Jan vs PrivateGPT

Jan 77

0.8.8, tagged on 27 October 2026 and dated 28 October in the changelog, 8 days before this check (30). Four releases since 6 August, 0.8.5 on 8 October, 0.8.6 on 9 October, 0.8.7 on 19 October and 0.8.8 on 27 October, each with a dated changelog entry (20). New issues get labels and milestones, per the 3 October check, and reply times couldn't be read (15). No MCP registry entry read and no SDK in the stable release. The 0.8.5 notes say agent work stays in the nightly channel (3). A Dependabot config, CI on pushes to main and a pinned Rust toolchain (1.98.0) (9). 30 + 20 + 15 + 3 + 9 = 77.

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

Jan 56

Read with the API lines. The server serves an OpenAPI 3.0 file at /openapi.json with a Swagger page at /, covering 4 paths (models, chat completions, messages, orchestrations) with typed schemas and a bearer scheme, but only 200 responses, and /completions, /embeddings and /messages/count_tokens aren't in it. The spec on the docs site is the retired Cortex API (12). No llms.txt at jan.ai or www.jan.ai (404 on 3 October), and no Markdown copies of pages found (0). The API server page explains each setting and when to change it (127.0.0.1 or 0.0.0.0, the key, CORS for browser clients, server-side tool execution) (12). Request schemas in the spec mark required fields and use enums, while the extra llama.cpp parameters and errors are described only in prose (10). One curl example, and a troubleshooting list for connection refused, 401, 404 and CORS errors. Error bodies are plain text (9). A /v1 prefix, semver releases and a dated changelog with GitHub release notes (13). No llms.txt at www.jan.ai on 4 November (404). 12 + 0 + 12 + 10 + 9 + 13 = 56.

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

Jan 46

Read with the API lines. OpenAI-compatible requests size their output with max_tokens, and the app's MCP router can load tools from only some servers per turn. 0.8.5 caps tool results before they enter the conversation (15). GET /models lists everything, with no paging or filters (8). Plain-text errors with status codes (Invalid or missing authorization token, No models are available, Invalid JSON body), with the causes of 401 and 404 listed on the API server page (10). Stateless chat completions are safe to repeat. No retry or idempotency guidance (6). The defaults suit a local caller (127.0.0.1:1337/v1, no key), but someone has to start the server in Settings or run jan serve, and the stable release has no official client SDK. Any OpenAI or Anthropic SDK works (7). 15 + 8 + 10 + 6 + 7 = 46.

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.

Jan 46

Read with the tool checklist. One optional key typed into Settings, empty by default, accepted as Authorization: Bearer or X-Api-Key, with no scopes, names or keys per client. jan serve --api-key defaults to empty too (10). The app asks before each MCP tool call by default, with an allow-all switch, and server-side tool execution through the API is off by default for every endpoint. The key can't be limited. The 0.0.0.0 bind that dropped Trusted Hosts in 0.8.4 was fixed in 0.8.5 on 8 October 2026, and 0.8.8 checks the Origin of browser requests (11). The docs advise a key when binding to 0.0.0.0 but say nothing on injected instructions in tool results. 0.8.5 caps tool-result size, and 0.8.8 opens links from replies and tool results in the system browser (5). Verbose server logs are on by default with a Server Logs view (10). SECURITY.md, added on 26 October 2026, takes reports through GitHub Security Advisories or security@jan.ai, promises acknowledgement within 3 business days and credits researchers. No bounty and no security.txt at jan.ai. CVE-2026-66005, published by VulnCheck, records the 0.0.0.0 flaw, and the 0.8.8 notes say advisories for its fixes will follow (10). 10 + 11 + 5 + 10 + 10 = 46.

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.

Jan 61

Read with the local-software lines, since Jan runs on the owner's machine with no hosted service behind its API. Installers for macOS 13.6 or later, Windows 10 or later and Linux (.deb and AppImage), plus Flathub and the Microsoft Store, with requirements in the README and the install guides (20). The Linter & Test workflow runs make test-ts and make test-ci-rust on pushes to main that touch the app's code. Its run results are on GitHub's pages, which our reader can't open, so the result is unread and the line takes 15 of 25. 409 open issues and 133 open pull requests on 3 October, with labels, milestones and a stale bot that closes issues after 180 days without activity, not re-read on 4 November (15). Semver tags and a dated changelog per release with Migration notes, but 0.8.5 renamed the desktop executable and stopped bundling the jan CLI in a patch release (11, held as a partial). 0.8.8, pre-1.0 (0). 20 + 15 + 15 + 11 + 0 = 61.

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.

Jan 70

Apache-2.0 for the app, the server and the CLI (30). The privacy policy (Menlo Research Pte Ltd, last updated 16 January 2025) says analytics are opt-in, tied to a random ID, sent to PostHog EU and kept up to 12 months. A second privacy page still names Cortex, a retired engine, and says usage logs never leave the computer. Neither mentions the update check to apps.jan.ai or that new model downloads from Hugging Face go through Menlo's mirror at apps.jan.ai first (14). No deprecation policy. The 0.8.4 and 0.8.5 notes have Migration sections and the 0.8.8 notes list what users might notice, each on release day (6). Analytics are asked for at first launch and off until accepted (the code opts out by default, turns off autocapture and session recording and strips URL properties), with a toggle under Settings, Privacy. The update check and the download mirror aren't disclosed (16). 30 + 14 + 6 + 16 = 66.

PrivateGPT 64

Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.