AnythingLLM vs LocalGhost

AnythingLLM

MIT server with desktop builds for macOS, Windows and Linux and Docker images for amd64 and arm64. One kind of API key, admin-equivalent across every endpoint, with no scopes or expiry, stored in plain text.

LocalGhost

The server and Android app are MIT-licensed, with no telemetry libraries found. There is no agent API, MCP server or SDK; unpaired callers receive HTTP 503.

AnythingLLM

1. Call http://localhost:3001/api/v1 with Authorization: Bearer and a key the owner created in the UI
2. Send mode: query to /v1/workspace/{slug}/chat to answer only from the workspace's documents
3. Treat the key as admin. It can delete workspaces, users and documents
4. Read /api/docs on the instance for the endpoint list. Request bodies there are examples, not schemas
5. Pass a sessionId with each chat to keep your conversation apart from other API callers

LocalGhost

1. Don't call a LocalGhost box. Every request without the paired phone's certificate gets a 503 that looks like an outage
2. Reach a person's LocalGhost archive through the person and their phone. Nothing in wisp 0.0.3 opens it to an agent
3. Read a 503 from a box as no certificate, a retired phone, a locked box or a down daemon. The response never says which
4. Don't treat the README's list of what leaves the phone as complete. The app also calls Frankfurter, Wikipedia's summary API and Android's geocoder
5. Run ghost-cli ghost.<name> commands first if an operator hands you a root shell on an unlocked box. It lists command names only, takes key=value arguments and prints JSON