Self-host freki
v1.0.0Open-source static malware analysis with web UI and API
docker-compose up- Stars
- 446
- Port
- 8000 (Freki Flask app served by gunicorn inside the container (proxied by the bundled Nginx on 80/443).)
- Requires
- MariaDB
What is freki?
Freki is a free, open-source malware analysis platform aimed at researchers and small teams who want an analysis instance on their own hardware. It computes a wide set of hashes for submitted files (from MD5 and the SHA families up to CRC32 and SSDEEP), performs static analysis of PE samples covering their headers, sections, imports, capabilities and embedded strings, runs YARA pattern matching, and queries the VirusTotal API for detection reports. Everything is reachable through a web interface with user accounts, community comments on samples and free sample downloads, plus a REST API for use from other projects. Deployment is documented via Docker Compose (a Flask app container, MariaDB and Nginx, configured through a .env file) or a step-by-step manual install on Ubuntu/Debian, Arch Linux or Fedora/RHEL using Python 3, a virtualenv and MariaDB. Freki describes itself as a collaborative alternative inspired by VirusTotal and MalwareBazaar rather than a full replacement; the newest tagged release is v1.0.0 from 2020 and several documentation pages are still marked "Coming soon".
Should you self-host freki?
freki scores 42/100 on selfhost.directory (how scoring works) and ranks #62 of 78 in Security. It has 446 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is moderate: expect some configuration beyond a single command. It is AGPL-3.0-licensed and written mostly in YARA.
Its closest alternative on selfhost.directory is urlvet (46/100, 110 stars). It scores higher overall, so compare the two before you pick. See freki vs urlvet side by side.
Features
- Community Comments
- File hash extraction
- PE static analysis
- REST API
- Sample Downloads
- User Management
- VirusTotal lookups
- Web Interface
- Yara Pattern Matching
freki README
FAQ
How can I have my own instance?
You can run it via Docker or install everything by hand, as described in the administrator documentation.
What is the difference to VirusTotal?
VirusTotal is great but paid for sample downloads; Freki is described as a collaborative alternative inspired by it and by MalwareBazaar, that you can run privately and extend.
Who can use Freki?
Anyone who wants a malware analysis tool running locally or publicly, whether for a small group or an open instance.
More in Research
gpt-researcherSelf-hosted, open-source deep research agent: a planner splits your question, parallel researchers scan 20+ web or local sources, and it writes a cited report.
gramps-webSelf-hosted, open-source genealogy web app for building family trees collaboratively with Gramps Desktop sync, interactive charts, DNA tools, and AI assistant.
gramps-web-apiSelf-hosted REST API for Gramps family trees with DNA analysis, AI assistant, and Gramps Desktop sync.
Local Deep Research ~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
Open Data CaptureOpen Data Capture is a self-hosted, open-source web platform for clinical questionnaires and interactive tasks, with hash-based patient IDs and multilingual support.
PDFMathTranslateSelf-hosted, open-source scientific PDF translator that preserves formulas, tables and layout, via CLI, Gradio GUI or Docker using Google, DeepL, Ollama or OpenAI.
RigorousRigorous is a self-hosted, open-source Python tool using 24 AI agents to analyze academic manuscripts with detailed feedback and PDF reports.
ScienceClawSelf-hosted, open-source personal research assistant for scientific research with 1,900+ built-in tools, multi-format report generation, and local-first privacy.
ThesysSelf-hosted open-source research workspace for searching papers, uploading PDFs, on-PDF highlights with citations, reader mode Q&A, paper comparison, and citation export.
VoyantServerVoyantServer is a self-hosted Java app running local Voyant Tools for text analysis, enabling offline work, privacy, and large-text handling.
amiuniqueSelf-hosted browser fingerprinting research platform collecting device fingerprints to study web tracking. Built with Play Framework and MySQL.
Deep Research Web UISelf-hosted AI agent generates cited reports via web searches, browsing real sources, and verifying evidence. Supports many AI providers and search APIs via Docker.
0 comments