The Problem

Am Law 100 firms spend roughly $2M/year per firm on legal tech. BigLaw targets solos, boutiques, and small firms that cannot afford that stack, consolidating research, drafting, redlining, e-signatures, briefing, docketing, billing, and collaboration into a single open-source platform. The project is explicitly experimental and not production-hardened.

What This Does

BigLaw is a portfolio of six self-contained projects, not one codebase. The core is biglaw-go/ (177 files), a Go backend that runs as a single static binary on 4 GB of RAM, with 100+ agents in a multi-round debate architecture. The ui/ folder (34 files) is a React/TypeScript frontend. benchmarks/harvey-lab/ contains a Python-based evaluation harness comparing this Go implementation against the original TypeScript version.

The README claims 1.25×–6.9× performance gains over the TypeScript original, which is preserved at tag typescript-final. The system supports local models (Ollama/LM Studio) and in-process vector search in biglaw-go/internal/agents/registry.go.

How It Is Wired

Execution starts at main in biglaw-go/cmd/biglaw/main.go:52, which reaches 401 functions. The shortest path to an external effect is main -> Init, which reads files via os.ReadFile. The API server's Run function (biglaw-go/internal/api/server.go:194) reaches 69 functions and is called from 11 places; it ultimately runs an external command via cmd.Run.

The most-connected modules are frontend types: ui/src/types (20 modules import it, 0 it imports) and ui/src/api (18 importers). These are hubs — changes ripple widely. On the Go side, biglaw-go/internal/cost/cost.go is called from 49 files and defines CalcCostUSD and CalcWattHours. The strutil.Truncate function is called from 47 places; requirePartner from 62. These carry the widest blast radius.

Four functions perform cryptographic operations, 44 read/write files, 6 call a model for inference, 7 make outbound network calls, and 2 run external commands. File effects route through handleApproveGate -> ApproveGate -> persistTasks (os.WriteFile) and handleAudit -> Query -> All -> readLocked (os.Open).

How To Use It

The repo provides a Dockerfile and docker-compose.yml in biglaw-go/, plus a root docker-compose.yml. No CI pipeline exists. Setup steps are not documented beyond the README's claims; the .env.example file exists but its contents are not shown in the analysis.

# Build the Go binary
cd biglaw-go
go build ./cmd/biglaw

# Or via Docker
docker build -t biglaw .

Configuration requires AUTH_ENABLED=false for local development (the default). The README explicitly warns: never expose the API on a public network without enabling auth. Keys and credentials must be treated as production secrets.

Real-World Use

A small firm deploys the Docker image on a Raspberry Pi, runs local models via Ollama, and uses the React UI for drafting and matter management. The biglaw-go/internal/api/matters.go file handles budget tracking and calls a model for inference; bots.go handles Slack/Teams notifications. The audit trail (internal/audit/audit.go) writes files for every action.

Code Health & Issues

Static analysis found 60 findings: 10 high, 50 medium. High-severity issues include 30 instances of deep nesting (max indentation depth 7 in ui/src/Library.tsx, AdminPanel.tsx, ClientsPanel.tsx) and 178 duplicated 6-line blocks across 58 files, including cmd/biglaw/main.go and internal/orchestrator/orchestrator.go. Medium issues include 12 oversized files (772 lines in ui/src/types.ts), hub modules (types.ts, api.ts), and two unclosed file handles in benchmarks/harvey-lab/labdriver/deliver.py and scripts/pdf_tools.py.

SDLC observations: no CI/CD pipeline, no Dependabot/Renovate, unpinned Docker base images (golang:1.25-alpine, alpine:3.21), and committed secrets detected. The README acknowledges the project is not security-audited.

The Bottom Line

This is a serious, ambitious experiment with real engineering substance — the Go rewrite is measurable and the architecture is coherent. It is not production software: no CI, no security audit, committed secrets, and the author says so plainly. Use it as a reference for legal AI architecture or a research platform, not for client data without independent security review.