Audited 2026-10-28 · Sources: GitHub repo metadata + source review at commit e9bbe76 (server, updater, memory, library index — egress, update, and file-boundary paths read directly), README, LICENSE, SOURCES.md, GitHub Issues & PRs, the Hacker News thread, and the published update manifest. Code audited — nothing installed or executed.
The card
| Repo | anonnerdfrenzy/survival-llm (site: brangus.io/survival-llm) |
| Stars | 586 at audit time — created 2026-10-24 and gaining roughly 80/hour while we watched; Hacker News front page, 517 points and 194 comments. |
| License | MIT on the code (copyright Ronny Fernandez); library content keeps each source's own license — Wikipedia, WikiMed, MedlinePlus, Ready.gov, CDC, FEMA, military field manuals, wikiHow, iFixit, Appropedia. |
| Provenance | Solo pseudonymous maintainer ("Brangus") — GitHub account since December 2022, eight followers, real history. Unusually honest engineering: a committed eval harness, blind-judged answer scores, and one model dropped from the lineup after it gave dangerous advice in their own testing. |
| What it is | An offline chat assistant over a ~1.5-million-article emergency and reference library. A local model (Ollama) calls three tools — search_library, read_article, show_article — against a SQLite FTS5/BM25 index of ~1,500-character passages, then answers with a Sources line the app verifies against articles actually opened. Roughly 150 KB of nearly standard-library Python; the only dependencies are pywebview, pypdf, truststore, and Ollama itself. |
| Install surface | Unsigned zip on both platforms — a Mac .app that trips Gatekeeper or a Windows .bat that trips SmartScreen — plus a bundled engine and 1.3–8.8 GB of library and 6–80 GB of model downloads. Alternative: python3 app/server.py from source, which is fully auditable. |
What problem it solves
Emergency reference when the internet is down: food safety in a blackout, treating a burn, purifying water, generator and CO safety. The design goal is an AI that shows its work — every answer lists the articles it read and the passage it used, with the cited text highlighted, so you can check it instead of trusting it. Their own eval scores the top model at 86% accuracy on 22 emergency questions — their measurement, not ours.
Our gate findings — the 5 Walls
Gate Score: 1 of 5 — all five walls clear. Only the seventh clean sweep across the 73 vendors in our wall-check registry — and every one of the other six is open source too (FastAPI, Playwright, PostgreSQL, Uvicorn, Django, WordPress self-hosted). This is what a tool looks like when the vendor erects no commercial gates at all:
| Wall | Finding |
|---|---|
| Price | Clear. No paid tier exists — no pricing page, no checkout, no "contact sales." The product is $0 under MIT. |
| Permission | Clear. No accounts, roles, or license keys. Every setting is a file on your disk; nothing is unlockable. |
| Gate | Clear. No humans in the loop — anonymous direct download or git clone. The OS-level warnings (Gatekeeper, SmartScreen) are unsigned-binary friction, not a vendor gate. |
| Meter | Clear. No usage metering, credits, seats, or billable API calls. Your costs are disk (~21 GB installed), RAM (16 GB+ for a usable model), and electricity. |
| Exit | Clear. Best exit posture we've audited: memory notes are a plain .txt, settings are JSON, the library is Markdown shards plus SQLite, models are standard Ollama files, and your documents never move. Uninstall is deleting four documented folders. |
The catch isn't a wall — it's the supply chain
A perfect wall score means the vendor isn't holding anything hostage. It says nothing about whether the artifact should be trusted. That's a different audit — and it's where the flags live:
| Check | Finding |
|---|---|
| Update channel | The trust anchor is one GitHub account. The app fetches update.json from the project's GitHub Pages site; that file carries both the download URL and the SHA-256 it's checked against — so the hash only proves the zip is what that account published. No signed manifest, no publisher certificate, no reproducible build. A compromised account ships a valid, hash-matching update to every install. |
| Unsigned builds | Neither platform artifact is signed by a verified publisher. The Mac update path does run codesign --verify --deep, but ad-hoc or self-signed bundles pass that check too — it proves the bundle isn't corrupt, not who made it. |
| Mitigations in source | Real ones: updates are user-triggered only (the daily check fetches the manifest but installs nothing by itself), the local API binds to 127.0.0.1 behind a per-launch random token and a Host allowlist that blocks DNS-rebinding, every network call has a timeout, and we found no telemetry endpoints — total egress is two small JSON fetches a day plus downloads you initiate. |
| Healthy signals | Issues and PRs show a real maintainer: five open issues, all substantive quality reports; a Cmd+Q bug shipped as a fix within days; community pull requests under review. The HN criticism is philosophical (does this need an LLM at all?) plus the same unsigned-binary flag — nobody has found malice. |
Verdict: CAUTION — run from source or don't run it. The code is genuinely well-built and the wall score is as clean as it gets. But the packaged zips can't be verified against the source (unsigned, no reproducible build), and the self-updater's entire trust model is one maintainer's GitHub account. If you want it: clone the repo, pin the commit, run app/server.py in a VM or spare machine — and skip the packaged installers on anything that matters.
Best for
Preppers and cabin owners who want emergency reference on a laptop that stays off the internet — and engineering teams shopping for a clean, honest reference implementation of local RAG with citation verification. If you just want the emergency library without the AI layer, Kiwix carries much of the same corpus with no model involved.