Khoj vs Underdog

Khoj 71

Read with the local-software lines, since Khoj Cloud closed on 15 April 2026 and an agent calls the HTTP API of a server its owner runs (gpt4all, also kind platform, read the same way). The khoj package on PyPI and the ghcr.io/khoj-ai/khoj image, with Python 3.10 to 3.12 stated in pyproject.toml and the setup docs. Both documented installs give 1.42.10 (20). The test workflow runs uv run pytest on Python 3.10, 3.11 and 3.12 against Postgres with pgvector on pushes to master and release/1.x that touch the server, with 24 test files in the clone. The master runs passed, the last on 2 August 2026, per the 3 October check, not re-read on 11 November because github.com refuses our reader, and master hasn't changed since (25). 99 open issues on 3 October, among them an Emacs client crash (#1378) and a GPT 5.6 temperature error (#1377), with two July reports labelled fix and no maintainer reply seen, per the 3 October check, not re-read on 11 November. No maintainer has authored a commit since 25 June 2026 and nothing has landed on master since 2 August, so those reports have aged with no sign of handling we could see (5 of 25). Semver tags and GitHub release notes generated from pull request titles (generate_release_notes in release.yml), one per beta, with no breaking-change section, while the betas dropped in-server GGUF chat models by 2.0.0-beta.13. Partly met, so the earlier partial stays (6 of 15). 1.42.10 is past 1.0 and pyproject.toml declares Production/Stable (15). 20 + 25 + 5 + 6 + 15 = 71.

Underdog 0

Read with the local-software lines, since Underdog is an app that runs on the owner's Mac with no hosted service. The app's download, system requirements and version are on underdog.ai, whose robots.txt disallows ClaudeBot (re-read on 11 November 2026), so they are unread. Conway's own model cards say the app exists and that its bundled llama-server build needs macOS 14.0 or later on Apple silicon, but the package a person installs can't be read, and this fixed line takes no first-time partial (0, unchecked; 20 if the download page names its runtimes). The app's source isn't public, so there's no public CI or test suite (0). No public issue tracker for the app was found (0). No app changelog or version history readable outside underdog.ai (0). No app version readable, so not shown to be 1.0 or declared stable. Conway's models carry 1.0, 1.1 and 3.0 version names, which aren't the app's (0). 0 + 0 + 0 + 0 + 0 = 0. Low because underdog.ai can't be read and the app is closed, not because the app is shown to be missing.

Khoj 64

AGPL-3.0-or-later in LICENSE and pyproject.toml, for the server and the clients (30). The khoj.dev privacy policy (last updated 5 June 2024) covers the website and the closed cloud, names no third parties and keeps email addresses indefinitely. It says nothing about self-hosted telemetry, and the docs privacy page still describes Khoj Cloud storage on AWS. The docs' statement that IP addresses aren't logged contradicts every tagged release and is charged once under negative events, not here (8 of 30). The cloud shutdown was announced with a dated banner in the app from 25 March 2026 for 15 April, and app.khoj.dev now carries a sunset notice dated 15 April 2026. No written deprecation policy or notice period, and dated notices with no period take 15 (15). Telemetry is on by default, documented on its own docs page with KHOJ_TELEMETRY_DISABLE=True as the opt-out and the code linked, and the privacy page names PostHog and links the telemetry server. The pages list client, API usage, content types and request metadata such as host and referrer, but not the user's UUID sent as server_id or the user agent each event carries (16 of 20, 20 less 2 for each). 30 + 8 + 15 + 16 = 69.

Underdog 17

The app's source isn't published and its terms on underdog.ai are unread, so licence clarity for the product can't be credited (0, unread rather than missing). Conway's model weights on Hugging Face switched from Apache-2.0 to CC BY-NC 4.0 in commits titled "Switch the license to CC BY-NC 4.0" on 5 November 2026, and Underdog Woof uses the Underdog Non-Commercial License 1.0. Those are the weights' terms, not the app's. The privacy policy on underdog.ai is unread. The Bark 3.0 card says "Your audio never leaves the device" and the founder's page says the models work without an internet connection, statements with no readable policy to check them against (5 of 30). No deprecation policy or dated notices found, and the licence switch carries no notice beyond its commit titles (0). No telemetry statement readable (0). 0 + 5 + 0 + 0 = 5. Low largely because underdog.ai can't be read.

Khoj 45

Read with the API lines for the self-hosted HTTP API. /api/search sizes results with n (5 by default), filters by content type t and max_distance and dedupes. Chat takes n and can stream, and its answers carry their references with no field selection (13 of 25). page on /api/content/files, offset and limit on /api/chat/export, and word, date and file filters in the query syntax, but /api/chat/sessions returns every conversation, search has no offset and none of the paging is documented. Partly met, so the earlier partial stays (12 of 20). Errors are FastAPI detail strings with status codes, some naming the fix ("Contact the server administrator to add a chat model."), none documented. Partly met, earlier partial kept (8 of 20). No idempotency keys or retry guidance. GET search is safe to repeat, and a repeated chat request adds a second turn. Partly met, earlier partial kept (5 of 20). Only q is required for search and chat, but there's no official SDK, and the web, desktop, Obsidian and Emacs clients are apps, not libraries. Partly met, earlier partial kept (7 of 15). 13 + 12 + 8 + 5 + 7 = 45.

Underdog 0

No outside-agent interface from Conway, so every line scores 0 (fresha-ai-concierge, lola). Running Conway's weights through llama.cpp, Splash or Ollama is those engines' interface, not Underdog's. 0 + 0 + 0 + 0 + 0 = 0.

Khoj 11

The newest stable release is 1.42.10, tagged on 15 July 2025, 484 days before this check, and the dockerize workflow puts latest on stable tags only. The newest tag, 2.0.0-beta.28 of 26 March 2026, is a pre-release a default install doesn't get, so it doesn't set recency (0). No tag of any kind in the 90 days from 13 August (0). github.com refuses our reader, so issue replies are unread on 11 November. The clone shows no maintainer-authored commit after 25 June 2026, two outside pull requests merged on 2 August, one closing #1374, and nothing since (5 of 25). No MCP server and no official SDK (0). Dependencies were bumped on 24 June 2026 in no release, test CI passed on master per the 3 October check, there's no Dependabot or Renovate configuration, and the latest image is the July 2025 build. Partly met, so the earlier partial stays (6 of 10). 0 + 0 + 5 + 0 + 6 = 11.

Underdog 56

Read as a closed product, from Conway's dated releases of the components its own cards say the app runs, since the app's changelog is on underdog.ai and unread. Underdog Bark 3.0, whose card says Underdog runs it on the device, and Bark 3.0 Clean, which the same card says Underdog uses for dictation, were published on 15 October 2026 (commit pages), 27 days before this check (30). Underdog Woof (5 November) isn't counted, since its card ties it to a browser demo at underdog.ai/woof and doesn't say the Mac app runs it. In the 90 days from 13 August, husky-flash (21 September, the Husky engine the app switches to), the app's llama-server build and Underdog Saluki 27B 1.0 (8 October, run by that build) and Bark 3.0 (15 October) (20). No public tracker or readable changelog for the app. Contact addresses root@conway.tech and license@conway.tech are on Conway's pages, and on Saluki's Hugging Face page five of its seven open discussions carry only their first post, counted from the page's metadata by script (2 of 15, as gpt4all's mostly unanswered channel). No SDK or MCP registry entry (0). The bundled llama-server is pinned to llama.cpp commit bd4eeaa of 7 October 2026 (read in a shallow fetch of llama.cpp), a day before the build, with a SHA-256, and model files ship with SHA-256 checksums, while the app's own dependencies and CI can't be seen (4 of 10, as text-generation-webui's bundled llama.cpp). 30 + 20 + 2 + 0 + 4 = 56. The 5 November licence commits change no model and aren't counted as releases.

Khoj 33

Read with the tool checklist for the self-hosted server. Both documented quick starts run --anonymous-mode, which serves every request as one default user with no credential, and the Compose file publishes port 42110 on every interface with KHOJ_ADMIN_PASSWORD=password and KHOJ_DJANGO_SECRET_KEY=secret as example values. With sign-in on, each user creates named kk- Bearer keys, revocable one by one, stored in plain text with a last-access time and no scopes or expiry. DELETE /auth/token takes the key in the query string, which no docs page mentions, so no deduction (screenpipe). Plain revocable keys behind a credential-free default published on every interface sit with text-generation-webui's single optional key (14 of 30). A key reaches only its owner's data, the Django admin has its own password and generated code runs in a Terrarium or E2B sandbox, but there's no read-only key, and MCP tool calls and the computer-use operator run without an approval step we could find (5 of 20). Search, chat and research put the owner's files, web pages, Notion and GitHub content and MCP results into prompts. Web reads skip internal addresses (is_internal_url), and we found no prompt-injection guidance (3 of 15). Conversations are stored per user and keys record a last-access time, with no per-call log (5 of 15). No SECURITY.md in the clone, no security.txt at khoj.dev (404 on 11 November), and no bounty or certification. Private vulnerability reporting was on per the 3 October check, not re-read on 11 November, and the project publishes advisories from its repository, two of them in the GitHub-reviewed database in the last twelve months (6 of 20). 14 + 5 + 3 + 5 + 6 = 33. Advisories are charged one by one under negative events.

Underdog 3

Read with the tool checklist for the app, for the surface an outside agent can call, of which Conway publishes none (fresha-ai-concierge, lola). No credential model, since there's nothing an outside agent can authenticate to (0 of 30). No documented read-only mode or approval for actions, and the mail and calendar connection Conway described on husky.underdog.ai is struck, since that host now refuses our reader (0 of 20). No prompt-injection guidance found (0 of 15). No audit or per-call log documented (0 of 15). No security.txt at conway.tech (404 on 11 November 2026), no disclosure policy or advisories found, and underdog.ai unread. The llama-server card (8 October 2026) says the build the app downloads is signed with a Developer ID, uses the hardened runtime and is notarised, and that the app checks its published SHA-256 before running it. The Bark 3.0 card says the app checks pinned sizes and SHA-256 for its model files. Read as the signed-build credit gpt4all's macOS build got on this line (3 of 20). 0 + 0 + 0 + 0 + 3 = 3.

Khoj 21

Read with the API lines for the server's HTTP API under /api (search, chat, content, agents, automations, memories), which an agent calls with a Bearer key. Khoj documents no HTTP API. FastAPI's /openapi.json stays on in every version, since src/khoj/main.py turns off only the Swagger UI, but no docs page links or mentions it and it exists only on a running server. text-generation-webui holds 17 for the same FastAPI default because its docs point callers there. Nothing here does, so there's no published contract (0). No llms.txt at docs.khoj.dev (404 on 11 November) and no Markdown copies served (0). 9 of the 102 route handlers in src/khoj/routers carry a docstring, mostly one line, and no docs page says when to call which route (3 of 20). Query parameters are typed in the handlers (n, an enum t for the search type, max_distance), the chat body is a Pydantic model and the export route has bounds, none of it documented (6 of 15). No API request examples and no documented errors. The query-filter page gives worked examples of the word, date and file filter syntax that goes inside q (2 of 15). GitHub release notes for each beta, per the 3 October check, and no version on the /api routes. Partly met, so the earlier partial stays (10 of 15). 0 + 0 + 3 + 6 + 2 + 10 = 21.

Underdog 0

No interface an outside agent can call was found from Conway (no API, MCP server, CLI or SDK), so the interface lines score 0, as for fresha-ai-concierge and lola. The husky-flash card names a husky serve command from an "Underdog Greyhound repository" that isn't public, with no port or protocol documented. The Underdog app downloads an unmodified llama.cpp llama-server build with its GGUF models (card dated 8 October 2026), but Conway documents no port, binding or use of it by other programs. No llms.txt at conway.tech (404 on 11 November) and underdog.ai unread (0). Model cards with run commands describe the weights, not the app (0). 0 + 0 + 0 + 0 + 0 + 0 = 0.