llama.cpp vs LM Studio

llama.cpp

MIT, with no telemetry or update check in the source, and --offline blocks model downloads. API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost.

LM Studio

OpenAI-compatible chat completions, responses, completions and embeddings, Anthropic-compatible /v1/messages and a native /api/v1, all on one port. Authentication is off by default, so any local process can call the server.

llama.cpp

1. Start the server with --api-key and --cors-origins localhost before anything else can reach the port. Both are off by default
2. Pass n_predict or max_tokens. Generation is unbounded by default
3. Send response_fields to /completion to drop the fields you don't read
4. Wait and retry on a 503 unavailable_error. The model is still loading
5. Read the server README of the build you run. Behaviour changes between nightly builds without a changelog entry

LM Studio

1. Send Authorization: Bearer $LM_API_TOKEN when the owner gives you a token. With Require Authentication on, every request needs it
2. Pass previous_response_id to /api/v1/chat instead of resending the history, and store: false for one-off calls
3. List models with GET /api/v1/models before naming one. A named model that's downloaded loads just in time
4. Install the Python SDK pre-release (1.6.0b1) and pass api_token directly. It reads LMSTUDIO_API_TOKEN, not the LM_API_TOKEN the docs name
5. Set allowed_tools on every MCP integration. Without it the model sees every tool on the server