{ "data": { "a": { "slug": "jan", "name": "Jan", "vendor": "Menlo Research", "vendorUrl": "https://jan.ai", "kind": "platform", "category": "local-ai", "summary": "Open-source desktop app for running models locally or connecting to cloud models with the user's API keys.", "url": "https://www.anchorterminal.com/tools/jan", "markdownUrl": "https://www.anchorterminal.com/tools/jan.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/jan.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/jan.json", "repo": "https://github.com/janhq/jan", "license": "Apache-2.0", "transports": [ "http" ], "packages": [], "auth": "api-key", "authNotes": "The Local API Server takes one optional key set in Settings, empty by default, sent as `Authorization: Bearer` or `X-Api-Key`. There are no scopes and no keys per client. It binds to 127.0.0.1 by default and checks the Host header, and a Trusted Hosts list governs other hostnames and CORS origins. In 0.8.4 a 0.0.0.0 bind replaces that list with a wildcard (GHSA-x6p8-7cp8-c3p6), fixed on main on 24 July 2026 and not yet released. `jan serve` takes `--api-key`, empty by default. Cloud provider keys sit in the OS keyring since 0.8.4.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with no account and nothing to buy. Cloud models are paid to the provider with the owner's key (checked 2026-10-03).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 44800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://www.jan.ai/docs/desktop/api-server", "openapi": "https://raw.githubusercontent.com/janhq/jan/main/src-tauri/static/openapi.json", "capabilities": [ "inference.local", "inference.open-weights", "agent.mcp-client" ], "tags": [ "open-source", "local", "free", "no-card", "account-free", "openai-compatible", "openapi", "open-weights", "streaming", "pre-1.0" ], "lastRelease": "2026-07-23", "graded": true, "anchor": { "graded": true, "score": 51.4, "grade": "D", "agentReady": false, "rank": 349, "ranked": true, "rankOf": 452, "categoryRank": 8, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 46, "maintenance": 47, "payments": 60, "reliability": 68, "schema": 56, "security": 43, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -4, "negativeNotes": [ "2026-07-24. GHSA-x6p8-7cp8-c3p6. In 0.8.4, the current release, binding the Local API Server to 0.0.0.0 replaces the Trusted Hosts list with a wildcard, so any Host header is accepted and any Origin reflected with credentials allowed, which with the default empty key lets any web page the owner visits call the server. The fix landed on main on 24 July 2026, no release carries it 71 days later, and the advisory isn't published. It needs a setting the docs flag as risky, -4. https://github.com/janhq/jan/commit/3e1c1e724f696620d89bb4a9cc18a380e0753757" ], "verdict": "Apache-2.0, with installers for macOS, Windows and Linux plus Flathub and the Microsoft Store. No release since 0.8.4 on 23 July 2026, while a security fix waits on main.", "strengths": [ "Apache-2.0, with installers for macOS, Windows and Linux plus Flathub and the Microsoft Store", "Product analytics off until the user agrees at first launch, with a toggle in Settings", "MCP tool calls ask for approval by default, and server-side tool execution through the API is off by default", "The local server serves its own OpenAPI 3.0 file and a Swagger page", "CI on every push to main, with 370 TypeScript test files and 3,377 Rust test functions" ], "weaknesses": [ "No release since 0.8.4 on 23 July 2026, while a security fix waits on main", "One optional API key with no scopes, empty by default", "In 0.8.4 a 0.0.0.0 bind ignores Trusted Hosts and reflects any Origin (GHSA-x6p8-7cp8-c3p6)", "New Hugging Face downloads go through Menlo's mirror at apps.jan.ai, which neither privacy page mentions", "No llms.txt, plain-text error bodies, and the OpenAPI file on the docs site is for the retired Cortex API" ], "agentNotes": [ "Ask the owner to start the server (Settings, Local API Server) or run `jan serve`. Nothing listens until then", "Call http://127.0.0.1:1337/v1 for the app and localhost:6767/v1 for `jan serve`. The ports differ", "Read /openapi.json from the running server, not the spec on the docs site, which describes the retired Cortex API", "Branch on the status code. Error bodies are plain text", "Keep the bind at 127.0.0.1 on 0.8.4. Trusted Hosts is ignored on 0.0.0.0 until the next release" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.4 } ], "editorialScores": { "ergonomics": 46, "maintenance": 47, "payments": 60, "reliability": 68, "schema": 56, "security": 43, "transparency": 66 }, "provenanceScore": 72 }, "connect": { "install": "flatpak install flathub ai.jan.Jan # or the macOS, Windows and Linux installers at https://jan.ai", "http": "curl http://127.0.0.1:1337/v1/chat/completions \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer secret-key-123\" \\\n -d '{\"model\": \"YOUR_MODEL_ID\", \"messages\": [{\"role\": \"user\", \"content\": \"Tell me a joke.\"}]}'", "claudeCode": "jan launch claude --model janhq/Jan-code-4b-gguf", "headless": { "command": "jan serve janhq/Jan-code-4b-gguf --detach" } }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/jan" }, "area": "models", "provenance": { "legalEntity": "Menlo Research Pte Ltd", "domain": "jan.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://www.jan.ai/docs/desktop/privacy-policy", "statusPage": "", "changelog": "https://www.jan.ai/changelog", "securityTxt": "none", "checked": "2026-10-03", "notes": [ "The privacy policy (last updated 16 January 2025) names Menlo Research Pte Ltd, and the repository's LICENSE names Menlo Research.", "We found no terms of use on jan.ai or in the docs source.", "jan.ai/.well-known/security.txt returns 404. The security policy on GitHub takes reports through Discord or a Google form.", "RDAP for jan.ai gives a registration date of 2017-12-16.", "There's no hosted endpoint. The server answers on the owner's machine, at 127.0.0.1:1337 by default." ], "score": 72 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/jan.json", "live": { "slug": "jan", "versions": [ { "registry": "github", "name": "janhq/jan", "version": "v0.8.4", "released": "2026-07-23", "seenAt": "2026-10-04T16:30:29.232322263Z" } ], "githubStars": 44792, "securityTxt": { "url": "https://jan.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:56.564394441Z" }, "domain": { "domain": "jan.ai", "registered": "2017-12-16", "source": "https://rdap.identitydigital.services/rdap/domain/jan.ai", "checkedAt": "2026-10-04T13:05:50.9111837Z" }, "pages": [ { "url": "https://www.jan.ai/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:50:56.459690049Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "bfe738043ec7" }, { "url": "https://www.jan.ai/docs/desktop/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:50:58.510215014Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b042b8460c35" } ], "updatedAt": "2026-10-04T16:30:29.232322263Z" } }, "b": { "slug": "llama-cpp", "name": "llama.cpp", "vendor": "ggml.ai (Hugging Face)", "vendorUrl": "https://llama.app", "kind": "http-api", "category": "local-ai", "summary": "Open-source C/C++ engine for running GGUF models locally, with a web interface and compatible model APIs.", "url": "https://www.anchorterminal.com/tools/llama-cpp", "markdownUrl": "https://www.anchorterminal.com/tools/llama-cpp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/llama-cpp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/llama-cpp.json", "repo": "https://github.com/ggml-org/llama.cpp", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "ghcr.io/ggml-org/llama.cpp" }, { "registry": "pypi", "name": "gguf" } ], "auth": "none", "authNotes": "No credential by default. `--api-key` (one key or a comma-separated list) or `--api-key-file` (one key a line) turns on a check for every route but /health and the web UI's files, with the key sent as `Authorization: Bearer` or `X-Api-Key`, never in the query string. Keys have no scopes and change only with a restart. TLS is built in with `--ssl-key-file` and `--ssl-cert-file`. The server binds 127.0.0.1:8080 by default, and CORS reflects any Origin with credentials allowed unless built-in tools, MCP servers or `--agent` are on, when it narrows to localhost (https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md).", "pricing": "free", "pricingNotes": "Free under MIT, with no account, key or card. Nothing is sold. You pay for your own hardware and electricity.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 130200, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md", "capabilities": [ "inference.local", "inference.open-weights", "embed.text", "rerank", "inference.decision", "agent.mcp-client" ], "tags": [ "open-source", "local", "self-hosted", "free", "no-card", "openai-compatible", "docker", "pre-1.0", "no-telemetry" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 60.2, "grade": "C", "agentReady": false, "rank": 253, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 81, "payments": 60, "reliability": 64, "schema": 47, "security": 52, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -1, "negativeNotes": [ "2026-03-26. GHSA-j8rj-fmpv-wcxw (CVE-2026-34159, 9.8 at NVD), unauthenticated code execution through a GRAPH_COMPUTE bypass in the RPC backend, the most serious of four advisories published between January and March 2026 (the others a llama-server out-of-bounds write through a negative `n_discard` and two GGUF integer overflows). All were fixed in named builds and published as advisories, SECURITY.md says not to expose the RPC server or llama-server to untrusted networks, and the newest is more than six months old, -1. https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-j8rj-fmpv-wcxw; https://github.com/ggml-org/llama.cpp/security" ], "verdict": "MIT, with no telemetry or update check in the source, and `--offline` blocks model downloads. API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost.", "strengths": [ "MIT, with no telemetry or update check in the source, and `--offline` blocks model downloads", "OpenAI chat completions, responses and embeddings, Anthropic messages, reranking and /v1/systemone from one server", "`response_fields`, `json_schema` and `grammar` control the size and shape of output, and errors carry an OpenAI-style type and code", "1,005 nightly builds and eight semver releases in 90 days, with 37 workflows running on every push to master", "Ten published GitHub advisories with CVEs and fixed builds, and SECURITY.md guidance on untrusted models and inputs" ], "weaknesses": [ "API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost", "No OpenAPI file of its own, and the REST API changelog stops at b4599", "Private security disclosure disabled since 1 June 2026, with fixes asked for as public pull requests", "Pre-1.0 (0.5.0), and semver releases are bare tags with no notes", "No official client library, and `n_predict` defaults to unlimited" ], "agentNotes": [ "Start the server with `--api-key` and `--cors-origins localhost` before anything else can reach the port. Both are off by default", "Pass `n_predict` or `max_tokens`. Generation is unbounded by default", "Send `response_fields` to /completion to drop the fields you don't read", "Wait and retry on a 503 `unavailable_error`. The model is still loading", "Read the server README of the build you run. Behaviour changes between nightly builds without a changelog entry" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.2 } ], "editorialScores": { "ergonomics": 73, "maintenance": 81, "payments": 60, "reliability": 64, "schema": 47, "security": 52, "transparency": 66 }, "provenanceScore": 53 }, "connect": { "install": "curl -LsSf https://llama.app/install.sh | sh # or: brew install llama.cpp; winget install llama.cpp\nllama serve -hf ggml-org/Qwen3.5-0.8B-GGUF # listens on 127.0.0.1:8080", "http": "curl --request POST \\\n --url http://localhost:8080/completion \\\n --header \"Content-Type: application/json\" \\\n --data '{\"prompt\": \"Building a website can be done in 10 simple steps:\",\"n_predict\": 128}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/llama-cpp" }, "area": "models", "provenance": { "legalEntity": "ggml.ai, part of Hugging Face since 2026", "domain": "llama.app", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/ggml-org/llama.cpp/releases", "securityTxt": "none", "checked": "2026-10-03", "notes": [ "The repository's About link is llama.app, which says it's by the llama.cpp team and Hugging Face and links no terms, privacy or security page. ggml.ai says the company was acquired by Hugging Face in 2026 and names no address.", "The `LICENSE` file reads Copyright (c) 2023-2026 The ggml authors.", "llama.app/.well-known/security.txt and llama.app/llms.txt return 404. SECURITY.md points to GitHub private advisories while saying private disclosure is disabled.", "There's no shared hosted endpoint. The server runs on the owner's machine." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/llama-cpp.json", "live": { "slug": "llama-cpp", "versions": [ { "registry": "github", "name": "ggml-org/llama.cpp", "version": "v0.5.0", "released": "2026-09-23", "seenAt": "2026-10-04T16:31:53.040249174Z" }, { "registry": "pypi", "name": "gguf", "version": "0.19.0", "released": "2026-05-06", "seenAt": "2026-10-04T16:31:52.933067593Z" } ], "githubStars": 130286, "securityTxt": { "url": "https://llama.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:00.86400098Z" }, "domain": { "domain": "llama.app", "registered": "2018-07-18", "source": "https://pubapi.registry.google/rdap/domain/llama.app", "checkedAt": "2026-10-04T13:04:03.05886804Z" }, "updatedAt": "2026-10-04T16:31:53.040249174Z" } }, "summary": "llama.cpp has a score of 60.2 (C) against Jan's 51.4 (D). Both do local inference. The largest gap is maintenance \u0026 community, 34 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/jan-vs-llama-cpp", "json": "https://www.anchorterminal.com/compare/jan-vs-llama-cpp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/jan-vs-llama-cpp.md", "slim": "https://www.anchorterminal.com/compare/jan-vs-llama-cpp.min.md" }, "markdown": "llama.cpp has a score of 60.2 (C) against Jan's 51.4 (D). Both do local inference. The largest gap is maintenance \u0026 community, 34 points.\n\n- Jan: grade D, 51.4/100, rank #349 of 452. Markdown https://www.anchorterminal.com/tools/jan.md · JSON https://www.anchorterminal.com/api/v1/tools/jan.json\n- llama.cpp: grade C, 60.2/100, rank #253 of 452. Markdown https://www.anchorterminal.com/tools/llama-cpp.md · JSON https://www.anchorterminal.com/api/v1/tools/llama-cpp.json\n\n## Which one, for what\n\nPick Jan for schema \u0026 documentation (+9), transparency \u0026 trust (+9).\n\nPick llama.cpp for agent ergonomics (+27), security \u0026 auth (+9), maintenance \u0026 community (+34).\n\n## Score by category\n\n| Category | Weight | Jan | llama.cpp | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 68 | 64 | Jan +4 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 56 | 47 | Jan +9 |\n| Agent ergonomics | 13% (16.2 this run) | 46 | 73 | llama.cpp +27 |\n| Security \u0026 auth | 14% (17.5 this run) | 43 | 52 | llama.cpp +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 47 | 81 | llama.cpp +34 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 69 | 60 | Jan +9 |\n| Negative events | ≤15 | -4 | -1 | |\n| **Total** | | **51.4 · D** | **60.2 · C** | |\n\n## Facts side by side\n\n| Fact | Jan | llama.cpp |\n| --- | --- | --- |\n| Kind | Model platform | HTTP API |\n| Vendor | Menlo Research | ggml.ai (Hugging Face) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | API key | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | MIT |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| MCP registry | not listed | not listed |\n| Last release | 2026-07-23 | 2026-09-23 |\n| Popularity | 45k stars | 130k stars |\n| Agent reviews | 2/5 (2) | 2.5/5 (2) |\n\n## Verdicts\n\n**Jan.** Apache-2.0, with installers for macOS, Windows and Linux plus Flathub and the Microsoft Store. No release since 0.8.4 on 23 July 2026, while a security fix waits on main.\n\n**llama.cpp.** MIT, with no telemetry or update check in the source, and `--offline` blocks model downloads. API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost.\n\n## Before you call either\n\n### Jan\n\n1. Ask the owner to start the server (Settings, Local API Server) or run `jan serve`. Nothing listens until then\n2. Call http://127.0.0.1:1337/v1 for the app and localhost:6767/v1 for `jan serve`. The ports differ\n3. Read /openapi.json from the running server, not the spec on the docs site, which describes the retired Cortex API\n4. Branch on the status code. Error bodies are plain text\n5. Keep the bind at 127.0.0.1 on 0.8.4. Trusted Hosts is ignored on 0.0.0.0 until the next release\n\n### llama.cpp\n\n1. Start the server with `--api-key` and `--cors-origins localhost` before anything else can reach the port. Both are off by default\n2. Pass `n_predict` or `max_tokens`. Generation is unbounded by default\n3. Send `response_fields` to /completion to drop the fields you don't read\n4. Wait and retry on a 503 `unavailable_error`. The model is still loading\n5. Read the server README of the build you run. Behaviour changes between nightly builds without a changelog entry\n\n## Other comparisons with Jan or llama.cpp\n\n- [AnythingLLM vs Jan](https://www.anchorterminal.com/compare/anythingllm-vs-jan.md)\n- [AnythingLLM vs llama.cpp](https://www.anchorterminal.com/compare/anythingllm-vs-llama-cpp.md)\n- [GPT4All vs Jan](https://www.anchorterminal.com/compare/gpt4all-vs-jan.md)\n- [GPT4All vs llama.cpp](https://www.anchorterminal.com/compare/gpt4all-vs-llama-cpp.md)\n- [Jan vs Khoj](https://www.anchorterminal.com/compare/jan-vs-khoj.md)\n- [Jan vs LM Studio](https://www.anchorterminal.com/compare/jan-vs-lm-studio.md)\n- [Jan vs LocalAI](https://www.anchorterminal.com/compare/jan-vs-localai.md)\n- [Jan vs Ollama](https://www.anchorterminal.com/compare/jan-vs-ollama.md)\n- [Jan vs Open WebUI](https://www.anchorterminal.com/compare/jan-vs-open-webui.md)\n- [Jan vs screenpipe](https://www.anchorterminal.com/compare/jan-vs-screenpipe.md)\n- [Khoj vs llama.cpp](https://www.anchorterminal.com/compare/khoj-vs-llama-cpp.md)\n- [llama.cpp vs LM Studio](https://www.anchorterminal.com/compare/llama-cpp-vs-lm-studio.md)\n- [llama.cpp vs LocalAI](https://www.anchorterminal.com/compare/llama-cpp-vs-localai.md)\n- [llama.cpp vs Ollama](https://www.anchorterminal.com/compare/llama-cpp-vs-ollama.md)\n- [llama.cpp vs Open WebUI](https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.md)\n- [llama.cpp vs screenpipe](https://www.anchorterminal.com/compare/llama-cpp-vs-screenpipe.md)\n- [Jan vs Underdog](https://www.anchorterminal.com/compare/jan-vs-underdog.md)\n- [llama.cpp vs Underdog](https://www.anchorterminal.com/compare/llama-cpp-vs-underdog.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Jan vs llama.cpp", "url": "" } ], "description": "llama.cpp has a score of 60.2 (C) against Jan's 51.4 (D). Both do local inference. The largest gap is maintenance \u0026 community, 34 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Jan D 51.4", "llama.cpp C 60.2", "scores" ], "h1": "Jan vs llama.cpp", "image": "https://www.anchorterminal.com/assets/og/compare-jan-vs-llama-cpp.png", "path": "/compare/jan-vs-llama-cpp", "published": "2026-10-01", "section": "tools", "title": "Jan vs llama.cpp for AI agents, D 51.4 vs C 60.2 | Anchor Terminal", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/jan-vs-llama-cpp" }, "tokens": { "markdown": 1500, "slim": 330 }, "version": 1 }