{ "data": { "a": { "slug": "anythingllm", "name": "AnythingLLM", "vendor": "Mintplex Labs", "vendorUrl": "https://anythingllm.com", "kind": "platform", "category": "local-ai", "summary": "Open-source app for chatting with documents using local or hosted models. Available as a desktop app or a self-hosted server.", "url": "https://www.anchorterminal.com/tools/anythingllm", "markdownUrl": "https://www.anchorterminal.com/tools/anythingllm.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/anythingllm.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/anythingllm.json", "dns": "anythingllm.grade.anchorterminal.com", "repo": "https://github.com/Mintplex-Labs/anything-llm", "license": "MIT (server, document collector, frontend and Docker image). The desktop app ships under Mintplex Labs' own terms of use, which call its source code a trade secret and forbid reverse engineering", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "mintplexlabs/anythingllm" }, { "registry": "oci", "name": "ghcr.io/mintplex-labs/anything-llm" } ], "auth": "api-key", "authNotes": "The developer API under /api/v1 takes a key in `Authorization: Bearer`. An admin creates keys in the UI. SECURITY.md says each key has full, unrestricted access to the whole /v1 surface, equivalent to admin, and the database stores keys in plain text with no scopes or expiry. A key is revoked by deleting it. The instance itself runs with no password, one password or multi-user accounts, chosen at onboarding, and the desktop backend listens on 127.0.0.1:3001 unless network discovery is switched on.", "pricing": "freemium", "pricingNotes": "The desktop app and the Docker server are free, with no account. AnythingLLM Cloud, a private managed instance on AWS, costs $50 a month (Basic, bring your own model key) or $99 a month (Pro, 72-hour support SLA), with Enterprise on request. The Cloud page shows no trial or free tier, and /pricing now redirects to it. An optional desktop Pro subscription lifts daily limits on Magic functions (https://anythingllm.com/cloud, checked 2026-11-04).", "priceSummary": "$50 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 66600, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://docs.anythingllm.com", "openapi": "https://raw.githubusercontent.com/Mintplex-Labs/anything-llm/master/server/swagger/openapi.json", "capabilities": [ "inference.local", "memory.search", "agent.mcp-client", "memory.user", "inference.open-weights" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "desktop", "docker", "openapi", "openai-compatible", "rag", "mcp-client", "freemium", "telemetry-default-on" ], "lastRelease": "2026-10-25", "graded": true, "anchor": { "graded": true, "score": 42.1, "grade": "E", "agentReady": false, "rank": 1288, "ranked": true, "rankOf": 1510, "categoryRank": 18, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 46, "maintenance": 78, "payments": 60, "reliability": 70, "schema": 57, "security": 38, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "2025-12-18 to 2026-09-10. Advisories counted one by one from osv.dev, 20 published in the last twelve months. Fixed Highs and Criticals over two months old, 1 each: CVE-2026-48116 (GHSA-6hrp-7mw6-8v59, 7.5, ripgrep `--pre` code execution, 28 May), CVE-2026-5627 (huntr, 9.1, AgentFlows path traversal, 7 April), CVE-2026-32628 (7.7, SQL agent injection) and CVE-2026-32626 (9.6, streaming XSS to code execution), both 13 March, CVE-2026-24478 (7.2, path traversal) and CVE-2026-24477 (8.7, key leak in systemSettings.js), both 26 January (6). CVE-2026-32617 (GHSA-24qj-pw4h-3jmm, 7.1, any-origin CORS on installs with no password), published by the project on 13 March with no fixed version, and master still sets `cors({ origin: true })`, unfixed High (2). Fixed Moderates the project published, 1 each: CVE-2026-88055 (10 September, fixed in v1.16.2), CVE-2026-72917 (10 August, fixed in v1.16.0), CVE-2026-48789, CVE-2026-42456, CVE-2026-41318, CVE-2026-32719 and CVE-2026-21484 (7). CVE-2026-55611 (scored 0.0) and four Lows cost nothing, and CVE-2025-63390 (MITRE, Medium, no fix listed) is left uncounted as a third-party Medium. Subtotal 15. https://osv.dev/list?q=anything-llm", "2026-10-19. A fix to the project's own described flaw released with no advisory: commit f1c3f53c, \"drop API key fragments from web search error messages\", shipped in v1.19.0 (25 October). Released unadvised fix, -3. https://github.com/Mintplex-Labs/anything-llm/commit/f1c3f53c", "2026-11-02. Fixes on master in no release yet: \"re-check user and workspace access when an agent invocation connects\" (#6954) and \"reject browser extension API keys whose owner is no longer an admin or manager\" (#6952). Unreleased fix, -3 until released. https://github.com/Mintplex-Labs/anything-llm/commits/master", "The terms add up to 21, so the negative sits at the -15 floor." ], "verdict": "MIT server with desktop builds, Docker images, a 63-operation OpenAPI file and OpenAI-compatible endpoints. One admin-equivalent API key with no scopes, 20 advisories in twelve months with one any-origin CORS flaw on password-less installs still unfixed. Telemetry is on by default.", "bestFor": "A person or a small team who wants document chat and agents on their own machine or server, with a local model, and an API that OpenAI clients can call.", "strengths": [ "MIT server with desktop builds for macOS, Windows and Linux and Docker images for amd64 and arm64", "63 developer API operations in OpenAPI 3.0, served at /api/docs on every instance", "OpenAI-compatible chat, embeddings and model endpoints that treat each workspace as a model", "38 model providers, including Ollama, LM Studio and a built-in local engine on the desktop, and LanceDB on disk by default", "v1.19.0 on 25 October 2026, six releases in the 90 days from 6 August, each with a changelog page" ], "weaknesses": [ "One kind of API key, admin-equivalent across every endpoint, with no scopes or expiry, stored in plain text", "20 advisories in twelve months on osv.dev, and the March any-origin CORS advisory has no fix on master", "Telemetry on by default, and the source sends 33 event types where the README lists five kinds", "Request bodies in the OpenAPI file are examples, not typed schemas, and there's no llms.txt", "Backend tests run only on pull requests, and the released Docker image still runs Node 18, end of life since April 2025" ], "agentNotes": [ "Call http://localhost:3001/api/v1 with `Authorization: Bearer` and a key the owner created in the UI", "Send `mode: query` to `/v1/workspace/{slug}/chat` to answer only from the workspace's documents", "Treat the key as admin. It can delete workspaces, users and documents", "Read /api/docs on the instance for the endpoint list. Request bodies there are examples, not schemas", "Pass a `sessionId` with each chat to keep your conversation apart from other API callers" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.1 } ], "editorialScores": { "ergonomics": 46, "maintenance": 78, "payments": 60, "reliability": 70, "schema": 57, "security": 38, "transparency": 58 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "export STORAGE_LOCATION=$HOME/anythingllm \u0026\u0026 \\\nmkdir -p $STORAGE_LOCATION \u0026\u0026 \\\ntouch \"$STORAGE_LOCATION/.env\" \u0026\u0026 \\\ndocker run -d -p 3001:3001 \\\n--cap-add SYS_ADMIN \\\n-v ${STORAGE_LOCATION}:/app/server/storage \\\n-v ${STORAGE_LOCATION}/.env:/app/server/.env \\\n-e STORAGE_DIR=\"/app/server/storage\" \\\nmintplexlabs/anythingllm:latest" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/anythingllm" }, "area": "models", "unitPrices": [ { "item": "AnythingLLM Cloud Basic", "unit": "month", "usd": 50, "note": "Private instance, bring your own model key" }, { "item": "AnythingLLM Cloud Pro", "unit": "month", "usd": 99, "note": "Private instance, 72-hour support SLA" } ], "provenance": { "legalEntity": "Mintplex Labs, Inc.", "domain": "anythingllm.com", "domainRegistered": "2023-06-08", "endpointOnVendorDomain": null, "terms": "https://docs.anythingllm.com/installation-desktop/terms", "privacy": "https://docs.anythingllm.com/installation-desktop/privacy", "statusPage": "", "changelog": "https://github.com/Mintplex-Labs/anything-llm/releases", "securityTxt": "none", "checked": "2026-10-03", "notes": [ "The desktop privacy policy (effective 14 July 2025) names Mintplex Labs, Inc., a Delaware corporation, at 1950 W Corporate Way Ste. 25340, Anaheim, CA 92801.", "There's no shared hosted endpoint. Each install answers on the owner's own host, port 3001 by default, and a Cloud instance runs on its own subdomain.", "anythingllm.com/.well-known/security.txt returns 404. SECURITY.md takes reports only through GitHub security advisories.", "RDAP for anythingllm.com gives a registration date of 2023-06-08. Self-hosted terms are in TERMS_SELF_HOSTED.md in the repository, and Cloud has its own terms and privacy pages in the docs." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/anythingllm.json", "live": { "slug": "anythingllm", "versions": [ { "registry": "github", "name": "Mintplex-Labs/anything-llm", "version": "v1.19.0", "released": "2026-10-26", "seenAt": "2026-11-06T23:06:29.924815476Z" } ], "githubStars": 68013, "securityTxt": { "url": "https://anythingllm.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:24.22384535Z" }, "domain": { "domain": "anythingllm.com", "registered": "2023-06-08", "source": "https://rdap.verisign.com/com/v1/domain/anythingllm.com", "checkedAt": "2026-11-01T14:07:52.235526702Z" }, "pages": [ { "url": "https://docs.anythingllm.com/installation-desktop/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:05:01.971714217Z", "changedAt": "2026-11-06T13:27:34.297510511Z", "fingerprint": "91ab6c58ffd2" }, { "url": "https://docs.anythingllm.com/installation-desktop/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:05:04.013268827Z", "changedAt": "2026-11-06T13:27:36.727549175Z", "fingerprint": "e9094c6f6682" } ], "github": { "repo": "mintplex-labs/anything-llm", "checkedAt": "2026-11-02T09:07:27.396613166Z", "stars": 67844, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T23:50:45Z", "openIssues": 330, "openPRs": 33, "issuesOpened90d": 404, "issuesClosed90d": 363, "prsMerged90d": 313, "ci": { "branch": "master", "runs": 50, "success": 20, "failure": 0, "other": 30, "latest": "success", "latestAt": "2026-10-30T21:08:50Z" }, "advisories": [ { "ghsa": "GHSA-p9pc-ccw4-fxc5", "severity": "low", "published": "2026-09-21T18:19:57Z" }, { "ghsa": "GHSA-3f4c-xj8r-h4cr", "severity": "medium", "published": "2026-09-21T18:08:52Z" }, { "ghsa": "GHSA-8wh8-3v68-whwj", "severity": "medium", "published": "2026-09-14T16:42:35Z" }, { "ghsa": "GHSA-rh3m-xv7m-9jhf", "cve": "CVE-2026-88055", "severity": "medium", "published": "2026-09-01T16:29:20Z" }, { "ghsa": "GHSA-vv8w-wg6r-hq56", "cve": "CVE-2026-72917", "severity": "medium", "published": "2026-07-15T17:25:36Z" }, { "ghsa": "GHSA-r872-gr59-vf5w", "cve": "CVE-2026-55611", "severity": "low", "published": "2026-06-14T23:17:22Z" }, { "ghsa": "GHSA-j4m9-wwcq-m868", "cve": "CVE-2026-48789", "severity": "medium", "published": "2026-06-01T23:27:21Z" }, { "ghsa": "GHSA-6hrp-7mw6-8v59", "cve": "CVE-2026-48116", "severity": "high", "published": "2026-05-21T00:02:49Z" }, { "ghsa": "GHSA-h349-hp2v-8rhw", "cve": "CVE-2026-47713", "severity": "low", "published": "2026-05-19T18:28:03Z" }, { "ghsa": "GHSA-vjrp-43mm-j7vw", "cve": "CVE-2026-45403", "severity": "low", "published": "2026-05-10T20:12:20Z" }, { "ghsa": "GHSA-jwqg-jfg3-x5vv", "cve": "CVE-2026-42456", "severity": "medium", "published": "2026-04-22T23:46:30Z" }, { "ghsa": "GHSA-4q6m-qh3w-9gf5", "cve": "CVE-2026-41318", "severity": "medium", "published": "2026-04-15T17:38:37Z" }, { "ghsa": "GHSA-2qmm-82f7-8qj5", "severity": "medium", "published": "2026-03-13T23:51:21Z" }, { "ghsa": "GHSA-p5rf-8p88-979c", "severity": "medium", "published": "2026-03-13T22:22:27Z" }, { "ghsa": "GHSA-rh66-4w74-cf4m", "cve": "CVE-2026-32719", "severity": "medium", "published": "2026-03-13T17:18:38Z" }, { "ghsa": "GHSA-7754-8jcc-2rg3", "cve": "CVE-2026-32717", "severity": "low", "published": "2026-03-13T17:05:31Z" }, { "ghsa": "GHSA-wfq3-65gm-3g2p", "cve": "CVE-2026-32715", "severity": "low", "published": "2026-03-13T16:46:57Z" }, { "ghsa": "GHSA-jwjx-mw2p-5wc7", "cve": "CVE-2026-32628", "severity": "high", "published": "2026-03-13T04:57:39Z" }, { "ghsa": "GHSA-rrmw-2j6x-4mf2", "cve": "CVE-2026-32626", "severity": "critical", "published": "2026-03-13T03:50:32Z" }, { "ghsa": "GHSA-24qj-pw4h-3jmm", "cve": "CVE-2026-32617", "severity": "high", "published": "2026-03-12T22:42:05Z" }, { "ghsa": "GHSA-jp2f-99h9-7vjv", "cve": "CVE-2026-24478", "severity": "high", "published": "2026-01-24T01:08:03Z" }, { "ghsa": "GHSA-gm94-qc2p-xcwf", "cve": "CVE-2026-24477", "severity": "high", "published": "2026-01-24T00:05:36Z" }, { "ghsa": "GHSA-47vr-w3vm-69ch", "cve": "CVE-2026-21484", "severity": "medium", "published": "2026-01-02T23:51:01Z" }, { "ghsa": "GHSA-7hpg-6pc7-cx86", "severity": "high", "published": "2025-05-07T16:38:51Z" }, { "ghsa": "GHSA-xmj6-g32r-fc5q", "cve": "CVE-2024-22422", "severity": "high", "published": "2024-01-18T21:57:52Z" } ], "replies": { "sampled": 18, "unanswered": 4, "medianDays": 0.5 } }, "updatedAt": "2026-11-07T16:01:24.22384535Z" } }, "answer": "PrivateGPT scores 53.2 (D) on agent readiness against AnythingLLM's 42.1 (E), and leads in 3 of 7 scored categories. AnythingLLM leads on security \u0026 auth and maintenance \u0026 community.", "b": { "slug": "privategpt", "name": "PrivateGPT", "vendor": "Zylon (PriBAI Technology Spain S.L.)", "vendorUrl": "https://docs.privategpt.dev", "kind": "http-api", "category": "local-ai", "summary": "PrivateGPT is Zylon's open-source server that puts an Anthropic-style messages API, document ingestion, retrieval with citations, built-in tools and MCP connectors in front of any OpenAI-compatible local model server. The owner runs it.", "url": "https://www.anchorterminal.com/tools/privategpt", "markdownUrl": "https://www.anchorterminal.com/tools/privategpt.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/privategpt.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/privategpt.json", "dns": "privategpt.grade.anchorterminal.com", "repo": "https://github.com/zylon-ai/private-gpt", "license": "Apache-2.0", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "zylonai/private-gpt" } ], "auth": "none", "authNotes": "Authentication is off by default. When `server.auth.enabled` is set, every request must carry one static secret in the `Authorization` header, compared with the whole header value. There are no per-user keys, scopes or rotation, and the docs show it as a Bearer token, a Basic value and an Anthropic API key in different places (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with no account or card. The cost is the owner's hardware and model server. Zylon sells a separate enterprise platform built on PrivateGPT through demos, with no public price (checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the OpenAPI file or the docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57600, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.privategpt.dev/introduction", "llmsTxt": "https://docs.privategpt.dev/llms.txt", "openapi": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/fern/openapi/openapi.json", "capabilities": [ "inference.local", "memory.search", "agent.mcp-client" ], "tags": [ "open-source", "local", "self-hosted", "docker", "openapi", "llms-txt", "rag", "mcp-client", "anthropic-compatible", "python", "free" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 53.2, "grade": "D", "agentReady": false, "rank": 960, "ranked": true, "rankOf": 1510, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -7, "negativeNotes": [ "Issue #2269, opened 11 June 2026, reports that the async ingestion API reads any local path given as a URI artifact. The stale bot closed it as not planned on 5 July with no maintainer reply, and `load_file_from_uri` in the source of 29 October 2026 still falls back to reading a local file for any value that isn't a URL, s3 or base64. With authentication off and a 0.0.0.0 bind by default, that is an open file-read path on a default install. Read from the source, not run (-7). https://github.com/zylon-ai/private-gpt/issues/2269" ], "verdict": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.", "bestFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "strengths": [ "Messages API modelled on Anthropic's, so Claude Code and Anthropic SDKs work by changing the base URL", "OpenAPI file of 38 paths, llms.txt and Markdown copies of every docs page", "Retrieval with citations, async ingestion, web, database and tabular tools, and remote MCP servers in one API", "Apache-2.0, with no telemetry to Zylon found in the source and OpenTelemetry tracing off by default", "Works with Ollama, llama.cpp, vLLM, LM Studio or any OpenAI-compatible server" ], "weaknesses": [ "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin", "When on, authentication is one shared static secret, with no per-user keys or scopes", "A June 2026 report of local file reads through URI artifacts was closed by a stale bot, and the source still reads local paths", "No release since 1.0.1 in June 2026 while main has moved on, including a breaking change", "Code execution runs as a host subprocess with resource limits, not in a container" ], "agentNotes": [ "Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller", "Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`", "Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`", "Pass ingested documents through `tool_context` to get answers with citations", "Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.2 } ], "editorialScores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 67 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "brew tap zylon-ai/tap\nbrew install private-gpt", "http": "curl http://localhost:8080/v1/messages \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"qwen3.5:35b\", \"messages\": [{\"role\": \"user\", \"content\": \"Explain retrieval-augmented generation.\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/privategpt" }, "area": "models", "provenance": { "legalEntity": "PriBAI Technology Spain S.L.", "domain": "privategpt.dev", "domainRegistered": "2023-10-16", "endpointOnVendorDomain": null, "terms": "https://github.com/zylon-ai/private-gpt/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://github.com/zylon-ai/private-gpt/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Self-hosted software with no hosted endpoint, so the Apache-2.0 licence stands in for terms and no privacy policy is scored.", "The zylon.ai terms name PriBAI Technology Spain S.L. (VAT ESB56550130) under Spanish law and cover the website and Zylon services. They forbid access through bots, scripts or scrapers, outside standard search engine or browser use. We read the terms and two public pages.", "RDAP gives privategpt.dev a registration date of 16 October 2023.", "docs.privategpt.dev/.well-known/security.txt and www.zylon.ai/.well-known/security.txt answer 404. SECURITY.md in the repository is the reporting route.", "docs.privategpt.dev and www.zylon.ai robots.txt allow our reader. wheels.privategpt.dev has no robots.txt (404)." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/privategpt.json", "live": { "slug": "privategpt", "versions": [ { "registry": "github", "name": "zylon-ai/private-gpt", "version": "v1.0.1", "released": "2026-06-18", "seenAt": "2026-11-06T23:58:40.643071731Z" } ], "githubStars": 57632, "securityTxt": { "url": "https://privategpt.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:53.351491852Z" }, "llmsTxt": { "url": "https://docs.privategpt.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:41.730243326Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:15.016082629Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "767d5dd99544" }, { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:17.075442465Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "839fbbcddc72" } ], "updatedAt": "2026-11-07T15:59:53.351491852Z" } }, "edges": [ { "by": 37, "category": "maintenance", "leads": "anythingllm", "name": "Maintenance \u0026 community", "reasons": { "a": "v1.19.0 tagged on 25 October 2026, with a dated changelog page (30). v1.16.0 (13 August), v1.16.1 (27 August), v1.16.2 (22 September), v1.17.0 (1 October), v1.18.0 (12 October) and v1.19.0 in the 90 days from 6 August, dates from the tags in a clone (20). Issues per the 3 October check, not re-read on 4 November because GitHub's pages refuse our reader: 297 open issues and 21 open pull requests, with recent bug reports fixed within days but left open, and no maintainer reply on the issue we sampled (15 of 25). No MCP server or official SDK. Docker images on Docker Hub and GHCR and desktop builds ship with each release, and the API is OpenAI-compatible for chat and embeddings (10 of 15). The v1.19.0 Docker image installs Node 18.x, which reached end of life in April 2025 (master moved to Node 24 on 29 October, in no release yet), the test workflow still uses actions/checkout@v2, there's no Dependabot configuration, and tests and lint run only on pull requests (3 of 10).", "b": "The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41." }, "scores": { "a": 78, "b": 41 } }, { "by": 26, "category": "schema", "leads": "privategpt", "name": "Schema \u0026 documentation", "reasons": { "a": "Read with the API lines, scored on the developer API an agent calls. An OpenAPI 3.0 file with 63 operations at v1.19.0 (the meeting-assistant routes v1.19.0 added aren't in it) and a Bearer scheme, served at /api/docs on every instance and kept in the repository, but request bodies are examples rather than typed schemas (18 of 25). No llms.txt at docs.anythingllm.com (404 on 4 November) and no Markdown copies of pages. The docs source is MDX on GitHub (0). Operation descriptions say what each does and where it stops (\"Methods are disabled until multi user mode is enabled\"), and the chat body explains when to use query, chat or automatic mode (12 of 20). Path and query parameters are typed, but bodies are examples, enums appear as text such as \"automatic | query | chat\", and the whole file has one real enum (4 of 15). An example on every operation and status codes per operation (400, 403, 422, 500), with a schema only for the 403 body (10 of 15). Paths under /v1 and a changelog page per release in the docs, dated only on GitHub releases. The spec's own version has stayed 1.0.0 (13 of 15).", "b": "An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83." }, "scores": { "a": 57, "b": 83 } }, { "by": 18, "category": "ergonomics", "leads": "privategpt", "name": "Agent ergonomics", "reasons": { "a": "Read with the tool lines for the developer API. Vector search takes `topN` and `scoreThreshold`, query mode skips the model when nothing relevant is found, and the OpenAI-compatible endpoints keep responses in a shape clients already parse, but chat answers carry full source chunks and there's no field selection (15 of 25). `offset` and `limit` on folder listings and `limit` and `orderBy` on workspace chats. Workspace, document and user lists return everything (10 of 20). Missing or wrong keys get 403 with `{\"error\": \"No valid api key found.\"}`, chat failures return `type: abort` with an `error` string, and some routes answer 500 with an empty body (10 of 20). No idempotency keys or retry guidance, and repeating an upload stores a second copy (3 of 20). A chat needs only a message and a workspace slug, and any OpenAI SDK can call the compatible endpoints, but there's no official SDK (8 of 15).", "b": "Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64." }, "scores": { "a": 46, "b": 64 } }, { "by": 6, "category": "security", "leads": "anythingllm", "name": "Security \u0026 auth", "reasons": { "a": "Developer API keys are one kind, admin-equivalent across every /v1 endpoint by design per SECURITY.md, stored in plain text, with no scopes or expiry. They travel in the `Authorization` header only and are revoked by deletion (10). There's no read-only key. Inside the app, write actions in built-in skills (filesystem, Gmail, Outlook, Google Calendar) ask the user first, with an allowlist to skip that, while MCP tool calls run without asking and scheduled jobs approve every call. Multi-user mode adds admin, manager and default roles for the UI (7 of 20). Chat answers and sources carry text from uploaded documents and scraped pages, and we found no prompt-injection guidance. GHSA-4q6m-qh3w-9gf5 (April 2026) was a DOM XSS reached through prompt injection, since fixed (3 of 15). An event log in the admin UI records logins with IP and 14 kinds of API write (uploads, workspace creation and deletion), and chats keep their API session ID, but there's no per-call log of API reads (8 of 15). SECURITY.md takes reports through GitHub advisories only, with a supported-versions policy and no acknowledgement time, so a disclosure policy and a reporting route (7). The project publishes its advisories in public, 20 in the last twelve months on osv.dev, one still unfixed. No security.txt (404), no bug bounty, no SOC 2 or ISO 27001. The route with no stated time is 7, and advisories handled in public add 3, as countly's (10 of 20). 10 + 7 + 3 + 8 + 10 = 38.", "b": "Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32." }, "scores": { "a": 38, "b": 32 } } ], "facts": [ { "a": "Platform", "b": "HTTP API", "name": "Kind" }, { "a": "Mintplex Labs", "b": "Zylon (PriBAI Technology Spain S.L.)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (server, document collector, frontend and Docker image). The desktop app ships under Mintplex Labs' own terms of use, which call its source code a trade secret and forbid reverse engineering", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-25", "b": "2026-06-18", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "67k stars", "b": "58k stars", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "PrivateGPT scores 53.2 (D) on agent readiness against AnythingLLM's 42.1 (E), and leads in 3 of 7 scored categories. AnythingLLM leads on security \u0026 auth and maintenance \u0026 community.", "question": "Which is better for AI agents, AnythingLLM or PrivateGPT?" }, { "answer": "No hosted endpoint is listed for AnythingLLM. No hosted endpoint is listed for PrivateGPT.", "question": "Can an agent call AnythingLLM and PrivateGPT without installing anything?" }, { "answer": "Yes. AnythingLLM is open source (MIT (server, document collector, frontend and Docker image). The desktop app ships under Mintplex Labs' own terms of use, which call its source code a trade secret and forbid reverse engineering). PrivateGPT is open source (Apache-2.0).", "question": "Are AnythingLLM and PrivateGPT open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 38 against 32", "Maintenance \u0026 community, 78 against 41" ], "also": null, "goodFor": "A person or a small team who wants document chat and agents on their own machine or server, with a local model, and an API that OpenAI clients can call.", "slug": "anythingllm", "watchFor": "One kind of API key, admin-equivalent across every endpoint, with no scopes or expiry, stored in plain text" }, { "aheadOn": [ "Schema \u0026 documentation, 83 against 57", "Agent ergonomics, 64 against 46" ], "also": [ "No key needed to call it" ], "goodFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "slug": "privategpt", "watchFor": "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin" } ], "history": { "anythingllm": [ { "causes": [ "security", "correction" ], "date": "2026-11-04", "delta": -11.4, "from": 53.5, "fromGrade": "D", "to": 42.1, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 53.3, "fromGrade": "D", "to": 53.5, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 53.6, "fromGrade": "D", "to": 53.3, "toGrade": "D" } ], "privategpt": null }, "job": { "capability": "inference.local", "name": "Local inference" }, "others": [ { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-berth.json", "title": "AnythingLLM vs Berth", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-berth" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-bitrun.json", "title": "AnythingLLM vs BitRun", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-bitrun" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-docker-model-runner.json", "title": "AnythingLLM vs Docker Model Runner", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-docker-model-runner" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-foundry-local.json", "title": "AnythingLLM vs Foundry Local", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-foundry-local" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-ghost-core.json", "title": "AnythingLLM vs Core", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-ghost-core" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-gpt4all.json", "title": "AnythingLLM vs GPT4All", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-gpt4all" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-hyperqwen.json", "title": "AnythingLLM vs HyperQwen", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-hyperqwen" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-jan.json", "title": "AnythingLLM vs Jan", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-jan" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-khoj.json", "title": "AnythingLLM vs Khoj", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-khoj" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-koboldcpp.json", "title": "AnythingLLM vs KoboldCpp", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-koboldcpp" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-lemonade.json", "title": "AnythingLLM vs Lemonade", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-lemonade" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-llama-cpp.json", "title": "AnythingLLM vs llama.cpp", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-llama-cpp" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-lm-studio.json", "title": "AnythingLLM vs LM Studio", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-lm-studio" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-localai.json", "title": "AnythingLLM vs LocalAI", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-localai" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm.json", "title": "AnythingLLM vs MLX LM", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-ollama.json", "title": "AnythingLLM vs Ollama", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-ollama" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.json", "title": "AnythingLLM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-screenpipe.json", "title": "AnythingLLM vs screenpipe", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-text-generation-webui.json", "title": "AnythingLLM vs TextGen", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-vllm.json", "title": "AnythingLLM vs vLLM", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-privategpt.json", "title": "Berth vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/berth-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt.json", "title": "BitRun vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.json", "title": "Docker Model Runner vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.json", "title": "Foundry Local vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.json", "title": "Core vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.json", "title": "GPT4All vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.json", "title": "HyperQwen vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-privategpt.json", "title": "Jan vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/jan-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.json", "title": "KoboldCpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt.json", "title": "Lemonade vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.json", "title": "llama.cpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.json", "title": "LM Studio vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-privategpt.json", "title": "LocalAI vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/localai-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.json", "title": "MLX LM vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-privategpt.json", "title": "Ollama vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ollama-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt.json", "title": "Open WebUI vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.json", "title": "PrivateGPT vs screenpipe", "url": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.json", "title": "PrivateGPT vs TextGen", "url": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-vllm.json", "title": "PrivateGPT vs vLLM", "url": "https://www.anchorterminal.com/compare/privategpt-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-localghost.json", "title": "AnythingLLM vs LocalGhost", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-privategpt.json", "title": "Khoj vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/khoj-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-privategpt.json", "title": "LocalGhost vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/localghost-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-underdog.json", "title": "AnythingLLM vs Underdog", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-underdog" } ], "panel": null, "scores": [ { "anythingllm": 70, "by": 0, "edge": "", "key": "reliability", "name": "Reliability", "privategpt": 70, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "anythingllm": 57, "by": 26, "edge": "privategpt", "key": "schema", "name": "Schema \u0026 documentation", "privategpt": 83, "weight": 13 }, { "anythingllm": 46, "by": 18, "edge": "privategpt", "key": "ergonomics", "name": "Agent ergonomics", "privategpt": 64, "weight": 13 }, { "anythingllm": 38, "by": 6, "edge": "anythingllm", "key": "security", "name": "Security \u0026 auth", "privategpt": 32, "weight": 14 }, { "anythingllm": 60, "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "privategpt": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "anythingllm": 78, "by": 37, "edge": "anythingllm", "key": "maintenance", "name": "Maintenance \u0026 community", "privategpt": 41, "weight": 7 }, { "anythingllm": 62, "by": 2, "edge": "privategpt", "key": "transparency", "name": "Transparency \u0026 trust", "privategpt": 64, "weight": 7 } ], "summary": "PrivateGPT scores 53.2 (D) on agent readiness against AnythingLLM's 42.1 (E), and leads in 3 of 7 scored categories. AnythingLLM leads on security \u0026 auth and maintenance \u0026 community. Both do local inference.", "tasks": null, "tutorials": [], "verdicts": { "anythingllm": "MIT server with desktop builds, Docker images, a 63-operation OpenAPI file and OpenAI-compatible endpoints. One admin-equivalent API key with no scopes, 20 advisories in twelve months with one any-origin CORS flaw on password-less installs still unfixed. Telemetry is on by default.", "privategpt": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt", "json": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.min.md" }, "markdown": "PrivateGPT scores 53.2 (D) on agent readiness against AnythingLLM's 42.1 (E), and leads in 3 of 7 scored categories. AnythingLLM leads on security \u0026 auth and maintenance \u0026 community. Both do local inference.\n\n- AnythingLLM: grade E, 42.1/100, rank #1288 of 1510. Markdown https://www.anchorterminal.com/tools/anythingllm.md · JSON https://www.anchorterminal.com/api/v1/tools/anythingllm.json\n- PrivateGPT: grade D, 53.2/100, rank #960 of 1510. Markdown https://www.anchorterminal.com/tools/privategpt.md · JSON https://www.anchorterminal.com/api/v1/tools/privategpt.json\n- Best local AI models and assistants: https://www.anchorterminal.com/best/local-ai/index.md\n- All 280 local ai comparisons: https://www.anchorterminal.com/compare/local-ai/index.md\n\n## Which one, for what\n\n### AnythingLLM (E)\n\nGood for: A person or a small team who wants document chat and agents on their own machine or server, with a local model, and an API that OpenAI clients can call.\n\nAhead on:\n- Security \u0026 auth, 38 against 32\n- Maintenance \u0026 community, 78 against 41\n\nWatch for: One kind of API key, admin-equivalent across every endpoint, with no scopes or expiry, stored in plain text\n\n### PrivateGPT (D)\n\nGood for: A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.\n\nAhead on:\n- Schema \u0026 documentation, 83 against 57\n- Agent ergonomics, 64 against 46\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin\n\n\n## Why the edge\n\n### Maintenance \u0026 community: AnythingLLM +37\n\n- AnythingLLM (78): v1.19.0 tagged on 25 October 2026, with a dated changelog page (30). v1.16.0 (13 August), v1.16.1 (27 August), v1.16.2 (22 September), v1.17.0 (1 October), v1.18.0 (12 October) and v1.19.0 in the 90 days from 6 August, dates from the tags in a clone (20). Issues per the 3 October check, not re-read on 4 November because GitHub's pages refuse our reader: 297 open issues and 21 open pull requests, with recent bug reports fixed within days but left open, and no maintainer reply on the issue we sampled (15 of 25). No MCP server or official SDK. Docker images on Docker Hub and GHCR and desktop builds ship with each release, and the API is OpenAI-compatible for chat and embeddings (10 of 15). The v1.19.0 Docker image installs Node 18.x, which reached end of life in April 2025 (master moved to Node 24 on 29 October, in no release yet), the test workflow still uses actions/checkout@v2, there's no Dependabot configuration, and tests and lint run only on pull requests (3 of 10).\n- PrivateGPT (41): The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.\n\n### Schema \u0026 documentation: PrivateGPT +26\n\n- AnythingLLM (57): Read with the API lines, scored on the developer API an agent calls. An OpenAPI 3.0 file with 63 operations at v1.19.0 (the meeting-assistant routes v1.19.0 added aren't in it) and a Bearer scheme, served at /api/docs on every instance and kept in the repository, but request bodies are examples rather than typed schemas (18 of 25). No llms.txt at docs.anythingllm.com (404 on 4 November) and no Markdown copies of pages. The docs source is MDX on GitHub (0). Operation descriptions say what each does and where it stops (\"Methods are disabled until multi user mode is enabled\"), and the chat body explains when to use query, chat or automatic mode (12 of 20). Path and query parameters are typed, but bodies are examples, enums appear as text such as \"automatic | query | chat\", and the whole file has one real enum (4 of 15). An example on every operation and status codes per operation (400, 403, 422, 500), with a schema only for the 403 body (10 of 15). Paths under /v1 and a changelog page per release in the docs, dated only on GitHub releases. The spec's own version has stayed 1.0.0 (13 of 15).\n- PrivateGPT (83): An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.\n\n### Agent ergonomics: PrivateGPT +18\n\n- AnythingLLM (46): Read with the tool lines for the developer API. Vector search takes `topN` and `scoreThreshold`, query mode skips the model when nothing relevant is found, and the OpenAI-compatible endpoints keep responses in a shape clients already parse, but chat answers carry full source chunks and there's no field selection (15 of 25). `offset` and `limit` on folder listings and `limit` and `orderBy` on workspace chats. Workspace, document and user lists return everything (10 of 20). Missing or wrong keys get 403 with `{\"error\": \"No valid api key found.\"}`, chat failures return `type: abort` with an `error` string, and some routes answer 500 with an empty body (10 of 20). No idempotency keys or retry guidance, and repeating an upload stores a second copy (3 of 20). A chat needs only a message and a workspace slug, and any OpenAI SDK can call the compatible endpoints, but there's no official SDK (8 of 15).\n- PrivateGPT (64): Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.\n\n### Security \u0026 auth: AnythingLLM +6\n\n- AnythingLLM (38): Developer API keys are one kind, admin-equivalent across every /v1 endpoint by design per SECURITY.md, stored in plain text, with no scopes or expiry. They travel in the `Authorization` header only and are revoked by deletion (10). There's no read-only key. Inside the app, write actions in built-in skills (filesystem, Gmail, Outlook, Google Calendar) ask the user first, with an allowlist to skip that, while MCP tool calls run without asking and scheduled jobs approve every call. Multi-user mode adds admin, manager and default roles for the UI (7 of 20). Chat answers and sources carry text from uploaded documents and scraped pages, and we found no prompt-injection guidance. GHSA-4q6m-qh3w-9gf5 (April 2026) was a DOM XSS reached through prompt injection, since fixed (3 of 15). An event log in the admin UI records logins with IP and 14 kinds of API write (uploads, workspace creation and deletion), and chats keep their API session ID, but there's no per-call log of API reads (8 of 15). SECURITY.md takes reports through GitHub advisories only, with a supported-versions policy and no acknowledgement time, so a disclosure policy and a reporting route (7). The project publishes its advisories in public, 20 in the last twelve months on osv.dev, one still unfixed. No security.txt (404), no bug bounty, no SOC 2 or ISO 27001. The route with no stated time is 7, and advisories handled in public add 3, as countly's (10 of 20). 10 + 7 + 3 + 8 + 10 = 38.\n- PrivateGPT (32): Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.\n\n## Score by category\n\n| Category | Weight | AnythingLLM | PrivateGPT | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 70 | 70 | even |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 57 | 83 | PrivateGPT +26 |\n| Agent ergonomics | 13% (16.2 this run) | 46 | 64 | PrivateGPT +18 |\n| Security \u0026 auth | 14% (17.5 this run) | 38 | 32 | AnythingLLM +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 78 | 41 | AnythingLLM +37 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 62 | 64 | PrivateGPT +2 |\n| Negative events | ≤15 | -15 | -7 | |\n| **Total** | | **42.1 · E** | **53.2 · D** | |\n\n## Facts side by side\n\n| Fact | AnythingLLM | PrivateGPT |\n| --- | --- | --- |\n| Kind | Platform | HTTP API |\n| Vendor | Mintplex Labs | Zylon (PriBAI Technology Spain S.L.) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | API key | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | MIT (server, document collector, frontend and Docker image). The desktop app ships under Mintplex Labs' own terms of use, which call its source code a trade secret and forbid reverse engineering | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-25 | 2026-06-18 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | no document linked |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 67k stars | 58k stars |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### AnythingLLM\n\n- -11.4 on 4 November 2026 (D to E): security, correction\n- +0.2 on 27 October 2026: checklist\n- -0.3 on 8 October 2026: checklist\n\n### PrivateGPT\n\nNo score change since it was listed.\n\n## Verdicts\n\n**AnythingLLM.** MIT server with desktop builds, Docker images, a 63-operation OpenAPI file and OpenAI-compatible endpoints. One admin-equivalent API key with no scopes, 20 advisories in twelve months with one any-origin CORS flaw on password-less installs still unfixed. Telemetry is on by default.\n\n**PrivateGPT.** PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.\n\n## Before you call either\n\n### AnythingLLM\n\n1. Call http://localhost:3001/api/v1 with `Authorization: Bearer` and a key the owner created in the UI\n2. Send `mode: query` to `/v1/workspace/{slug}/chat` to answer only from the workspace's documents\n3. Treat the key as admin. It can delete workspaces, users and documents\n4. Read /api/docs on the instance for the endpoint list. Request bodies there are examples, not schemas\n5. Pass a `sessionId` with each chat to keep your conversation apart from other API callers\n\n### PrivateGPT\n\n1. Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller\n2. Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`\n3. Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`\n4. Pass ingested documents through `tool_context` to get answers with citations\n5. Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling\n\n## Questions\n\n### Which is better for AI agents, AnythingLLM or PrivateGPT?\n\nPrivateGPT scores 53.2 (D) on agent readiness against AnythingLLM's 42.1 (E), and leads in 3 of 7 scored categories. AnythingLLM leads on security \u0026 auth and maintenance \u0026 community.\n\n### Can an agent call AnythingLLM and PrivateGPT without installing anything?\n\nNo hosted endpoint is listed for AnythingLLM. No hosted endpoint is listed for PrivateGPT.\n\n### Are AnythingLLM and PrivateGPT open source?\n\nYes. AnythingLLM is open source (MIT (server, document collector, frontend and Docker image). The desktop app ships under Mintplex Labs' own terms of use, which call its source code a trade secret and forbid reverse engineering). PrivateGPT is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.json, and with the fewest tokens: https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"anythingllm\", \"b\": \"privategpt\"}`. From a terminal: `anchor compare anythingllm privategpt`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/anythingllm.json and https://www.anchorterminal.com/api/v1/tools/privategpt.json\n\n## Other comparisons with AnythingLLM or PrivateGPT\n\n- [AnythingLLM vs Berth](https://www.anchorterminal.com/compare/anythingllm-vs-berth.md)\n- [AnythingLLM vs BitRun](https://www.anchorterminal.com/compare/anythingllm-vs-bitrun.md)\n- [AnythingLLM vs Docker Model Runner](https://www.anchorterminal.com/compare/anythingllm-vs-docker-model-runner.md)\n- [AnythingLLM vs Foundry Local](https://www.anchorterminal.com/compare/anythingllm-vs-foundry-local.md)\n- [AnythingLLM vs Core](https://www.anchorterminal.com/compare/anythingllm-vs-ghost-core.md)\n- [AnythingLLM vs GPT4All](https://www.anchorterminal.com/compare/anythingllm-vs-gpt4all.md)\n- [AnythingLLM vs HyperQwen](https://www.anchorterminal.com/compare/anythingllm-vs-hyperqwen.md)\n- [AnythingLLM vs Jan](https://www.anchorterminal.com/compare/anythingllm-vs-jan.md)\n- [AnythingLLM vs Khoj](https://www.anchorterminal.com/compare/anythingllm-vs-khoj.md)\n- [AnythingLLM vs KoboldCpp](https://www.anchorterminal.com/compare/anythingllm-vs-koboldcpp.md)\n- [AnythingLLM vs Lemonade](https://www.anchorterminal.com/compare/anythingllm-vs-lemonade.md)\n- [AnythingLLM vs llama.cpp](https://www.anchorterminal.com/compare/anythingllm-vs-llama-cpp.md)\n- [AnythingLLM vs LM Studio](https://www.anchorterminal.com/compare/anythingllm-vs-lm-studio.md)\n- [AnythingLLM vs LocalAI](https://www.anchorterminal.com/compare/anythingllm-vs-localai.md)\n- [AnythingLLM vs MLX LM](https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm.md)\n- [AnythingLLM vs Ollama](https://www.anchorterminal.com/compare/anythingllm-vs-ollama.md)\n- [AnythingLLM vs Open WebUI](https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.md)\n- [AnythingLLM vs screenpipe](https://www.anchorterminal.com/compare/anythingllm-vs-screenpipe.md)\n- [AnythingLLM vs TextGen](https://www.anchorterminal.com/compare/anythingllm-vs-text-generation-webui.md)\n- [AnythingLLM vs vLLM](https://www.anchorterminal.com/compare/anythingllm-vs-vllm.md)\n- [Berth vs PrivateGPT](https://www.anchorterminal.com/compare/berth-vs-privategpt.md)\n- [BitRun vs PrivateGPT](https://www.anchorterminal.com/compare/bitrun-vs-privategpt.md)\n- [Docker Model Runner vs PrivateGPT](https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.md)\n- [Foundry Local vs PrivateGPT](https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.md)\n- [Core vs PrivateGPT](https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.md)\n- [GPT4All vs PrivateGPT](https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.md)\n- [HyperQwen vs PrivateGPT](https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.md)\n- [Jan vs PrivateGPT](https://www.anchorterminal.com/compare/jan-vs-privategpt.md)\n- [KoboldCpp vs PrivateGPT](https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.md)\n- [Lemonade vs PrivateGPT](https://www.anchorterminal.com/compare/lemonade-vs-privategpt.md)\n- [llama.cpp vs PrivateGPT](https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.md)\n- [LM Studio vs PrivateGPT](https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.md)\n- [LocalAI vs PrivateGPT](https://www.anchorterminal.com/compare/localai-vs-privategpt.md)\n- [MLX LM vs PrivateGPT](https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.md)\n- [Ollama vs PrivateGPT](https://www.anchorterminal.com/compare/ollama-vs-privategpt.md)\n- [Open WebUI vs PrivateGPT](https://www.anchorterminal.com/compare/open-webui-vs-privategpt.md)\n- [PrivateGPT vs screenpipe](https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.md)\n- [PrivateGPT vs TextGen](https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.md)\n- [PrivateGPT vs vLLM](https://www.anchorterminal.com/compare/privategpt-vs-vllm.md)\n- [AnythingLLM vs LocalGhost](https://www.anchorterminal.com/compare/anythingllm-vs-localghost.md)\n- [Khoj vs PrivateGPT](https://www.anchorterminal.com/compare/khoj-vs-privategpt.md)\n- [LocalGhost vs PrivateGPT](https://www.anchorterminal.com/compare/localghost-vs-privategpt.md)\n- [AnythingLLM vs Underdog](https://www.anchorterminal.com/compare/anythingllm-vs-underdog.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AnythingLLM vs PrivateGPT", "url": "" } ], "description": "PrivateGPT scores 53.2 (D) to AnythingLLM's 42.1 (E) for local inference. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AnythingLLM E 42.1", "PrivateGPT D 53.2", "scores" ], "h1": "AnythingLLM vs PrivateGPT", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/anythingllm-vs-privategpt", "published": "2026-10-01", "section": "tools", "title": "AnythingLLM vs PrivateGPT for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt" }, "tokens": { "markdown": 5050, "slim": 2680 }, "version": 1 }