{ "data": { "a": { "slug": "berth", "name": "Berth", "vendor": "Trevin Tindall (T-Crypt on GitHub)", "vendorUrl": "https://github.com/T-Crypt", "kind": "http-api", "category": "local-ai", "summary": "Berth is an open-source Go daemon and CLI that leases one GPU to local inference engines, image pipelines and games in turn, with a priority queue, measured VRAM handoffs and a preview OpenAI-compatible gateway on loopback.", "url": "https://www.anchorterminal.com/tools/berth", "markdownUrl": "https://www.anchorterminal.com/tools/berth.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/berth.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/berth.json", "repo": "https://github.com/T-Crypt/berth", "license": "Apache-2.0. The Berth name, the Pilot mascot and the artwork in assets/ are excluded from the licence, per the NOTICE file", "transports": [ "http" ], "packages": [ { "registry": "go", "name": "github.com/T-Crypt/berth" } ], "auth": "api-key", "authNotes": "The gateway (`berth gateway`, 127.0.0.1:9799) takes one bearer key on every API route. The key is created on first use in `~/.config/berth/api.key` with mode 600, a group- or world-readable file is refused, `berth key` prints it, and the comparison is constant-time. The gateway binds loopback only, refuses non-loopback Host names and any request with a browser Origin. The key has no scopes and no documented rotation command. The daemon itself answers on a Unix socket with mode 600 in a 700 directory, so only the owning user can lease the card. The harbor web UI (127.0.0.1:9798) is read-only with no login, and its actions need a device paired with `berth pair`. The wake page and the optional `--comfyui-listen` port take no key by design.", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with nothing to buy and no account. No hosted service.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs or the changelog (checked 2026-10-28). Nothing is sold.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 245, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-28" }, "docsUrl": "https://t-crypt.github.io/berth/", "capabilities": [ "inference.local", "compute.gpu" ], "tags": [ "open-source", "local", "self-hosted", "free", "no-card", "apache-2.0", "openai-compatible", "go", "cli", "linux", "windows", "gpu", "agent-skill", "alpha", "pre-1.0", "new" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 67.6, "grade": "B", "agentReady": false, "rank": 283, "ranked": true, "rankOf": 1218, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 76, "payments": 60, "reliability": 76, "schema": 69, "security": 51, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-28" }, "negative": 0, "verdict": "Berth coordinates one NVIDIA card between engines, ComfyUI and games, grants a lease only after the driver shows memory free, and gives agents a skill, JSON output and a keyed loopback gateway. It is 17 days old, alpha and maintained by one developer, with Windows and AMD experimental and no machine-readable API spec.", "bestFor": "Someone running several GPU programs (llama.cpp, llama-swap, Ollama, vLLM, ComfyUI, games) on one NVIDIA card who wants them to take turns, and agents that need to ask for the card.", "strengths": [ "A lease is granted only after the driver shows the previous holder's memory free, and processes it did not start are reported, never killed", "Every reporting command takes `--format json|yaml`, with results on stdout and exit codes 0, 1, 2 and 75 by one documented rule", "Gateway failures return 503 with Retry-After and a machine code such as `outranked`, `engine_oom` or `no_headroom`", "CI builds, vets, lints and tests on Linux and Windows, and releases publish SHA256SUMS that `berth update` checks", "Apache-2.0, no account and no telemetry upload, with the one GitHub update check documented and switchable off" ], "weaknesses": [ "First released on 11 October 2026 and called alpha. Windows, AMD and multiple GPUs are experimental, and the gateway is a preview", "One bearer key with no scopes or documented rotation controls every gateway route, including switch and stop", "No OpenAPI file or llms.txt. The gateway's own routes are documented in Markdown with curl examples", "No SECURITY.md, security.txt or disclosure route, and the harbor has no login when bound past loopback", "Linux and NVIDIA only for full support, through nvidia-smi. Intel and Apple GPUs are not supported" ], "agentNotes": [ "Run `berth status --format json` before starting, stopping or switching any GPU engine. If berthd is unreachable, no engine is protected", "Never kill a process to free VRAM. Ask for the card with `berth run`, `berth hold` or a gateway request, and report stowaways to the user", "Send gateway requests to http://127.0.0.1:9799/v1 with `Authorization: Bearer $(berth key)`, and use `\"stream\": true` for cold starts of up to minutes", "On a 503, read the `code` and wait for `Retry-After`. A pinned holder (a game or `berth hold`) answers 409 to stop and is the user's call", "Ask the user before `berth reclaim LEASE --yes`, any berth.toml edit or `berth update`. Each changes the node" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.6 } ], "editorialScores": { "ergonomics": 75, "maintenance": 76, "payments": 60, "reliability": 76, "schema": 69, "security": 51, "transparency": 74 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-10-28", "maintenance": "2026-10-28", "payments": "2026-10-28", "reliability": "2026-10-28", "schema": "2026-10-28", "security": "2026-10-28", "transparency": "2026-10-28" }, "last": "2026-10-28", "oldest": "2026-10-28", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "go install github.com/T-Crypt/berth/cmd/berth@latest # or a release binary checked against SHA256SUMS\nberth service install --harbor\nberth status\nberth run --as llama --priority foreground -- llama-server -m model.gguf --port 8080", "http": "curl -s http://127.0.0.1:9799/v1/berth/board -H \"Authorization: Bearer $(berth key)\"", "claudeCode": "berth skill install # writes the Berth and ComfyUI skills, including to ~/.claude/skills" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/berth" }, "area": "models", "provenance": { "legalEntity": "Trevin Tindall (T-Crypt on GitHub)", "domain": "", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/T-Crypt/berth/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-28", "notes": [ "The project has no website of its own. The docs are an MkDocs site at https://t-crypt.github.io/berth/. The NOTICE and README name Trevin Tindall (T-Crypt) as the creator and maintainer, and the licence is Apache-2.0.", "No terms, privacy policy, SECURITY.md or security.txt. The changelog has a Security heading for v0.3.4.", "The software runs on the owner's machine, so there is no vendor endpoint or status page to check.", "T-Crypt/berth is the original. jenerestain/berth, sefator/berth and Bacongineer/berth-upstream keep its module path, copyright and links, and are forks of earlier snapshots." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/berth.json" }, "answer": "Berth scores 67.6 (B) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "open-webui", "name": "Open WebUI", "vendor": "Open WebUI Inc.", "vendorUrl": "https://openwebui.com", "kind": "platform", "category": "local-ai", "summary": "Self-hosted web interface for chatting with models, from Open WebUI Inc., with a Python (FastAPI) back end and a Svelte front end.", "url": "https://www.anchorterminal.com/tools/open-webui", "markdownUrl": "https://www.anchorterminal.com/tools/open-webui.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/open-webui.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/open-webui.json", "repo": "https://github.com/open-webui/open-webui", "license": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "open-webui" }, { "registry": "oci", "name": "ghcr.io/open-webui/open-webui" } ], "auth": "api-key", "authNotes": "Sign-in is on by default (`WEBUI_AUTH`), the first account to sign up becomes admin, and sign-up then closes. An agent calls the API with `Authorization: Bearer \u003ctoken\u003e`, either an `sk-` API key from Settings \u003e Account or a session JWT, which lasts four weeks by default (`JWT_EXPIRES_IN`), and behind a reverse proxy that uses `Authorization` itself the key can go in an `x-api-key` header (https://docs.openwebui.com/reference/api-endpoints). API keys stay off until an administrator turns them on (`ENABLE_API_KEYS` defaults to false), a group permission decides who may create one, and they can be limited instance-wide to listed endpoints with `ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS` and `API_KEYS_ALLOWED_ENDPOINTS` (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/config.py). Each user has one key, `sk-` plus 32 hexadecimal characters, stored as plain text with a last-used time and no expiry set by the API (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py). People sign in with email and password, OAuth or OIDC, LDAP or trusted headers, with SCIM 2.0 provisioning.", "pricing": "free", "pricingNotes": "Free to self-host under the Open WebUI License. Deployments with more than 50 end users in a rolling 30 days have to keep the Open WebUI branding unless they hold an enterprise licence or written permission. The enterprise licence (white-labelling, SLA-backed support, Terminals) is sold through sales to registered organisations only, with no published prices (https://docs.openwebui.com/enterprise). There's no hosted Open WebUI service. You pay your model provider, or nothing with a local model (checked 2026-10-03).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 153000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://docs.openwebui.com", "llmsTxt": "https://docs.openwebui.com/llms.txt", "capabilities": [ "inference.local", "agent.mcp-client", "memory.user", "knowledge.search" ], "tags": [ "self-hosted", "local", "free", "python", "docker", "openai-compatible", "llms-txt", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 52, "grade": "D", "agentReady": false, "rank": 879, "ranked": true, "rankOf": 1218, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -8, "negativeNotes": [ "2026-05-05. GHSA-2r4p-jpmg-48f4 (CVE-2026-44551, Critical, 9.1). LDAP sign-in accepted an empty password where the directory allows unauthenticated binds, giving full access to the victim's account. It affects 0.8.12 and earlier and was fixed in 0.9.0 (21 April 2026) before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4", "2026-07-02. GHSA-74h3-cxq7-vc5q (CVE-2026-59216, 7.7). A signed-in low-privilege user could run code and tools in another user's session through an unchecked Socket.IO session_id, which against an administrator meant code execution as the server process (root in default containers). Fixed in 0.10.0 on 29 June 2026 and published three days later, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q", "2026-08-02 and 2026-09-04. Two account takeovers through OAuth, both High. GHSA-rq84-p6rr-vf89 accepted tokens issued to any client in the OAuth token exchange (fixed in 0.11.0), and GHSA-wpmr-8h3q-fwj7 (8.1) matched OAuth and OIDC subjects by substring on SQLite, so a crafted subject could sign in as an existing account, administrators included (fixed in 0.11.1 on 25 August). Both fixed before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-rq84-p6rr-vf89; https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "2025-10-03 to 2026-10-03. The rest of the year's record. GitHub reviewed 143 of the repository's advisories in the 12 months to 3 October 2026, and 129 cover flaws fixed in releases from 0.6.35 (6 November 2025) on, 58 High and 1 Critical, more than half of them access-control or authorisation flaws by their titles and CWE tags. July to September alone brought 52 (18 High, 29 Moderate, 5 Low) in batches published on 2 July, 2 August and 4 September. Each was fixed in a release before publication, so the 125 beyond the four above count together, -2. https://github.com/open-webui/open-webui/security/advisories; https://github.com/advisories?query=open-webui+type%3Areviewed+ecosystem%3Apip" ], "verdict": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.", "bestFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations", "OpenAI-compatible `/api/chat/completions` and `/api/models`, plus an Anthropic Messages route and an Ollama proxy, so OpenAI's SDKs work against a local instance", "Roles, groups, per-model and per-knowledge access grants, a group permission for key creation and an instance-wide endpoint allowlist for keys", "An audit log at metadata, request or request-and-response level, plus events for key creation and deletion", "No product telemetry found, third-party analytics off in the Docker image, and `OFFLINE_MODE` to stop the release check and model downloads" ], "weaknesses": [ "API keys are off by default, and each user gets one key with no scopes or expiry", "The API reference covers seven route groups, and the OpenAPI file and Swagger UI need `ENV=dev`", "52 advisories published from July to September 2026, 18 of them High, including cross-user code execution (CVE-2026-59216) and two OAuth account takeovers, all fixed", "Pre-1.0 (0.11), with database migrations in patch releases and no rolling updates during them", "The branding clause makes the licence non-OSI, and the enterprise licence has no published price" ], "agentNotes": [ "Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then", "Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself", "Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections", "Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base", "Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52 } ], "editorialScores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 66 }, "provenanceScore": 80, "checked": { "categories": { "ergonomics": "2026-10-03", "maintenance": "2026-10-03", "payments": "2026-10-03", "reliability": "2026-10-03", "schema": "2026-10-03", "security": "2026-10-03", "transparency": "2026-10-03" }, "last": "2026-10-03", "lastMoved": "2026-10-27", "oldest": "2026-10-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install open-webui \u0026\u0026 open-webui serve # or: docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main", "http": "curl -X POST http://localhost:3000/api/chat/completions \\\n -H \"Authorization: Bearer $OPEN_WEBUI_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"llama3.1\", \"messages\": [{\"role\": \"user\", \"content\": \"Why is the sky blue?\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/open-webui" }, "area": "models", "provenance": { "legalEntity": "Open WebUI Inc.", "domain": "openwebui.com", "domainRegistered": "2024-02-17", "endpointOnVendorDomain": null, "terms": "https://openwebui.com/terms", "privacy": "https://openwebui.com/privacy", "statusPage": "", "changelog": "https://github.com/open-webui/open-webui/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-03", "notes": [ "The LICENSE copyright line names Open WebUI Inc., created by Timothy Jaeryang Baek, and the privacy policy names Open WebUI, Inc. with no address.", "openwebui.com/.well-known/security.txt points to GitHub Security Advisories and expires on 2027-06-30.", "The privacy policy, last updated on 31 December 2025, covers openwebui.com and its community services only, says nothing about the self-hosted software, and gives no retention periods.", "We found no status page linked from openwebui.com. There's no hosted service, so an instance answers on its owner's own host.", "RDAP for openwebui.com gives a registration date of 2024-02-17, registrar Cloudflare. The terms page wasn't read for this check." ], "score": 80 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/open-webui.json", "live": { "slug": "open-webui", "versions": [ { "registry": "github", "name": "open-webui/open-webui", "version": "v0.12.4", "released": "2026-10-25", "seenAt": "2026-10-27T11:20:05.489347407Z" }, { "registry": "pypi", "name": "open-webui", "version": "0.12.4", "released": "2026-10-25", "seenAt": "2026-10-27T11:20:05.301499081Z" } ], "githubStars": 156909, "pypiWeekly": 109585, "securityTxt": { "url": "https://openwebui.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T00:00:00Z", "checkedAt": "2026-10-27T15:31:27.569083001Z" }, "llmsTxt": { "url": "https://docs.openwebui.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-27T14:58:46.17132131Z" }, "domain": { "domain": "openwebui.com", "registered": "2024-02-17", "source": "https://rdap.verisign.com/com/v1/domain/openwebui.com", "checkedAt": "2026-10-25T13:46:27.685354873Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/open-webui/open-webui/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-27T03:55:29.605408133Z", "changedAt": "2026-10-26T03:25:31.910282305Z", "fingerprint": "64b0b9ee7bee" }, { "url": "https://openwebui.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-27T03:51:08.267987373Z", "changedAt": "2026-10-27T03:51:08.267987373Z", "fingerprint": "6d4dc4c2ffaf" }, { "url": "https://openwebui.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-27T03:51:11.240540458Z", "changedAt": "2026-10-27T03:51:11.240540458Z", "fingerprint": "dd115f79721c" } ], "github": { "repo": "open-webui/open-webui", "checkedAt": "2026-10-26T07:52:02.505854492Z", "stars": 156776, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-26T07:09:27Z", "openIssues": 177, "openPRs": 19, "issuesOpened90d": 1554, "issuesClosed90d": 1586, "prsMerged90d": 1178, "ci": { "branch": "main", "runs": 50, "success": 43, "failure": 6, "other": 1, "latest": "success", "latestAt": "2026-10-25T08:09:40Z" }, "advisories": [ { "ghsa": "GHSA-3vvh-g22g-jq6r", "severity": "medium", "published": "2026-10-18T19:50:50Z" }, { "ghsa": "GHSA-q46m-r89w-j74p", "severity": "high", "published": "2026-09-28T16:36:41Z" }, { "ghsa": "GHSA-gqfh-jxvw-74rp", "severity": "medium", "published": "2026-09-27T19:55:15Z" }, { "ghsa": "GHSA-whgc-vpjx-m3qh", "severity": "medium", "published": "2026-09-27T19:53:56Z" }, { "ghsa": "GHSA-wf9m-46cp-c6h6", "severity": "medium", "published": "2026-09-27T19:51:36Z" }, { "ghsa": "GHSA-w8j8-jv6j-3m47", "severity": "medium", "published": "2026-09-27T19:49:07Z" }, { "ghsa": "GHSA-vpq8-f445-hcq7", "severity": "high", "published": "2026-09-27T19:47:06Z" }, { "ghsa": "GHSA-qpqv-xwg8-cqpj", "severity": "high", "published": "2026-09-27T19:45:25Z" }, { "ghsa": "GHSA-jx3w-3pqq-7f3w", "severity": "medium", "published": "2026-09-27T19:34:53Z" }, { "ghsa": "GHSA-hm62-64q2-6gxw", "severity": "medium", "published": "2026-09-27T19:33:41Z" }, { "ghsa": "GHSA-gww9-mhgj-pfqh", "severity": "medium", "published": "2026-09-27T19:32:16Z" }, { "ghsa": "GHSA-gfjp-5hc9-852r", "severity": "medium", "published": "2026-09-27T19:30:44Z" }, { "ghsa": "GHSA-f9xp-mfmq-x6cg", "severity": "high", "published": "2026-09-27T19:29:00Z" }, { "ghsa": "GHSA-9wj4-mcm3-ppj6", "severity": "medium", "published": "2026-09-27T19:27:08Z" }, { "ghsa": "GHSA-9cxp-636w-4997", "severity": "medium", "published": "2026-09-27T19:25:50Z" }, { "ghsa": "GHSA-6g45-8g27-fh8q", "severity": "medium", "published": "2026-09-27T19:22:59Z" }, { "ghsa": "GHSA-6fjc-5cg3-mgvh", "severity": "medium", "published": "2026-09-27T16:42:03Z" }, { "ghsa": "GHSA-5w58-mwmh-vf2m", "severity": "medium", "published": "2026-09-27T16:31:36Z" }, { "ghsa": "GHSA-2rr4-q6pg-m5g3", "severity": "medium", "published": "2026-09-27T16:14:42Z" }, { "ghsa": "GHSA-2h26-836q-4jh2", "severity": "medium", "published": "2026-09-27T15:58:57Z" }, { "ghsa": "GHSA-wvm9-9g5j-623f", "cve": "CVE-2026-88006", "severity": "medium", "published": "2026-09-09T21:59:45Z" }, { "ghsa": "GHSA-3g9q-v48f-hh9w", "cve": "CVE-2026-87011", "severity": "high", "published": "2026-09-04T12:08:59Z" }, { "ghsa": "GHSA-v39v-59xw-j98g", "cve": "CVE-2026-87012", "severity": "medium", "published": "2026-09-04T12:05:52Z" }, { "ghsa": "GHSA-8r35-5x5r-hv74", "cve": "CVE-2026-87013", "severity": "medium", "published": "2026-09-04T11:49:34Z" }, { "ghsa": "GHSA-wjwr-xfp9-r66p", "cve": "CVE-2026-87014", "severity": "medium", "published": "2026-09-04T11:48:27Z" }, { "ghsa": "GHSA-p78m-89r6-pgf7", "cve": "CVE-2026-87015", "severity": "medium", "published": "2026-09-04T11:47:12Z" }, { "ghsa": "GHSA-wpmr-8h3q-fwj7", "cve": "CVE-2026-87016", "severity": "high", "published": "2026-09-04T11:43:51Z" }, { "ghsa": "GHSA-pcvc-8vrv-8q6w", "cve": "CVE-2026-87017", "severity": "medium", "published": "2026-08-31T16:13:50Z" }, { "ghsa": "GHSA-fmqh-xp37-5hr8", "cve": "CVE-2026-87994", "severity": "medium", "published": "2026-08-31T15:48:12Z" }, { "ghsa": "GHSA-jmc6-2wr8-h3wj", "cve": "CVE-2026-87995", "severity": "high", "published": "2026-08-31T15:43:57Z" }, { "ghsa": "GHSA-4v28-j6q3-5m4r", "cve": "CVE-2026-87996", "severity": "high", "published": "2026-08-31T15:42:38Z" }, { "ghsa": "GHSA-3pf7-q2g3-wj28", "cve": "CVE-2026-87997", "severity": "medium", "published": "2026-08-30T17:00:13Z" }, { "ghsa": "GHSA-2724-6cpj-gf3v", "cve": "CVE-2026-87998", "severity": "high", "published": "2026-08-30T16:54:04Z" }, { "ghsa": "GHSA-34r3-9m95-vq73", "cve": "CVE-2026-87999", "severity": "high", "published": "2026-08-30T16:48:07Z" }, { "ghsa": "GHSA-3cgp-3cqx-j8w2", "cve": "CVE-2026-88000", "severity": "medium", "published": "2026-08-29T11:52:10Z" }, { "ghsa": "GHSA-5x7x-4c3c-qf5w", "cve": "CVE-2026-88001", "severity": "medium", "published": "2026-08-29T11:49:13Z" }, { "ghsa": "GHSA-jqhh-cjmq-vmv6", "cve": "CVE-2026-88002", "severity": "medium", "published": "2026-08-29T10:57:26Z" }, { "ghsa": "GHSA-4qg5-cxx4-g927", "cve": "CVE-2026-88005", "severity": "medium", "published": "2026-08-29T10:45:07Z" }, { "ghsa": "GHSA-8x5v-cpv7-8jjp", "cve": "CVE-2026-70485", "severity": "high", "published": "2026-08-02T23:12:13Z" }, { "ghsa": "GHSA-3vf6-64vr-3g56", "cve": "CVE-2026-70483", "severity": "low", "published": "2026-08-02T23:10:05Z" }, { "ghsa": "GHSA-pwxh-7358-jq2x", "cve": "CVE-2026-70492", "severity": "high", "published": "2026-08-02T23:08:30Z" }, { "ghsa": "GHSA-6xhv-rxhv-pwm4", "cve": "CVE-2026-70487", "severity": "medium", "published": "2026-08-02T23:07:17Z" }, { "ghsa": "GHSA-jxc9-xmc4-gr23", "cve": "CVE-2026-70488", "severity": "medium", "published": "2026-08-02T23:05:27Z" }, { "ghsa": "GHSA-5gpj-vj23-vhhv", "cve": "CVE-2026-70490", "severity": "medium", "published": "2026-08-02T23:04:23Z" }, { "ghsa": "GHSA-g423-grf7-98rv", "cve": "CVE-2026-70484", "severity": "medium", "published": "2026-08-02T22:58:19Z" }, { "ghsa": "GHSA-rffm-9q57-q649", "cve": "CVE-2026-70480", "severity": "medium", "published": "2026-08-02T22:54:08Z" }, { "ghsa": "GHSA-3r7g-q6cg-q2vx", "cve": "CVE-2026-70491", "severity": "medium", "published": "2026-08-02T22:47:08Z" }, { "ghsa": "GHSA-3xpf-xq7r-v8c5", "cve": "CVE-2026-70486", "severity": "high", "published": "2026-08-02T22:30:32Z" }, { "ghsa": "GHSA-2f54-p244-32q6", "cve": "CVE-2026-70493", "severity": "medium", "published": "2026-08-02T22:28:14Z" }, { "ghsa": "GHSA-73cq-mcgh-379c", "cve": "CVE-2026-70489", "severity": "medium", "published": "2026-08-02T22:08:09Z" }, { "ghsa": "GHSA-mj5r-jf49-m3w7", "cve": "CVE-2026-70481", "severity": "medium", "published": "2026-08-02T21:40:08Z" }, { "ghsa": "GHSA-w2rx-84hp-gg95", "cve": "CVE-2026-70479", "severity": "high", "published": "2026-08-02T21:36:36Z" }, { "ghsa": "GHSA-3cg5-48j3-v4gv", "cve": "CVE-2026-70494", "severity": "high", "published": "2026-08-02T21:21:29Z" }, { "ghsa": "GHSA-rq84-p6rr-vf89", "cve": "CVE-2026-70482", "severity": "high", "published": "2026-08-02T21:03:25Z" }, { "ghsa": "GHSA-frvj-c5qp-xj4w", "cve": "CVE-2026-59221", "severity": "high", "published": "2026-07-02T19:47:03Z" }, { "ghsa": "GHSA-m3qf-58wf-w979", "cve": "CVE-2026-59225", "severity": "medium", "published": "2026-07-02T16:33:50Z" }, { "ghsa": "GHSA-2xwm-4h2q-ggfx", "cve": "CVE-2026-59212", "severity": "medium", "published": "2026-07-02T15:58:11Z" }, { "ghsa": "GHSA-j657-m4c4-24jq", "cve": "CVE-2026-59224", "severity": "high", "published": "2026-07-02T15:10:12Z" }, { "ghsa": "GHSA-qg3f-8x3j-ggf2", "cve": "CVE-2026-59223", "severity": "medium", "published": "2026-07-02T14:56:49Z" }, { "ghsa": "GHSA-gh7p-78x6-jw6m", "cve": "CVE-2026-59222", "severity": "medium", "published": "2026-07-02T14:53:06Z" }, { "ghsa": "GHSA-73x5-h92w-xc2j", "cve": "CVE-2026-59215", "severity": "low", "published": "2026-07-02T14:45:45Z" }, { "ghsa": "GHSA-3wp3-xxj9-5jqq", "cve": "CVE-2026-59213", "severity": "low", "published": "2026-07-02T13:58:12Z" }, { "ghsa": "GHSA-7r7x-gjvr-448g", "cve": "CVE-2026-59217", "severity": "medium", "published": "2026-07-02T13:39:00Z" }, { "ghsa": "GHSA-74h3-cxq7-vc5q", "cve": "CVE-2026-59216", "severity": "high", "published": "2026-07-02T13:20:56Z" }, { "ghsa": "GHSA-x2ff-v5v8-m75m", "cve": "CVE-2026-59714", "severity": "high", "published": "2026-07-02T12:52:22Z" }, { "ghsa": "GHSA-855v-hq7w-jmjw", "cve": "CVE-2026-59219", "severity": "high", "published": "2026-07-02T12:41:09Z" }, { "ghsa": "GHSA-rqj7-6wrp-6g2g", "cve": "CVE-2026-59227", "severity": "medium", "published": "2026-06-29T23:29:25Z" }, { "ghsa": "GHSA-ffpj-xv5c-p3gw", "cve": "CVE-2026-59220", "severity": "medium", "published": "2026-06-29T23:25:59Z" }, { "ghsa": "GHSA-mvx4-532p-xfm9", "cve": "CVE-2026-59226", "severity": "low", "published": "2026-06-29T23:19:39Z" }, { "ghsa": "GHSA-9rpj-v7hf-vv2w", "cve": "CVE-2026-54021", "severity": "medium", "published": "2026-06-11T19:13:54Z" }, { "ghsa": "GHSA-p5cp-r7rg-qpxc", "cve": "CVE-2026-54019", "severity": "medium", "published": "2026-06-11T19:09:52Z" }, { "ghsa": "GHSA-cx9v-4qj2-jrw6", "cve": "CVE-2026-54016", "severity": "medium", "published": "2026-06-11T19:06:16Z" }, { "ghsa": "GHSA-4r4w-2wgp-w7cj", "cve": "CVE-2026-54015", "severity": "medium", "published": "2026-06-11T19:05:34Z" }, { "ghsa": "GHSA-j2c8-v969-8r5c", "cve": "CVE-2026-54014", "severity": "medium", "published": "2026-06-11T19:04:46Z" }, { "ghsa": "GHSA-v2qm-5wxj-qhj7", "cve": "CVE-2026-54013", "severity": "high", "published": "2026-06-11T19:02:12Z" }, { "ghsa": "GHSA-vjqm-6gcc-62cr", "cve": "CVE-2026-54012", "severity": "high", "published": "2026-06-11T18:58:16Z" }, { "ghsa": "GHSA-v8qj-hxv7-mgvv", "cve": "CVE-2026-54011", "severity": "high", "published": "2026-06-11T18:58:03Z" }, { "ghsa": "GHSA-vrhc-3fr6-pc3c", "cve": "CVE-2026-54010", "severity": "high", "published": "2026-06-11T18:57:21Z" }, { "ghsa": "GHSA-wch8-mhj5-9frg", "cve": "CVE-2026-54009", "severity": "medium", "published": "2026-06-11T18:57:04Z" }, { "ghsa": "GHSA-226f-f24g-524w", "cve": "CVE-2026-54008", "severity": "high", "published": "2026-06-11T18:56:45Z" }, { "ghsa": "GHSA-3vv5-8xxp-4f55", "cve": "CVE-2026-54007", "severity": "high", "published": "2026-06-11T18:56:24Z" }, { "ghsa": "GHSA-f3g7-59qc-pqg6", "cve": "CVE-2026-54006", "severity": "medium", "published": "2026-06-11T18:55:57Z" }, { "ghsa": "GHSA-3wgj-c2hg-vm6q", "severity": "high", "published": "2026-05-10T19:49:20Z" }, { "ghsa": "GHSA-65pg-qhhw-mxwg", "cve": "CVE-2026-45397", "severity": "medium", "published": "2026-05-10T19:35:12Z" }, { "ghsa": "GHSA-rjmp-vjf2-qf4g", "cve": "CVE-2026-45396", "severity": "medium", "published": "2026-05-10T19:34:32Z" }, { "ghsa": "GHSA-p4fx-23fq-jfg6", "cve": "CVE-2026-45395", "severity": "high", "published": "2026-05-10T19:34:01Z" }, { "ghsa": "GHSA-hcwp-82g6-8wxc", "cve": "CVE-2026-45318", "severity": "medium", "published": "2026-05-09T08:02:58Z" }, { "ghsa": "GHSA-jx2x-j75f-xq3j", "cve": "CVE-2026-45316", "severity": "low", "published": "2026-05-09T08:02:53Z" }, { "ghsa": "GHSA-m8f9-9whg-f4xr", "cve": "CVE-2026-45315", "severity": "high", "published": "2026-05-09T08:02:50Z" }, { "ghsa": "GHSA-3856-3vxq-m6fc", "cve": "CVE-2026-45314", "severity": "high", "published": "2026-05-09T08:02:43Z" }, { "ghsa": "GHSA-rcvp-6fgw-c7fh", "cve": "CVE-2026-44563", "severity": "medium", "published": "2026-05-05T11:19:27Z" }, { "ghsa": "GHSA-mqq6-cqcx-38vg", "cve": "CVE-2026-44562", "severity": "medium", "published": "2026-05-05T11:19:22Z" }, { "ghsa": "GHSA-7rjh-px4v-5w55", "cve": "CVE-2026-44558", "severity": "medium", "published": "2026-05-05T11:19:02Z" }, { "ghsa": "GHSA-6c2x-gcp3-gp73", "cve": "CVE-2026-44557", "severity": "medium", "published": "2026-05-05T11:18:53Z" }, { "ghsa": "GHSA-9vvh-qmjx-p4q8", "cve": "CVE-2026-44555", "severity": "high", "published": "2026-05-05T11:18:42Z" }, { "ghsa": "GHSA-7r82-qhg4-6wvj", "cve": "CVE-2026-44554", "severity": "high", "published": "2026-05-05T11:18:35Z" }, { "ghsa": "GHSA-45m8-cpm2-3v65", "cve": "CVE-2026-44553", "severity": "high", "published": "2026-05-05T11:18:29Z" }, { "ghsa": "GHSA-3x8w-4f7p-xxc2", "cve": "CVE-2026-44552", "severity": "high", "published": "2026-05-05T11:18:22Z" }, { "ghsa": "GHSA-2r4p-jpmg-48f4", "cve": "CVE-2026-44551", "severity": "critical", "published": "2026-05-05T11:18:17Z" }, { "ghsa": "GHSA-hr43-rjmr-7wmm", "cve": "CVE-2026-44550", "severity": "medium", "published": "2026-05-05T11:18:11Z" } ] }, "updatedAt": "2026-10-27T15:31:27.569083001Z" } }, "facts": [ { "a": "HTTP API", "b": "Platform", "name": "Kind" }, { "a": "Trevin Tindall (T-Crypt on GitHub)", "b": "Open WebUI Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0. The Berth name, the Pilot mascot and the artwork in assets/ are excluded from the licence, per the NOTICE file", "b": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-23", "b": "2026-09-21", "name": "Last release" }, { "a": "no document linked", "b": "2026-07-07", "name": "Terms last updated" }, { "a": "no document linked", "b": "2025-12-31", "name": "Privacy policy last updated" }, { "a": "", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "245 stars", "b": "153k stars", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Berth scores 67.6 (B) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Berth or Open WebUI?" }, { "answer": "No hosted endpoint is listed for Berth. No hosted endpoint is listed for Open WebUI.", "question": "Can an agent call Berth and Open WebUI without installing anything?" }, { "answer": "Berth is open source (Apache-2.0. The Berth name, the Pilot mascot and the artwork in assets/ are excluded from the licence, per the NOTICE file). No open-source release is listed for Open WebUI.", "question": "Are Berth and Open WebUI open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 76 against 68", "Schema \u0026 documentation, 69 against 60", "Agent ergonomics, 75 against 54", "Payments \u0026 pricing, 60 against 20" ], "also": [ "Free to start without a card", "Open source", "No incidents deducted, where Open WebUI loses 8 points for them" ], "goodFor": "Someone running several GPU programs (llama.cpp, llama-swap, Ollama, vLLM, ComfyUI, games) on one NVIDIA card who wants them to take turns, and agents that need to ask for the card.", "slug": "berth", "watchFor": "First released on 11 October 2026 and called alpha. Windows, AMD and multiple GPUs are experimental, and the gateway is a preview" }, { "aheadOn": [ "Security \u0026 auth, 63 against 51", "Maintenance \u0026 community, 91 against 76", "Transparency \u0026 trust, 73 against 68" ], "also": null, "goodFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "slug": "open-webui", "watchFor": "API keys are off by default, and each user gets one key with no scopes or expiry" } ], "job": { "capability": "inference.local", "name": "Local inference" }, "others": [ { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-berth.json", "title": "AnythingLLM vs Berth", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-berth" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.json", "title": "AnythingLLM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-bitrun.json", "title": "Berth vs BitRun", "url": "https://www.anchorterminal.com/compare/berth-vs-bitrun" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-docker-model-runner.json", "title": "Berth vs Docker Model Runner", "url": "https://www.anchorterminal.com/compare/berth-vs-docker-model-runner" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-foundry-local.json", "title": "Berth vs Foundry Local", "url": "https://www.anchorterminal.com/compare/berth-vs-foundry-local" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-ghost-core.json", "title": "Berth vs Core", "url": "https://www.anchorterminal.com/compare/berth-vs-ghost-core" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-gpt4all.json", "title": "Berth vs GPT4All", "url": "https://www.anchorterminal.com/compare/berth-vs-gpt4all" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-jan.json", "title": "Berth vs Jan", "url": "https://www.anchorterminal.com/compare/berth-vs-jan" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-khoj.json", "title": "Berth vs Khoj", "url": "https://www.anchorterminal.com/compare/berth-vs-khoj" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-koboldcpp.json", "title": "Berth vs KoboldCpp", "url": "https://www.anchorterminal.com/compare/berth-vs-koboldcpp" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-lemonade.json", "title": "Berth vs Lemonade", "url": "https://www.anchorterminal.com/compare/berth-vs-lemonade" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-llama-cpp.json", "title": "Berth vs llama.cpp", "url": "https://www.anchorterminal.com/compare/berth-vs-llama-cpp" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-lm-studio.json", "title": "Berth vs LM Studio", "url": "https://www.anchorterminal.com/compare/berth-vs-lm-studio" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-localai.json", "title": "Berth vs LocalAI", "url": "https://www.anchorterminal.com/compare/berth-vs-localai" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-mlx-lm.json", "title": "Berth vs MLX LM", "url": "https://www.anchorterminal.com/compare/berth-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-ollama.json", "title": "Berth vs Ollama", "url": "https://www.anchorterminal.com/compare/berth-vs-ollama" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-screenpipe.json", "title": "Berth vs screenpipe", "url": "https://www.anchorterminal.com/compare/berth-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-text-generation-webui.json", "title": "Berth vs TextGen", "url": "https://www.anchorterminal.com/compare/berth-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-vllm.json", "title": "Berth vs vLLM", "url": "https://www.anchorterminal.com/compare/berth-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/bitrun-vs-open-webui.json", "title": "BitRun vs Open WebUI", "url": "https://www.anchorterminal.com/compare/bitrun-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.json", "title": "Docker Model Runner vs Open WebUI", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.json", "title": "Foundry Local vs Open WebUI", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.json", "title": "Core vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.json", "title": "GPT4All vs Open WebUI", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-open-webui.json", "title": "Jan vs Open WebUI", "url": "https://www.anchorterminal.com/compare/jan-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-open-webui.json", "title": "Khoj vs Open WebUI", "url": "https://www.anchorterminal.com/compare/khoj-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.json", "title": "KoboldCpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui.json", "title": "Lemonade vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.json", "title": "llama.cpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.json", "title": "LM Studio vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-open-webui.json", "title": "LocalAI vs Open WebUI", "url": "https://www.anchorterminal.com/compare/localai-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.json", "title": "MLX LM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-open-webui.json", "title": "Ollama vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ollama-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.json", "title": "Open WebUI vs screenpipe", "url": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.json", "title": "Open WebUI vs TextGen", "url": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-vllm.json", "title": "Open WebUI vs vLLM", "url": "https://www.anchorterminal.com/compare/open-webui-vs-vllm" } ], "scores": [ { "berth": 76, "by": 8, "edge": "berth", "key": "reliability", "name": "Reliability", "open-webui": 68, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "berth": 69, "by": 9, "edge": "berth", "key": "schema", "name": "Schema \u0026 documentation", "open-webui": 60, "weight": 13 }, { "berth": 75, "by": 21, "edge": "berth", "key": "ergonomics", "name": "Agent ergonomics", "open-webui": 54, "weight": 13 }, { "berth": 51, "by": 12, "edge": "open-webui", "key": "security", "name": "Security \u0026 auth", "open-webui": 63, "weight": 14 }, { "berth": 60, "by": 40, "edge": "berth", "key": "payments", "name": "Payments \u0026 pricing", "open-webui": 20, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "berth": 76, "by": 15, "edge": "open-webui", "key": "maintenance", "name": "Maintenance \u0026 community", "open-webui": 91, "weight": 7 }, { "berth": 68, "by": 5, "edge": "open-webui", "key": "transparency", "name": "Transparency \u0026 trust", "open-webui": 73, "weight": 7 } ], "summary": "Berth scores 67.6 (B) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.", "tutorials": [], "verdicts": { "berth": "Berth coordinates one NVIDIA card between engines, ComfyUI and games, grants a lease only after the driver shows memory free, and gives agents a skill, JSON output and a keyed loopback gateway. It is 17 days old, alpha and maintained by one developer, with Windows and AMD experimental and no machine-readable API spec.", "open-webui": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/berth-vs-open-webui", "json": "https://www.anchorterminal.com/compare/berth-vs-open-webui.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/berth-vs-open-webui.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/berth-vs-open-webui.min.md" }, "markdown": "Berth scores 67.6 (B) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.\n\n- Berth: grade B, 67.6/100, rank #283 of 1218. Markdown https://www.anchorterminal.com/tools/berth.md · JSON https://www.anchorterminal.com/api/v1/tools/berth.json\n- Open WebUI: grade D, 52/100, rank #879 of 1218. Markdown https://www.anchorterminal.com/tools/open-webui.md · JSON https://www.anchorterminal.com/api/v1/tools/open-webui.json\n- Best local AI models and assistants: https://www.anchorterminal.com/best/local-ai/index.md\n- All 229 local ai comparisons: https://www.anchorterminal.com/compare/local-ai/index.md\n\n## Which one, for what\n\n### Berth (B)\n\nGood for: Someone running several GPU programs (llama.cpp, llama-swap, Ollama, vLLM, ComfyUI, games) on one NVIDIA card who wants them to take turns, and agents that need to ask for the card.\n\nAhead on:\n- Reliability, 76 against 68\n- Schema \u0026 documentation, 69 against 60\n- Agent ergonomics, 75 against 54\n- Payments \u0026 pricing, 60 against 20\n\nAlso in its favour:\n- Free to start without a card\n- Open source\n- No incidents deducted, where Open WebUI loses 8 points for them\n\nWatch for: First released on 11 October 2026 and called alpha. Windows, AMD and multiple GPUs are experimental, and the gateway is a preview\n\n### Open WebUI (D)\n\nGood for: A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.\n\nAhead on:\n- Security \u0026 auth, 63 against 51\n- Maintenance \u0026 community, 91 against 76\n- Transparency \u0026 trust, 73 against 68\n\nWatch for: API keys are off by default, and each user gets one key with no scopes or expiry\n\n\n## Score by category\n\n| Category | Weight | Berth | Open WebUI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 76 | 68 | Berth +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 69 | 60 | Berth +9 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 54 | Berth +21 |\n| Security \u0026 auth | 14% (17.5 this run) | 51 | 63 | Open WebUI +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 20 | Berth +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 76 | 91 | Open WebUI +15 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 68 | 73 | Open WebUI +5 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **67.6 · B** | **52 · D** | |\n\n## Facts side by side\n\n| Fact | Berth | Open WebUI |\n| --- | --- | --- |\n| Kind | HTTP API | Platform |\n| Vendor | Trevin Tindall (T-Crypt on GitHub) | Open WebUI Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0. The Berth name, the Pilot mascot and the artwork in assets/ are excluded from the licence, per the NOTICE file | Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-23 | 2026-09-21 |\n| Terms last updated | no document linked | 2026-07-07 |\n| Privacy policy last updated | no document linked | 2025-12-31 |\n| Customer content may train models | | yes, with an opt-out |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | not found in the text |\n| Arbitration or class-action waiver | | yes |\n| Popularity | 245 stars | 153k stars |\n| Agent reviews | none | 2.5/5 (2) |\n\n## Verdicts\n\n**Berth.** Berth coordinates one NVIDIA card between engines, ComfyUI and games, grants a lease only after the driver shows memory free, and gives agents a skill, JSON output and a keyed loopback gateway. It is 17 days old, alpha and maintained by one developer, with Windows and AMD experimental and no machine-readable API spec.\n\n**Open WebUI.** Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.\n\n## Before you call either\n\n### Berth\n\n1. Run `berth status --format json` before starting, stopping or switching any GPU engine. If berthd is unreachable, no engine is protected\n2. Never kill a process to free VRAM. Ask for the card with `berth run`, `berth hold` or a gateway request, and report stowaways to the user\n3. Send gateway requests to http://127.0.0.1:9799/v1 with `Authorization: Bearer $(berth key)`, and use `\"stream\": true` for cold starts of up to minutes\n4. On a 503, read the `code` and wait for `Retry-After`. A pinned holder (a game or `berth hold`) answers 409 to stop and is the user's call\n5. Ask the user before `berth reclaim LEASE --yes`, any berth.toml edit or `berth update`. Each changes the node\n\n### Open WebUI\n\n1. Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then\n2. Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself\n3. Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections\n4. Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base\n5. Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist\n\n## Questions\n\n### Which is better for AI agents, Berth or Open WebUI?\n\nBerth scores 67.6 (B) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.\n\n### Can an agent call Berth and Open WebUI without installing anything?\n\nNo hosted endpoint is listed for Berth. No hosted endpoint is listed for Open WebUI.\n\n### Are Berth and Open WebUI open source?\n\nBerth is open source (Apache-2.0. The Berth name, the Pilot mascot and the artwork in assets/ are excluded from the licence, per the NOTICE file). No open-source release is listed for Open WebUI.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/berth-vs-open-webui.json, and with the fewest tokens: https://www.anchorterminal.com/compare/berth-vs-open-webui.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"berth\", \"b\": \"open-webui\"}`. From a terminal: `anchor compare berth open-webui`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/berth.json and https://www.anchorterminal.com/api/v1/tools/open-webui.json\n\n## Other comparisons with Berth or Open WebUI\n\n- [AnythingLLM vs Berth](https://www.anchorterminal.com/compare/anythingllm-vs-berth.md)\n- [AnythingLLM vs Open WebUI](https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.md)\n- [Berth vs BitRun](https://www.anchorterminal.com/compare/berth-vs-bitrun.md)\n- [Berth vs Docker Model Runner](https://www.anchorterminal.com/compare/berth-vs-docker-model-runner.md)\n- [Berth vs Foundry Local](https://www.anchorterminal.com/compare/berth-vs-foundry-local.md)\n- [Berth vs Core](https://www.anchorterminal.com/compare/berth-vs-ghost-core.md)\n- [Berth vs GPT4All](https://www.anchorterminal.com/compare/berth-vs-gpt4all.md)\n- [Berth vs Jan](https://www.anchorterminal.com/compare/berth-vs-jan.md)\n- [Berth vs Khoj](https://www.anchorterminal.com/compare/berth-vs-khoj.md)\n- [Berth vs KoboldCpp](https://www.anchorterminal.com/compare/berth-vs-koboldcpp.md)\n- [Berth vs Lemonade](https://www.anchorterminal.com/compare/berth-vs-lemonade.md)\n- [Berth vs llama.cpp](https://www.anchorterminal.com/compare/berth-vs-llama-cpp.md)\n- [Berth vs LM Studio](https://www.anchorterminal.com/compare/berth-vs-lm-studio.md)\n- [Berth vs LocalAI](https://www.anchorterminal.com/compare/berth-vs-localai.md)\n- [Berth vs MLX LM](https://www.anchorterminal.com/compare/berth-vs-mlx-lm.md)\n- [Berth vs Ollama](https://www.anchorterminal.com/compare/berth-vs-ollama.md)\n- [Berth vs screenpipe](https://www.anchorterminal.com/compare/berth-vs-screenpipe.md)\n- [Berth vs TextGen](https://www.anchorterminal.com/compare/berth-vs-text-generation-webui.md)\n- [Berth vs vLLM](https://www.anchorterminal.com/compare/berth-vs-vllm.md)\n- [BitRun vs Open WebUI](https://www.anchorterminal.com/compare/bitrun-vs-open-webui.md)\n- [Docker Model Runner vs Open WebUI](https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.md)\n- [Foundry Local vs Open WebUI](https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.md)\n- [Core vs Open WebUI](https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.md)\n- [GPT4All vs Open WebUI](https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.md)\n- [Jan vs Open WebUI](https://www.anchorterminal.com/compare/jan-vs-open-webui.md)\n- [Khoj vs Open WebUI](https://www.anchorterminal.com/compare/khoj-vs-open-webui.md)\n- [KoboldCpp vs Open WebUI](https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.md)\n- [Lemonade vs Open WebUI](https://www.anchorterminal.com/compare/lemonade-vs-open-webui.md)\n- [llama.cpp vs Open WebUI](https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.md)\n- [LM Studio vs Open WebUI](https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.md)\n- [LocalAI vs Open WebUI](https://www.anchorterminal.com/compare/localai-vs-open-webui.md)\n- [MLX LM vs Open WebUI](https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.md)\n- [Ollama vs Open WebUI](https://www.anchorterminal.com/compare/ollama-vs-open-webui.md)\n- [Open WebUI vs screenpipe](https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.md)\n- [Open WebUI vs TextGen](https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.md)\n- [Open WebUI vs vLLM](https://www.anchorterminal.com/compare/open-webui-vs-vllm.md)\n\n## Disclosure\n\n- Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-28", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Berth vs Open WebUI", "url": "" } ], "description": "Berth scores 67.6 (B) to Open WebUI's 52 (D) for local inference. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Berth B 67.6", "Open WebUI D 52", "scores" ], "h1": "Berth vs Open WebUI", "image": "https://www.anchorterminal.com/assets/og/compare-berth-vs-open-webui.png", "path": "/compare/berth-vs-open-webui", "published": "2026-10-01", "section": "tools", "title": "Berth vs Open WebUI for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-28", "url": "https://www.anchorterminal.com/compare/berth-vs-open-webui" }, "tokens": { "markdown": 2900, "slim": 830 }, "version": 1 }