AnythingLLM vs Jan

AnythingLLM

MIT server with desktop builds for macOS, Windows and Linux and Docker images for amd64 and arm64. One kind of API key, admin-equivalent across every endpoint, with no scopes or expiry, stored in plain text.

Jan

Apache-2.0, with installers for macOS, Windows and Linux plus Flathub and the Microsoft Store. No release since 0.8.4 on 23 July 2026, while a security fix waits on main.

AnythingLLM

1. Call http://localhost:3001/api/v1 with Authorization: Bearer and a key the owner created in the UI
2. Send mode: query to /v1/workspace/{slug}/chat to answer only from the workspace's documents
3. Treat the key as admin. It can delete workspaces, users and documents
4. Read /api/docs on the instance for the endpoint list. Request bodies there are examples, not schemas
5. Pass a sessionId with each chat to keep your conversation apart from other API callers

Jan

1. Ask the owner to start the server (Settings, Local API Server) or run jan serve. Nothing listens until then
2. Call http://127.0.0.1:1337/v1 for the app and localhost:6767/v1 for jan serve. The ports differ
3. Read /openapi.json from the running server, not the spec on the docs site, which describes the retired Cortex API
4. Branch on the status code. Error bodies are plain text
5. Keep the bind at 127.0.0.1 on 0.8.4. Trusted Hosts is ignored on 0.0.0.0 until the next release