AnythingLLM vs PrivateGPT

AnythingLLM 78

v1.19.0 tagged on 25 October 2026, with a dated changelog page (30). v1.16.0 (13 August), v1.16.1 (27 August), v1.16.2 (22 September), v1.17.0 (1 October), v1.18.0 (12 October) and v1.19.0 in the 90 days from 6 August, dates from the tags in a clone (20). Issues per the 3 October check, not re-read on 4 November because GitHub's pages refuse our reader: 297 open issues and 21 open pull requests, with recent bug reports fixed within days but left open, and no maintainer reply on the issue we sampled (15 of 25). No MCP server or official SDK. Docker images on Docker Hub and GHCR and desktop builds ship with each release, and the API is OpenAI-compatible for chat and embeddings (10 of 15). The v1.19.0 Docker image installs Node 18.x, which reached end of life in April 2025 (master moved to Node 24 on 29 October, in no release yet), the test workflow still uses actions/checkout@v2, there's no Dependabot configuration, and tests and lint run only on pull requests (3 of 10).

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

AnythingLLM 57

Read with the API lines, scored on the developer API an agent calls. An OpenAPI 3.0 file with 63 operations at v1.19.0 (the meeting-assistant routes v1.19.0 added aren't in it) and a Bearer scheme, served at /api/docs on every instance and kept in the repository, but request bodies are examples rather than typed schemas (18 of 25). No llms.txt at docs.anythingllm.com (404 on 4 November) and no Markdown copies of pages. The docs source is MDX on GitHub (0). Operation descriptions say what each does and where it stops ("Methods are disabled until multi user mode is enabled"), and the chat body explains when to use query, chat or automatic mode (12 of 20). Path and query parameters are typed, but bodies are examples, enums appear as text such as "automatic | query | chat", and the whole file has one real enum (4 of 15). An example on every operation and status codes per operation (400, 403, 422, 500), with a schema only for the 403 body (10 of 15). Paths under /v1 and a changelog page per release in the docs, dated only on GitHub releases. The spec's own version has stayed 1.0.0 (13 of 15).

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

AnythingLLM 46

Read with the tool lines for the developer API. Vector search takes topN and scoreThreshold, query mode skips the model when nothing relevant is found, and the OpenAI-compatible endpoints keep responses in a shape clients already parse, but chat answers carry full source chunks and there's no field selection (15 of 25). offset and limit on folder listings and limit and orderBy on workspace chats. Workspace, document and user lists return everything (10 of 20). Missing or wrong keys get 403 with {"error": "No valid api key found."}, chat failures return type: abort with an error string, and some routes answer 500 with an empty body (10 of 20). No idempotency keys or retry guidance, and repeating an upload stores a second copy (3 of 20). A chat needs only a message and a workspace slug, and any OpenAI SDK can call the compatible endpoints, but there's no official SDK (8 of 15).

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.

AnythingLLM 38

Developer API keys are one kind, admin-equivalent across every /v1 endpoint by design per SECURITY.md, stored in plain text, with no scopes or expiry. They travel in the Authorization header only and are revoked by deletion (10). There's no read-only key. Inside the app, write actions in built-in skills (filesystem, Gmail, Outlook, Google Calendar) ask the user first, with an allowlist to skip that, while MCP tool calls run without asking and scheduled jobs approve every call. Multi-user mode adds admin, manager and default roles for the UI (7 of 20). Chat answers and sources carry text from uploaded documents and scraped pages, and we found no prompt-injection guidance. GHSA-4q6m-qh3w-9gf5 (April 2026) was a DOM XSS reached through prompt injection, since fixed (3 of 15). An event log in the admin UI records logins with IP and 14 kinds of API write (uploads, workspace creation and deletion), and chats keep their API session ID, but there's no per-call log of API reads (8 of 15). SECURITY.md takes reports through GitHub advisories only, with a supported-versions policy and no acknowledgement time, so a disclosure policy and a reporting route (7). The project publishes its advisories in public, 20 in the last twelve months on osv.dev, one still unfixed. No security.txt (404), no bug bounty, no SOC 2 or ISO 27001. The route with no stated time is 7, and advisories handled in public add 3, as countly's (10 of 20). 10 + 7 + 3 + 8 + 10 = 38.

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.