KoboldCpp vs PrivateGPT

KoboldCpp 82

Release 1.124.2 on 2 November 2026, tagged the day before this check, read from the tag dates in a clone since GitHub's release pages refuse our session (30). Ten tagged releases since 5 August 2026 (1.119 on 15 August, 1.120, 1.121, 1.122, 1.122.1, 1.123, 1.123.1, 1.124, 1.124.1 and 1.124.2) (20). 524 open issues and 5 open pull requests, with replies on all 24 of the newest open issues, per the 8 October check, not re-read on 3 November. The README points to GitHub Discussions and a Discord server. One person, Concedo, is the main author of the project's own commits (20 of 25). No client library. The official Docker image was last updated on 14 September 2026, before the six newest releases, and has 167,319 pulls (6 of 15). Upstream llama.cpp is merged regularly and builds run on GitHub Actions for five targets, but they are started by hand, requirements.txt pins only minimum versions and there's no Dependabot (6 of 10). 30 + 20 + 20 + 6 + 6 = 82.

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

KoboldCpp 55

The editorial half. AGPL-3.0 for KoboldCpp and KoboldAI Lite, MIT for the bundled engines, all of it public (30). No privacy policy. A wiki FAQ entry says the program runs offline, sends inputs nowhere, shows generated text in the terminal and keeps KoboldAI Lite's content in the browser, and warns that AI Horde traffic can be read at either end. That agrees with koboldcpp.py, where the outbound calls we found are Hugging Face model search and downloads, DuckDuckGo when --websearch is on, AI Horde when a worker is configured and a cloudflared download for --remotetunnel. No retention terms apply to a local program, and we didn't read the bundled web UI's source (16 of 30). Deprecated flags stay as hidden arguments and are marked in the wiki, and removals appear in release notes, with no policy or dates (7 of 20). No telemetry, analytics or update check in koboldcpp.py, so nothing to opt out of. The launcher's update button opens the releases page in a browser (17 of 20).

PrivateGPT 64

Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.

KoboldCpp 63

Read with the local-software lines, since KoboldCpp runs on the owner's machine with no hosted service. Single-file binaries on GitHub releases for Windows x64, Linux x64 and Apple Silicon macOS, with nocuda and oldpc variants and the hardware each suits stated in the README and release notes, plus the koboldai/koboldcpp Docker image. No package-manager release of the project's own, since the Nix and AUR packages are third-party (18 of 20). Eight workflows in the repository at 1.124.2, all builds started by hand. The AutoGuess test that ran on pull requests and three unofficial test builds were gone by 1.123 (13 October 2026), so no workflow runs the test suite. The macOS build, also started by hand, runs the built binary once on a small model as its only check. The tests folder holds 526 lines of Python in four files that nothing runs automatically (5 of 25). 524 open issues and 5 open pull requests with no stale bot, and replies on the 24 newest open issues, per the 8 October check, not re-read on 3 November, since GitHub's pages refuse our session (16 of 25). Sequential 1.x version numbers with notes on every release. 1.123 replaced --multiuser with --queuelimit and kept the old flag as a hidden deprecated argument, so existing launch commands still start. No changelog file and no stated semver rule (9 of 15). Version 1.124.2 (15). 18 + 5 + 16 + 9 + 15 = 63.

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.

KoboldCpp 38

Read with the tool checklist, credential model first. No credential by default. --password sets one shared key, sent as a Bearer token and never read from the query string, with a separate --adminpassword for admin routes. Keys have no scopes and change only with a restart, and the key doesn't cover image generation, upscaling, /sdapi/v1/interrogate or /tts_to_audio, as the --help text says (11 of 30). Admin mode, web search, MCP servers and the agent are off by default, the agent asks for confirmation of tool calls unless set to auto or off, and /api/extra/shutdown answers only local callers with --singleinstance. But with no --host the server listens on all routable interfaces, CORS reflects any Origin with credentials and allows private-network requests, so a web page or another machine on the network can call a server with no password (7 of 20). The server returns model output unless web search or MCP tools are on. The wiki lists flags for a public instance and the 1.122 notes tell users to take care when approving tool calls, with no guidance on untrusted content (7 of 15). Prompts and outputs print to the terminal unless --quiet is set and /api/extra/perf gives timing counters. No per-key record or log file was found (6 of 15). No SECURITY.md (none in the repository at 1.124.2), security.txt or bug bounty. GitHub private vulnerability reporting is open, and one advisory was published on 29 August 2026 (GHSA-qhvp-gj7g-rw26, Low) with the fix committed on 18 August, per the 8 October check (GitHub's pages weren't readable on 3 November and OSV holds no record of it). 1.124 masks passwords and keys in the startup print, and further bounds checks for the legacy loaders landed in 1.124, hardening that names no flaw (7 of 20).

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.