Korkut

Korkut is a self-hosted, single-tenant AI assistant for a Turkish law office. It manages case files, does live legal research, drafts petitions, and handles correspondence — through a chat web app that keeps client data on the office's own machine. Korkut answers under that office's identity.

Features

• Case files (matters) — clients, hearings, and procedural deadlines, with a unified, proactive agenda of what's coming up.
• Legal research — live search and fetch over Turkish public legal databases (Yargıtay, Danıştay, UYAP Emsal, mevzuat, KİK, Rekabet, Sayıştay, GİB, Uyuşmazlık, KVKK, BDDK, insurance arbitration).
• Drafting — petition/contract drafting in a Canvas editor with DOCX/UDF export.
• Correspondence — propose-and-confirm e-mail.
• Local-first — in Ayarlar → Yapay zeka, point Korkut at a local OpenAI-compatible model (e.g. LM Studio, Ollama) and nothing leaves the machine. If you choose a cloud model, outbound text is passed through best-effort redaction first — a mitigation, not a guarantee (see DISCLAIMER.md).
• Self-hosted — one office per install, one admin (korkut-admin) created by the installer, members invited by e-mail; password sign-in with optional two-step verification, nothing external. Overall security depends on how you deploy it (TLS, backups, updates); provided as-is, with no warranty.

Quick start

curl -fsSL https://github.com/bircex/korkut/releases/latest/download/korkut.tar.gz | tar xz
cd korkut && ./install.sh     # Windows: unpack korkut.zip, run .\install.ps1

Then open http://localhost:8090. From a clone of this repository, ./install.sh builds from source instead. Releases follow CalVer (YYYY.MM.PATCH); see CHANGELOG.md and docs/RELEASING.md.

No configuration is needed; see docs/INSTALL.md for settings and where data lives.

To work on the code, the runtime is a .NET 10 solution at the repository root (Korkut.slnx, src/, tests/) and the React app is in ui/:

make build     # dotnet build Korkut.slnx
make test      # full test suite (needs Docker for the Postgres integration tests)
make run       # start the API on :8080  (dotnet run --project src/Korkut.Api)
make migrate   # apply EF Core migrations via the migrator

Layout

Everything lives in this repository:

Path	What
src/	The .NET hosts and modules
ui/	The React app, built into the app image and served from the same origin as the API
website/	The Astro marketing site, a separate static deploy
tests/	Unit, integration and architecture tests

Documentation

Start with the documentation index:

Page	What it covers
INSTALL	Installing and updating with the installer, settings, where data lives
DEVELOPMENT	Dev loop: run, test, lint, build, CLIs, adding a tool
ARCHITECTURE	The single-office model, the matter domain, and the agentic core
GLOSSARY	Turkish legal & product terms in English

Contributing

Contributions are welcome — see CONTRIBUTING.md and our Code of Conduct. Report security issues privately via SECURITY.md.

Legal & disclaimer

Korkut is free, open-source software that you self-host — not a service, a SaaS platform, or legal advice. It is provided "AS IS", without warranty of any kind (see LICENSE). Full text: DISCLAIMER.md.

• Not legal advice. Korkut does not provide legal counsel or representation. Every output — research, summaries, petition/contract drafts — is a draft for a qualified lawyer to review. AI output can be wrong, incomplete, or fabricated (e.g. invented case/article citations); verifying it is the user's responsibility.
• Your data stays on your machine. By default all data (chats, documents, accounts) lives only on your own server. The project ships no telemetry or analytics — the developers receive nothing and cannot access your deployment.
• You are the data controller. Whoever installs and operates Korkut is the "data controller" (veri sorumlusu) under Türkiye's KVKK (and GDPR where applicable) for the personal data they process, and bears all related obligations (registration, notice, consent, security, retention). The developers are not a controller or processor of your data.
• Local by default; cloud models are optional and your responsibility. Point Korkut at a local OpenAI-compatible model and nothing leaves the machine. If you choose to connect it to an external/cloud model (e.g. OpenAI, Google, any third-party API), your inputs are sent to that provider — possibly abroad. Meeting cross-border transfer requirements (KVKK Art. 9 / GDPR) and assessing that provider's data-retention and training policies is solely your responsibility.
• Optional integrations. Enabling WhatsApp, Telegram, or e-mail integrations sends the relevant data to those third parties, under their own terms. Lawfulness and any required notice/consent are your responsibility.
• Limitation of liability. To the maximum extent permitted by law, the developers are not liable for any direct or indirect damages arising from use of the software. This does not apply to gross negligence or willful misconduct.

This is a general notice, not legal advice. Before using Korkut with real client data, have a data-protection/IT lawyer review your deployment.

License

MIT © Recep Kızılarslan