Core vs PrivateGPT

Core 7

Graded on the interface an agent would use, the endpoint Ghost's FAQ says is compatible with the OpenAI Responses API, for OpenCode, OpenClaw, Codex and the owner's own apps, scripts and agents. No MCP server or other agent interface found. OpenAI's Responses API is a public contract by reference, but Ghost publishes no spec, address, port, model identifiers or supported parameters. The Underdog dossier gave 5 for an OpenAI-compatible API named with no spec from the vendor (5 of 25). llms.txt, /docs and /developers return 404, and the setup guide is an HTML page for people (0 of 10). One FAQ answer states the endpoint's purpose and the clients it suits, with nothing on when not to use it or its limits. Underdog earned 6 for several model cards stating purpose, so one answer earns 2 (2 of 20). No typed inputs, context lengths or limits documented (0 of 15). No request examples or documented errors (0 of 15). No API versioning or public changelog (0 of 15).

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

Core 5

Read with the local-software lines, as GHOST.md asks and as the Underdog and Screenpipe dossiers did for software the owner runs. Core is a box running Ghost's software at home, and it hadn't shipped on 5 October 2026 (batch 1 is scheduled for 31 October). Nothing installs today. The app page states 'Apple Silicon only, macOS Big Sur or higher', but its download buttons link to the setup guide (checked 23:33 UTC) and no package is published, so the line isn't met (0 of 20). The software is closed and no public CI or tests were found (0). No public issue tracker or forum, and no units have shipped, so there's nothing to count. Underdog's judgement call for the same situation (5 of 25). No changelog, release notes or version numbers for Core's software. The setup guide's 'Updated September 18th, 2026' is a dated help page, not a changelog, and ghost.ai/changelog returns 404 (0 of 15). No software version or stability statement, and the product is on pre-order (0 of 15). Low because the product is closed and unshipped, not because of any failure found.

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.

Core 4

Graded on the Responses-compatible endpoint. No context length, response sizing or truncation is documented for any listed model. Underdog's 5 on this line rested on published evidence of prompt reuse, and nothing comparable was found for Core (0 of 25). No pagination, filtering or output-size controls documented (0 of 20). No error responses documented (0 of 20). Nothing on retries, idempotency or statelessness (0 of 20). Ghost states the endpoint works with any app that supports the Responses API and a custom endpoint, so OpenAI's own SDKs should reach it, a vendor claim that couldn't be tested without an address or credential. No Ghost SDK, default model or required parameters are documented, where Underdog's 7 also covered documented defaults and two named runtimes (4 of 15).

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.

Core 10

Self-hosted rule, scoring the paid option (the box), as the Underdog and Screenpipe dossiers did. No x402, MPP or L402 on ghost.ai or in its site code. Orders go through Stripe Checkout (0 of 40). $3,499 one-off, public without a login, with no subscription and no per-token fee stated. That's a single product price with no per-call unit, the reading the Screenpipe and Marmot dossiers used for public prices without a per-call unit, and the line has no step between 10 and 20 (10 of 20). No free tier or trial. The 30-day return follows a paid purchase (0 of 20). A person buys in a browser and pairs the box through the Ghost app, and no programmatic route to access is documented (0 of 20). Batch 1 showed sold out at 23:31 UTC on 5 October 2026, which doesn't change the published price.

PrivateGPT 60

Read with the self-hosted rule. PrivateGPT is Apache-2.0 with nothing to buy. Zylon, the company's enterprise platform built on it, is a separate product sold through demos, and is not the surface graded. No payment protocol (0). Free with no account and no card, so 20, 20 and 20 on the last three lines.

Core 3

Read for a closed product. No software release, model update or API change found, since Core hadn't shipped on 5 October 2026. The privacy policy (effective 4 October 2026) and setup guide (updated 18 September 2026) are policy and help pages, not releases (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). Closed-service scale. No public changelog, a support page with seven FAQ answers, a setup guide with troubleshooting and support@ghost.ai, while the app page's troubleshooting link uses hello@tryghost.ai. Neither address was tested. Underdog earned 2 for a contact address alone, and Core adds a support page and troubleshooting (3 of 15). No SDK and no MCP registry entry (0 of 15). No visible CI or dependency information (0 of 10).

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

Core 6

Tool lines, graded on the Responses-compatible endpoint as GHOST.md asks, the same interface as Schema and Ergonomics, with the device's documented controls counted where a line covers them. How the endpoint authenticates callers is not documented. No key, token or pairing requirement for it was found, and the privacy policy mentions 'device-access controls' without detail. App pairing covers the app, not the endpoint (0 of 30). Screen history is off until enabled, connected accounts get the permissions the owner approves and can be disconnected, and the setup guide says Ghost connects to home devices only when the owner approves a live view. Against that, the home page says Core acts 'without waiting for a prompt', and no read-only mode or confirmation before it acts through imported browser sessions was found (4 of 20). Core reads email, messages, web results and screen text, all untrusted content, and no prompt-injection guidance was found (0 of 15). No audit log or per-action record described (0 of 15). No security.txt (404 at 23:34 UTC on 5 October 2026), disclosure policy, bug bounty, certification or advisories. The privacy policy invites independent security firms to audit the gateway and relay through support@ghost.ai (2 of 20).

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.