Maintainer of this skill?
Automated security scan — not a certification.
by thomasunise
CaseCite is an open-source, self-hosted legal RAG caselaw research & document analysis platform.
# Add to your Claude Code skills
git clone https://github.com/thomasunise/caseciteGuides for using ai agents skills like casecite.
Last scanned: 11/1/2026
{
"issues": [
{
"file": "README.md",
"line": 256,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "PASSED",
"scannedAt": "2026-11-01T11:03:09.489Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how casecite compares with popular alternatives.
casecite is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by thomasunise. CaseCite is an open-source, self-hosted legal RAG caselaw research & document analysis platform. It has 244 GitHub stars.
Yes. casecite passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/thomasunise/casecite" and add it to your Claude Code skills directory (see the Installation section above).
casecite is primarily written in Python. It is open-source under thomasunise on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh casecite against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
If you need help setting up or installing this on your infrastructure, contact me at https://thomasunise.com
CaseCite is an open-source, self-hosted legal research platform. Upload your firm's documents, ask questions, and research cases & judges — on infrastructure you control. Documents, the search index and chat history are stored on your own servers. AI features send your questions and the relevant document text to the AI providers you configure, under your own API keys (BYOK); nothing is sent to the CaseCite maintainers, and there is no telemetry. See What leaves your infrastructure.
Nine tools behind one login, all reading from the same document corpus.
Research (/research) |
Chat over your firm's documents — hybrid retrieval (vector search and a full-corpus keyword index, merged by rank fusion) over clause-aware chunks that know their section and page, and inline citations back to the source, each claim checked against the passage it cites. Deep research for bigger questions: a plan of sub-questions you edit before anything runs, each researched over your documents and CourtListener, every quote verified against the text it came from, and a step log of what was searched. |
Documents (/documents) |
Upload, index, and organize your corpus. Import from Google Drive, OneDrive, Box, Dropbox, Filevine, or Clio — OAuth sync, or a file picker where OAuth verification isn't needed. iManage and NetDocuments connectors exist but are experimental (untested against a live tenant) and off unless EXPERIMENTAL_CONNECTORS=true. |
Contracts (/contracts) |
Full contract review pipeline: analyze an indexed contract or pasted text, chat with a single contract, compare 2–4 contracts clause-by-clause against a baseline, and export a redline, a draft, or the analysis itself. |
Tabular review (/review-tables) |
Review hundreds of contracts at once: start from a built-in or saved field template, point the table at a set of documents, and get one row per document with every value tied to the exact passage that supports it. Open any cell to see the quote highlighted in the document, override the value, approve or flag it with a note; a re-run never undoes a reviewer's work. Filter by status, sort typed columns, bulk-approve or re-run a selection, add documents later, see the run history and what changed. Export to Excel (Results, Citations, Review and Summary sheets), CSV or JSON, narrowed to the columns and cells you choose. |
Workflows (/workflows) |
Save a review, research or drafting process as an ordered list of steps (extract fields, analyse contracts, compare against a baseline, draft a document, deep research, check citations, wait for an approval) and run it over any set of documents as one background job. Steps can run on a condition over an earlier output; an approval step pauses the run until a named approver decides; every step's output is rendered in full (extracted rows, issues, clause differences, the draft with Word export, the research answer, citation treatment); a failed run resumes, retries or skips a step; every change to the steps is a version a run records; and the runner is emailed when a run ends or needs them. Three starter templates (NDA intake, lease review, due-diligence pass) show the shape. See docs/workflows.md. |
Drafting (/drafting) |
Draft a document grounded in up to four documents you pick from the Knowledge Base, with server-side text extraction and PDF conversion. Set a target length for long documents (30-page agreements): you review a section plan first, then every section is drafted in its own context window against the full references and the whole is reconciled. Revisions to long drafts are scoped to the sections they touch. |
Matters (/matters) |
One workspace per client engagement: the documents, research chats and contract analyses filed under it, who can see them, and an activity feed from the audit trail. Set a matter as active in the header and Research, Contracts and Drafting scope themselves to it. Owners invite colleagues, file documents in bulk, and hand a matter over when someone leaves. |
Case view (/case/:id) |
Open a CourtListener opinion and chat with it directly. |
Judge intel (/judge-intel) |
Judge analytics from CourtListener. |
Legal tools (/tools) |
Case lookup, citation check (a scan of citing opinions for negative-treatment language — not a Shepard's/KeyCite substitute), precedents, dockets, oral arguments, and case-law trends. |
Captured from the real UI against a mocked API with fictional firm, matter and
case data (frontend/e2e/screenshots.spec.ts). No real client or case appears.
| Research over the firm's documents | Knowledge Base |
|---|---|
 |
 |
| Contract analysis | Citation check |
|---|---|
 |
 |
Practice profile. Nothing about any practice area is baked into the product. You state what you practice, CaseCite drafts a profile of what matters in that practice, and you edit and own it (saved via Settings). It then rides along with every review, redline, and draft as standing context.
Every AI-generated answer, analysis and draft carries a notice to verify it against the source documents and current law before relying on it. CaseCite is a research aid, not a substitute for a lawyer's judgment or for a citator.
Documents, the vector index, chat history and analyses are stored only on your deployment. Using the AI features transmits content to third parties you choose:
To keep document text entirely on your network, run both models yourself: set
OPENAI_BASE_URL (chat) and EMBEDDING_BASE_URL (embeddings) to
OpenAI-compatible servers you host. Setting only the first still sends
document text to OpenAI for embedding. The full list of outbound data flows,
and how to restrict them, is in docs/subprocessors.md.
Copyright 2026 Thomas Unise. CaseCite is open source under the Apache License 2.0 (LICENSE), an OSI-approved permissive license. In plain terms:
Commercial support and private installs are available from the maintainer, @thomasunise. See SUPPORT.md. Versions up to 1.3.0 were released under the Elastic License 2.0; that license continues to apply to those versions.
openssl (to generate secrets)git clone https://github.com/thomasunise/casecite.git && cd casecite
cp .env.example .env
# 1. Generate the three REQUIRED secrets (the .env.example placeholders
# intentionally refuse to boot). Copy each value into .env:
openssl rand -hex 32 # -> SECRET_KEY
openssl rand -hex 32 # -> AUDIT_HMAC_KEY
openssl rand -hex 16 # -> ENCRYPTION_SALT
# 2. In .env also set OPENAI_API_KEY (or leave it empty and save a key under
# Settings after signing in), then uncomment and set DOMAIN,
# POSTGRES_PASSWORD and REDIS_PASSWORD in the "Bundled production stack"
# section (generation hints are in the file; use DOMAIN=localhost to try it
# on your machine). CORS_ORIGINS and ALLOWED_HOSTS default from DOMAIN.
# Set REGISTRATION_BOOTSTRAP_TOKEN too (openssl rand -hex 16) — you need it
# to create the first account.
# 3. Set DISK_ENCRYPTION_ACKNOWLEDGED=true in .env (required to boot).
# What this acknowledges: the app encrypts BYOK keys and uploaded documents
# at the application layer (AES-256-GCM), but derived text (vector chunks,
# chat history, analyses) is stored in cleartext in the app, Postgres and
# Redis volumes — full-disk encryption of the host is YOUR responsibility.
# 4. Start the full stack (bundled Postgres + Redis + Caddy):
docker compose -f docker-compose.prod.yml up -d
python3 scripts/setup_production.py --create-env --domain <host> does steps
1–2 for you (it generates every secret and writes .env with mode 0600).
Then open https://$DOMAIN (with DOMAIN=localhost: https://localhost).
On a localh