Read the code
One public repository holds the whole thing. The desktop app, the server, the Zotero plugin, the browser connector and this website are all in there.
Open the repository
Open source and local-first
Open source and local-first
Research software asks for a great deal of trust. It holds unpublished work, material you may not be licensed to share, and years of reading. Nodus answers that in the only two ways you can check for yourself. The source is published under a licence that keeps it published, and the corpus never leaves your computer unless you ask it to.
01 · The licence
Published under a licence that keeps it published.
Nodus 4.0.0 and later are released exclusively under the GNU Affero General Public License v3.0, SPDX AGPL-3.0-only. Versions through 3.2.7 remain available under the MIT licence that accompanied them.
What that means for you in practice is short. You may read the code, run it for any purpose, modify it and pass it on. If you distribute a modified version, or run one as a network service that other people use, you have to publish your source under the same terms. That last part is what the Affero in AGPL adds, and it is why the licence was chosen. It means a future hosted version of Nodus cannot quietly become a closed product built on this work.
Every published build links to its Corresponding Source, which is the exact immutable tag and the source archives the release was made from. A binary you downloaded can therefore be traced back to code you can read. The third-party notices list every dependency and its licence, and the repository follows the REUSE convention, with an SPDX header on its files.
Read the licence
The complete, unmodified AGPL-3.0 text ships with the source, and the corresponding-source document names the tag every release was built from.
AGPL-3.0-onlyRead the dependencies
Third-party notices list what Nodus is built on and under which terms, so an institution can review the whole stack rather than one name.
Third-party noticesReport a vulnerability
Security issues have their own private disclosure route rather than a public issue, so a fix can ship before the details do.
Security policy
02 · Where your work lives
On your disk, in a folder you chose.
Local-first is a claim about storage, not a slogan. In Nodus it means every vault, the cross-vault Library and every search index are files on your own computer.
01
No account, ever
There is no sign-up, no licence key and no subscription. You download an installer, open it, and create a vault. Nothing about the application depends on a server run by the project, because there is no such server.
02
You choose the folder
Vaults and the shared Library sit under a backup folder you pick, which means they can live on an encrypted disk, a departmental drive or wherever your institution requires. Moving them is moving files.
03
Backups you can verify
Nodus makes encrypted automatic backups, and a complete Nodus 4 backup holds every vault together with the shared Library. Before Nodus 4 opens an existing database it creates and verifies a one-time pre-v4 recovery copy, and Nodus 4 can still open backups made by Nodus 3.x.
04
A record of what happened
An audit ledger records the operations performed in a vault. That matters when the question months later is not what does my corpus say but when did this change, and why.
No advertising, telemetry or remote analytics. The application does not send your content to a cloud run by the project, because the project runs none. This website carries no analytics container either, so no Tag Manager, no Google Analytics and no tracking pixel, and a test in the repository fails the build if anyone ever adds one.
03 · What leaves the machine
Every outgoing request, and what triggers it.
Local-first does not mean a program that never touches the network. It means nothing goes out unless you asked for something that needs it. Here is the whole list.
AI providers, only once you configure one
Model-assisted features stay inactive until you set up a provider or a local model. When you use one, that provider receives the text or page image the task needs. Run Ollama or LM Studio instead and the content never leaves your device at all.
How Nodus uses AIBibliographic lookups, only the identifier
Ask Nodus to resolve metadata and it sends Crossref, Open Library, NCBI or arXiv the single DOI, ISBN, ISSN, PMID or arXiv id you selected, and nothing else. Bulk requests are rate limited and can be cancelled, and candidates are shown for review rather than applied for you.
Updates, checked but never installed for you
Nodus checks GitHub for new releases and can download one, but the download is not automatic and an update is never installed behind your back. GitHub sees what any web request exposes, such as an IP address.
Announcements, a static file you can switch off
Nodus fetches a public static file from this website so it can warn you about known issues between releases. It is a plain conditional GET, at most once every four hours, carrying no identifier, no account, no vault name and nothing about your corpus. Turn it off in Settings → Updates and news and no request is made at all.
Zotero, a connection that never leaves the computer
The Zotero integration talks to the Zotero application on the same machine over a local connection. There is no API key and no round trip through zotero.org.
How the Zotero link worksSharing, opt-in and always a copy
Nodus Server publishes a filtered copy of a vault you explicitly choose to share, while the original database and documents stay on your computer. Nothing is published until you set it up.
This page is a summary written for people deciding whether to try Nodus. The privacy policy is the authoritative document and goes a good deal further, service by service. Please read it before you put confidential or personal research material into any application, this one included.
04 · Citing Nodus
Software you can cite like any other instrument.
If Nodus contributes substantially to research that leads to a publication, cite the version you used. The repository ships machine-readable citation metadata in CITATION.cff, including an ORCID for the author and the released version and date, which GitHub renders directly in APA and BibTeX.
Citing the version matters more here than it does for a general purpose editor. Analysis pipelines change between releases, and a reviewer asking how a corpus was processed deserves an answer that points at a specific archived tag.
Nodus started as one person's project, and it now includes everyone who has added to it since. Bug reports, translations, documentation and a precise account of what broke are worth as much as code. The contribute page sets out the ways in.
Keep going