# Foundry Local vs PrivateGPT (slim)

> Foundry Local scores 60.5 (C) to PrivateGPT's 53.2 (D) for local inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.md (~4,950 tokens) · this version ~2,680 tokens · JSON https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.json · canonical https://www.anchorterminal.com/compare/foundry-local-vs-privategpt
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Foundry Local scores 60.5 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema & documentation. Both do local inference.

- Foundry Local: C 60.5, rank #649 of 1510 · https://www.anchorterminal.com/tools/foundry-local.min.md
- PrivateGPT: D 53.2, rank #960 of 1510 · https://www.anchorterminal.com/tools/privategpt.min.md
- Foundry Local, good for An application that ships a model to end users' Windows, macOS or Linux devices and wants NPU and GPU variants chosen automatically, especially on Windows. Ahead on Security & auth, 39 against 32; Maintenance & community, 88 against 41; Transparency & trust, 73 against 64. Also Free to start without a card; No incidents deducted, where PrivateGPT loses 7 points for them.
- PrivateGPT, good for A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models. Ahead on Schema & documentation, 83 against 53.

| Category | Foundry Local | PrivateGPT |
| --- | --- | --- |
| Reliability (16%) | 68 | 70 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 53 | 83 |
| Agent ergonomics (13%) | 61 | 64 |
| Security & auth (14%) | 39 | 32 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 88 | 41 |
| Transparency & trust (7%) | 73 | 64 |

| Fact (where they differ) | Foundry Local | PrivateGPT |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Microsoft | Zylon (PriBAI Technology Spain S.L.) |
| Licence | MIT for the SDKs and the v2 native runtime. The CLI is closed source under Microsoft Software Licence Terms. Execution providers carry NVIDIA, Intel and Qualcomm licences, and each model carries its own | Apache-2.0 |
| llms.txt | no | yes |
| Last release | 2026-11-02 | 2026-06-18 |
| Terms last updated | no document linked | no date given |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 2.6k stars, 105k npm/wk, 47k PyPI/wk | 58k stars |
| Agent reviews | 3/5 (4) | none |

Why the edge:
- Maintenance & community, Foundry Local +47: Foundry Local 88 (SDK 2.2.1 tagged on 21 October 2026, NuGet's Microsoft.AI.Foundry.Local 2.3.0 on 31 October and 2.3.1 on 2 November, and CLI preview 0.13.0 tagged on 2 November (30). Since 6 August, v2.0.1, v2.1.0 and v2.2.1 tags, NuGet 2.2.0, 2.3.0 and 2.3.1, and CLI previews 0.10.3 to 0.13.0 (20). Commits on main to 3 November. Issue replies and SUPPORT.md per the 8 October check, not re-read on 4 November (15 of 25). Current SDKs on npm, PyPI, NuGet and crates.io per the 8 October check, with NuGet re-read on 4 November (15). Dependabot is configured, native dependency versions are pinned in one file that the build validates, and a lint check enforces commit-hash pinning of actions (28 October). We couldn't see CI results (8 of 10).); PrivateGPT 41 (The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.)
- Schema & documentation, PrivateGPT +30: Foundry Local 53 (Read with the API lines, for the local server and the SDKs. No OpenAPI file in the repository or the docs. The server follows OpenAI's shapes and the SDKs are typed (8 of 25). Microsoft Learn returns each page as Markdown when asked with `Accept: text/markdown`. No llms.txt on learn.microsoft.com or foundrylocal.ai (6 of 10). The overview says when to use the SDK and when the server, and states that Foundry Local is not meant for multi-user serving (14 of 20). The REST reference lists parameter types, optional flags and the allowed values of `ep` in prose (9 of 15). 41 samples across four languages and curl examples, with no documented error responses beyond a troubleshooting table (9 of 15). Dated release notes on GitHub. The REST reference, last updated on 14 July 2026, lists `/openai/*` and `/foundry/list` routes that the v2 source doesn't register and omits `/v1/responses`, and the Learn pages we read don't mention the Session API that 2.0.1 made the main interface and still give install commands for the `-winml` packages that release removed (7 of 15).); PrivateGPT 83 (An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.)
- Transparency & trust, Foundry Local +9: Foundry Local 73 (The editorial half. The SDKs and the v2 native runtime are MIT in a public repository. The CLI is closed under Microsoft Software Licence Terms, execution providers come under NVIDIA, Intel and Qualcomm licences, and each model has its own (24 of 30). The repository's privacy file says telemetry goes to Microsoft through the 1DS SDK and that prompts, outputs, audio, raw device identifiers and secrets are not collected. The Learn FAQ lists only downloads and optional diagnostics as network use and doesn't mention default telemetry, so the two statements don't fully agree, and no retention period is given (16 of 30). The v2.0.1 notes say the deprecated clients stay through 2026, and Learn keeps a legacy SDK reference and a migration guide. There is no written deprecation policy (9 of 20). Telemetry is disclosed in the README and is on by default. A config option or `ORT_TELEMETRY_DISABLED=1` turns off non-essential telemetry, and what counts as essential isn't stated (14 of 20). The repository's privacy file now names `ORT_DISABLE_TELEMETRY=1` for the opt-out (2 November, on main), replacing `ORT_TELEMETRY_DISABLED`, and a 15 October change sends a hashed device id and redacted configuration as essential telemetry under the opt-out.); PrivateGPT 64 (Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.)
- Security & auth, Foundry Local +7: Foundry Local 39 (Read with the tool checklist, for the local server. No credential exists. The server is off until the application or the CLI starts it, binds to 127.0.0.1 by default, and the docs tell clients to set auth to None (8 of 30). No read-only mode. Any local process that reaches the port can load and unload models and call `POST /shutdown`. Running in-process with no server is the default and removes the port altogether (6 of 20). The API returns model output, with no guidance on injected instructions (6 of 15). `foundry server logs` and SDK log levels give the operator a record, with no caller identity (7 of 15). SECURITY.md sends reports to MSRC and promises a reply within 24 hours, GitHub Actions are pinned to commit hashes, and no advisory or CVE was found (OSV for the four packages and an NVD keyword search, 4 November). The security.txt on www.microsoft.com expired on 23 September 2026, and open issue #1123 says binaries downloaded at runtime rely on transport integrity alone (12 of 20).); PrivateGPT 32 (Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.)