LibreChat for teams: what you run and share

LibreChat is an open-source chat app, under the MIT license, that puts many AI providers behind one interface, with agents, tools and multi-user sign-in. [1] ClickHouse acquired it on November 4, 2025; its founder Danny Avila and his team joined ClickHouse, which said that for existing deployments operations continue unchanged, with ongoing investment in the open-source project. [2] If you are deciding whether to run it for a team, the useful questions are what you have to operate, how people and permissions work, and where the team’s files end up. Here is each, then a different approach, Claude Code on a company file server, which is what we build — so read that section as ours.

What you run

• The stack. The default Docker Compose setup starts LibreChat with MongoDB, Meilisearch for conversation search, and the RAG API with a PostgreSQL/pgvector database for file search; the docs also cover installing with npm or a Helm chart. [3][7] The containers need at least 1 GiB of RAM; with everything running, give Docker at least 2 GB. [3]
• The Admin Panel needs v0.8.5 or later, runs as its own service with its own URL, and starts once you set ADMIN_PANEL_SESSION_SECRET; v0.8.7 bundled it into the Compose files. [6][16]
• Running code. Code runs in a separate sandbox, ClickHouse/code-interpreter (open source), that you deploy next to LibreChat. Admins can also attach a VM or workstation running the @librechat/code worker: there the agent can browse, read, search and edit files and run shell commands in the selected workspace. Pairing a machine doesn’t sandbox anything, so the docs say to isolate it like any machine that runs untrusted code. [13]
• Configuration. Settings live in .env and librechat.yaml; to use your own librechat.yaml in Docker you mount it through a docker-compose.override.yml. [3] Updating means stopping the containers, removing the old images, git pull, docker compose pull and starting again. [3]
• Pace. v0.8.8 was released on October 1, and a v0.8.9 release candidate on October 26. [16] The docs describe the development version, so a few features below — passkeys, and project instructions and files — arrived with that release candidate. [16]

Sign-in, roles and groups

• Sign-in. Email and password are on by default. An admin can add Google, GitHub, Discord, Facebook, Apple or any OpenID Connect provider, SAML, and LDAP or Active Directory. People with email or LDAP accounts can turn on two-factor authentication, and an admin can make it mandatory; admins can also enable passkeys. [4] Sign-ups can be limited to your email domains, and that applies to SSO logins too. [4]
• Roles. Every user has exactly one role: USER by default, ADMIN for the first account on a single-tenant instance, or a custom role an admin creates. [5] Each role has switches for using, creating and sharing agents, prompts, MCP servers and skills; a part that is switched off disappears from that role’s interface. [5]
• Groups. Admins create groups, or groups sync from Microsoft Entra ID when people sign in through Entra with OpenID token reuse on; membership changes apply at each person’s next login. [5]
• Admin Panel. It manages users, groups, roles, permissions and configuration in the browser instead of in librechat.yaml. It can save configuration overrides for a single role, group or user, and grants hand out individual admin capabilities, such as managing users, without making someone a full admin. Some settings stay in the file, such as MCP servers that run a local process, and deleting a user still needs the delete-user script. [6]

Agents, skills and sharing

Sharing is set per resource. Agents, prompts, MCP servers, skills and shared links each have their own access list; the creator is the owner and can share with users, groups, roles or everyone, as Viewer, Editor or Owner (shared links have only Viewer and Owner). [5] By default users can use and create these but not share them — sharing is something an admin turns on per role. [5]

• Agents each have their own model, instructions, files and tools, including MCP servers that an admin configures or a user adds, and Actions built from OpenAPI specs that can reach only the domains your admin allows. [8]
• Skills are SKILL.md files with a short front-matter block and instructions; you write one or upload a .md, .zip or .skill file, and its scripts/ folder is available in the code sandbox when Run Code is on. [14]
• Scheduled chats send a fixed prompt to one of your saved agents hourly, daily, on weekdays, weekly or on a cron schedule; each run starts a new conversation. They are experimental, and an admin has to turn them on. [15]

Where the files go

Files reach LibreChat by upload, from SharePoint, or on an attached machine. [7][13][22] An agent can use attached files three ways: File Search sends them to the RAG API, which splits and indexes them and returns matching passages; File Context puts a file’s full text into every message, which costs tokens on every turn; Run Code makes them available in the sandbox. [7][8]

• SharePoint. With Entra ID sign-in, people can browse SharePoint Online and OneDrive for Business and pick files; only files they may open in SharePoint are offered, and the picked files are downloaded and attached to the conversation. [22]
• Your files. Files indexed for search stay in your account, and you can attach them again later. [7]
• An agent’s files become its knowledge base: everyone who chats with the agent can have it search them, Editors and Owners see the attached files, and the docs warn that even Viewers can coax attached content out through the chat, so don’t attach anything its audience shouldn’t read. [5][7]
• Projects group your chats; in the v0.8.9 release candidate they gained shared instructions and up to 50 reference files by default. They are personal: a project can’t be shared with other users or groups. [9][16]

So once a file is in LibreChat, access is decided per agent, prompt or skill, and the file rides along with the agent it is attached to; SharePoint permissions decide which files a person can pick. [5][22] That works well when each set of documents belongs to one assistant and one audience. It is harder when the same documents sit in a folder tree outside SharePoint where Sales may open one folder and not the next.

Claude and spending

• Claude. Set ANTHROPIC_API_KEY to a company key, or to user_provided so each person enters their own key; Claude also works through Google Vertex AI, and the page notes that newer Claude models are available through AWS Bedrock. [10] The Anthropic setup page describes API keys and cloud providers; it does not describe signing in with a Claude subscription. [10]
• Spending. The balance setting gives each user credits, weighted by each model’s rate (1,000 credits = $0.001). It is off by default; a new account starts with 20,000, and balances can refill on a schedule (by default 10,000 every 30 days) or reset to a set amount each period. [11][23] When an admin turns it on, the conversation shows context usage and cost. [23] Admin Insights shows conversations, users, messages and token counts per agent — the docs say the token figure is not a cost figure — and shows admins people’s names, email addresses and the first message of recent conversations. [12]

Claude Code on a company file server

This is what we built Trina AX to do, so here is how it works there. Claude Code and Codex run on one company server next to a team folder — shared/, groups/<group>/, projects/<project>/, skills/ and a personal folder for each person — and people use a chat app in the browser, on desktop or phone. [17][19]

• Files are checked as the person asking. Folder rules decide who sees what, and one permission function on the server decides every access; a file you can’t open is invisible in Files, AI answers, search, previews, version history and trash. [19] The engine runs without its own shell or file tools and reaches files only through the server’s tools, which check the person every time — so unlike Claude Code on a laptop, it doesn’t run shell commands. [18][25]
• Getting files in. You upload files or whole folders into the team folder, which keeps a version of every change, or connect Google Drive, which has its own integration with the same folder checks. [17][19]
• Folder rules. An admin sets each folder to follow the folder above, only named people, everyone reads, or everyone reads and writes, then gives people and groups read, read-and-write or no access — so “everyone reads, but not Bob” works — and sees who gains or loses access before saving. [19]
• People. Admins invite members and set up groups under Admin › People. [21] People sign in with a username and password; the docs describe no SSO or two-factor sign-in. [26] Chats are visible only to their owner, and the activity log shows which files the AI read, not the conversation. [17]
• Team skills are SKILL.md files in skills/, which everyone reads and skill managers write; the server asks a person to confirm before the AI saves into skills/. [19]
• Claude. Claude or OpenAI, as a subscription or an API key, connected for a person, a group or the whole team; use only accounts and plans that are authorized for your use. [17] On new hosted teams, one company connection can serve the whole team by default; the site notes that this setting doesn’t grant permission under Anthropic’s or OpenAI’s terms, that sharing one person’s subscription across a team can break them, and that a company API key with a monthly limit per person avoids that question. [17] On a self-hosted server, Claude Code can also run on other models through an Anthropic-compatible gateway. [17]
• Spending. Admins see answers, tokens and estimated cost by person, group, engine or model, and can set token limits for a person, a group or the whole team, per day or per month; at the limit, the people it covers can’t start new answers until the period resets. There are no limits by default. The costs are estimates of the equivalent API price, not bills, and subscription connections add 0 per request. [20]

What it doesn’t do. Its security page calls it a pre-release with no security certification yet. [18] Server operators, including Trina on a hosted plan, can read stored files and chats; removing folder access doesn’t erase earlier answers; self-hosting is not offline. [17][19] Codex isn’t available on office Macs. [17] Installing it yourself is free under AGPL-3.0-only, which requires you to offer the source of a changed version you run as a network service. [18] It needs Debian 13 (or 12, or Ubuntu 24.04) with systemd and cgroup v2 — not a plain Docker container — 4 GB of RAM recommended and at least 20 GB of disk; on an office Mac it runs as a signed-in user and stops when that user logs out. [24] Or Trina hosts a private server for you in Seoul for up to 40 people (larger teams by quote), each plan capping people and AI answers running at the same time — the smallest takes 5 people — with a 14-day free trial (a card is needed to start) and paid plans from $50 a month. AI usage is paid separately to your AI provider. [17]

Fits when the files already sit in folders whose access differs folder by folder, you want Claude Code’s agent to open them as the person asking, and username-and-password sign-in is acceptable for now.

Side by side

	LibreChat	Trina AX
What it is	A chat app for many AI providers, with agents and tools [1][8]	Claude Code and Codex on a company server, with a chat app [17]
What you run	Docker Compose (or npm, or Helm): the app, MongoDB, Meilisearch, the RAG API and a vector database; the Admin Panel and code sandbox as extra services [3][6][13]	Debian or Ubuntu with systemd (not a plain Docker container), an office Mac, or a private server Trina hosts in Seoul [17][24]
Sign-in	Email, OAuth and OpenID Connect, SAML, LDAP; 2FA that admins can require; passkeys in the v0.8.9 release candidate [4][16]	Username and password, by invitation; no SSO or 2FA in the docs [21][26]
Who sees which file	Your own uploads; an agent’s files go to everyone who can chat with it; SharePoint permissions decide what each person can pick; projects are personal [5][7][9][22]	Per folder, checked as the person asking [19]
How the AI uses files	Search over an index, full text in every message, a code sandbox, or an attached machine where it edits files and runs commands [7][8][13]	Claude Code opens them through the server’s tools; its own shell is off [18][25]
Claude	An API key, shared or per user; Vertex AI; Bedrock [10]	A subscription or an API key, for a person, a group or the team, within each provider’s terms [17]
Spending controls	Credits per user weighted by model rate, off by default; cost in the conversation when turned on [11][23]	Token limits per person, group or team, none by default; estimated cost by person, not a bill [20]
License	MIT [1]	AGPL-3.0-only; a changed version you run as a service must offer its source [18]

How to choose

1. Many AI providers in one place, SSO through SAML, LDAP or Entra, assistants shared by group, and someone to run the stack → LibreChat.
2. Documents that belong to one assistant and one audience each, or that already live in SharePoint with the right permissions → LibreChat, keeping in mind that everyone who can chat with an agent can reach its files.
3. Company folders whose access differs folder by folder, Claude Code’s agent working on them as the person asking, and sign-in by username and password is fine for now → a company file server like Trina AX.

Questions people ask

Is LibreChat free for a company?

The software is MIT-licensed, so yes; you pay for the servers and for AI usage. [1] The code sandbox is a separate open-source project you deploy yourself. [13]

Does LibreChat have an admin panel?

Yes. It needs v0.8.5 or later, runs as a separate service and has been in the Compose files since v0.8.7; it manages users, groups, roles, permissions and configuration. A few settings still live in librechat.yaml, and deleting a user still needs a script. [6][16]

Can LibreChat use Claude?

Yes, with an Anthropic API key — one for the company or one per person — or through Vertex AI or Bedrock. [10]

Can I limit which files each person sees?

Per agent, not per folder: files attached to an agent are available to everyone who can chat with it, and the docs warn that viewers can draw attached content out through the chat. Files picked from SharePoint are limited to what each person may open there. Indexed uploads stay in the uploader’s account, and projects are personal. [5][7][9][22] On a company file server like Trina AX, access is set per folder and checked on every file the AI opens. [19]

Who owns LibreChat?

ClickHouse, since November 4, 2025. [2]

Try it

• LibreChat: its Docker setup page [3] and its Access Control page. [5]
• Trina AX: Ask your first question, Set folder permissions and Files and permissions. Source: github.com/trina-app/trina-ax. Hosting plans: ax.trina.app/#pricing.

Claude is a trademark of Anthropic. Trina AX is made by Trina Inc. and is not affiliated with Anthropic.