llama.cpp vs Ollama

llama.cpp

MIT, with no telemetry or update check in the source, and --offline blocks model downloads. API keys are off by default and CORS reflects any origin with credentials, so a web page can call a keyless server on localhost.

Ollama

An OpenAPI 3.1 file for the 15 native operations and llms.txt with 68 links to Markdown pages. No credential on the local API, and any caller that reaches it can pull, push, create and delete models.

llama.cpp

1. Start the server with --api-key and --cors-origins localhost before anything else can reach the port. Both are off by default
2. Pass n_predict or max_tokens. Generation is unbounded by default
3. Send response_fields to /completion to drop the fields you don't read
4. Wait and retry on a 503 unavailable_error. The model is still loading
5. Read the server README of the build you run. Behaviour changes between nightly builds without a changelog entry

Ollama

1. Send "stream": false for one JSON body. The native routes stream NDJSON by default
2. Set OLLAMA_CONTEXT_LENGTH=64000 or options.num_ctx before agent work. The default is 4k below 24 GiB of VRAM
3. Back off on a 503. It means the queue (512 by default) is full
4. Put an authenticating proxy in front before binding past 127.0.0.1. The server checks no credential
5. Expect model names with a cloud tag to run on Ollama's servers. They need ollama signin and fail with OLLAMA_NO_CLOUD=1