAG, agents, image/audio generation, and a Blockly-style visual pipeline builder behind a single REST API with a full React admin UI. It's aimed at teams that want a multi-tenant, white-labelable LLM gateway (Slack/Telegram/WhatsApp bots, a WordPress plugin, embeddable chat widgets) without hand-wiring LangChain/LlamaIndex themselves.
Provider coverage is genuinely broad (OpenAI, Anthropic, Gemini, Bedrock, vLLM, Ollama, LiteLLM) and exposed through OpenAI-compatible endpoints, so existing client SDKs work unmodified. Knowledge base sync reaches real enterprise sources — S3, Confluence, SharePoint, Google Drive — which most self-hosted RAG projects don't bother with beyond file upload. The agentic browser feature (Playwright in a per-chat Docker container) pairs a domain allowlist with a secrets vault that resolves credentials server-side so they never hit the LLM context — that's a real answer to prompt-injection-driven exfiltration, not just a demo. Multi-tenancy (teams, RBAC, per-project rate limits, white-label branding) is core to the data model rather than bolted on later.
The README states most of the codebase is now AI-generated rather than human-written, which for a project handling auth, secrets, and headless browser automation warrants closer review than the claim invites. Feature surface is enormous for a 514-star project — RAG, agents, image/audio gen, Blockly, three chat platform integrations, and a WordPress plugin — breadth like that usually comes at the cost of test depth and a heavier long-term maintenance load than the contributor count suggests. Defaults are soft: admin/admin credentials and SQLite out of the box mean a lot gets exposed before anyone touches auth or the datastore. The bulk-ingest and browser-automation paths both require a shared filesystem or Docker daemon between processes, and the README itself documents the failure mode ("otherwise every bulk-ingest job stays queued") — a sign the multi-node deployment story isn't fully solved yet.