Morphic 1.8 brings built-in accounts and local crawling to AI search
The self-hostable search app packages Better Auth and an opt-in crawl4ai backend, with unusually explicit documentation of what still leaves your server.
Accounts and page reading on your own infrastructure
Morphic v1.8.0 gives self-hosters two practical pieces of an AI search service: built-in user accounts and an optional crawler they operate themselves. The October 17 release packages Better Auth support for multiple users and a crawl4ai fetch backend, alongside account usage budgets, search fixes and clearer privacy documentation.
Morphic is a standalone search application that combines retrieval with cited answers and streamed interface components. It can use hosted model APIs, Ollama or OpenAI-compatible endpoints. It is not itself a model provider, and these release notes are not an independently measured improvement in answer quality.
For multi-user self-hosting, the tagged guide recommends explicitly setting AUTH_PROVIDER=better-auth. Accounts live in the instance’s PostgreSQL database, so this route does not require an external authentication service. Better Auth is not selected automatically: the example Docker configuration remains anonymous by default. Its first account becomes the instance administrator and closes the bootstrap window; BOOTSTRAP_ADMIN_EMAIL can restrict who creates that first account.
The guide calls the new provider’s in-process authentication rate limiting basic and recommends a reverse proxy with HTTPS and its own rate limits for internet-facing instances. Chat sharing with Better Auth is also opt-in.
A local crawler is not an offline search engine
Setting CRAWL4AI_BASE_URL routes every fetch-tool request, including PDF extraction, through the configured crawler, ahead of Jina or Tavily. The tagged documentation describes a page-extraction attempt followed by a PDF strategy if needed. This changes where pages are fetched and extracted; it does not make the web content local or establish that every PDF will parse successfully.
The privacy guide makes the remaining data flows explicit. A configured hosted AI provider receives the full prompt, conversation history, search results and attachments. Search providers receive the agent’s query. Bundled SearXNG still contacts its upstream engines. Result-image hosts can see the visitor’s browser request, and opening a YouTube result loads an embed.
The release also moves source favicons behind Morphic’s own origin. According to the documentation, this keeps visitors’ browsers from contacting the favicon provider directly, while the provider still receives the cited hostnames from the server. It can be disabled separately. Without a local crawler or Jina key, API extraction can still send a URL to Tavily even when no Tavily key is configured, resulting in an authentication error. Self-hosted does not mean no outbound requests.
How to run it
The recommended route is Docker Compose: clone the repository, configure .env.local and run docker compose up -d. The stack starts PostgreSQL, Redis, SearXNG and Morphic, with the app at localhost port 3000. Bun is the documented development route. Hosted models need their applicable credentials and may incur provider charges; Ollama is a documented local alternative. The software itself is Apache-2.0 licensed.
The release’s attraction is a more concrete choice about who runs accounts, page extraction and model inference. Those choices remain separate, and the project’s documentation makes their boundaries visible.