flowgraphapp 0.1.5

FlowGraph — local-first knowledge-graph canvas + AI planner, run securely on your own machine.

FlowGraph — local server (flowgraphapp)

Run FlowGraph — the local-first knowledge-graph canvas + AI planner — on your own machine. Same app as flow-graph.com, served from a hardened localhost server; your data stays in your browser, and (optionally) your AI key stays in your OS keychain instead of the browser.

Install

From PyPI:

python3 -m pip install flowgraphapp      # or, isolated: pipx install flowgraphapp
flowgraph                              # serves http://127.0.0.1:8765 and opens your browser

If your shell has a pip command, pip install flowgraphapp is equivalent. The PyPI distribution is named flowgraphapp; the installed command is flowgraph, not flowgraphapp.

From source:

# 1. build the frontend once
cd app && npm run build && cd ..
# 2. install the local server (use a venv or pipx to keep it isolated)
cd server && pip install .
# 3. run it
flowgraph

Open the printed URL if the browser does not launch automatically. The default port is http://127.0.0.1:8765; if that port is already busy, FlowGraph picks a free port and prints the replacement URL. Stop with Ctrl-C. Options: flowgraph --port 0 (auto-pick a free port), --no-open (don't open the browser), flowgraph --help.

Why local

• Offline / air-gapped — no Cloudflare, no network required for the app itself.
• Privacy / data locality — your graph lives in the browser's IndexedDB on this machine.
• On-device models — point at Ollama / LM Studio for zero-key, zero-cost AI.
• No size ceiling — not bound by hosting per-file limits as the app grows.

AI

Local-model-first: if a local runtime (Ollama :11434, LM Studio :1234) is reachable, it's used with no key. Otherwise bring your own provider key — stored in the OS keychain, used server-side, never sent to the browser:

flowgraph keys set anthropic     # or openrouter / openai / google / deepseek
flowgraph keys list              # shows source, never the key

Security (safe by default)

Binds loopback only (127.0.0.1); a per-session token is required (delivered via the terminal + a 0600 file; the auto-opened URL carries a one-time ticket, never the token). Host-header allow-listing blocks DNS-rebinding from websites you visit; Origin checks, strict CSP, and security headers apply to every route. Exposing beyond loopback (--allow-lan) requires TLS. See docs/18-local-server.md for the full threat model.

Updates

pip install -U flowgraphapp (or flowgraph upgrade) updates the app and server together; your data is untouched. A calm one-line "update available" notice appears at startup — disable with FLOWGRAPH_NO_UPDATE_CHECK=1.

What is in the package

The PyPI wheel contains the local server plus the compiled FlowGraph web app. It does not include the repo's private planning docs, reference folders, tests, app source tree, or development scripts.