llama.cpp vs PrivateGPT

llama.cpp 81

Semver release v0.8.0 on 28 October 2026, and build b12087 on 3 November (30). Eleven semver releases from v0.1.0 (17 August) to v0.8.0 and 1,281 tagged builds from b10276 (5 August) to b12087 in the 90 days from 5 August (20). 1,822 commits on master from 450 authors since 5 August. 868 open issues and 1.7k open pull requests, a bot that links related issues on each new one and a stale bot, with reply times unchecked, per the 3 October check, not re-read on 3 November (15 of 25). No official client library for the server. The C API in llama.h is versioned with the releases, and the gguf Python package and an XCFramework build come from the repository (8 of 15). CI on every push to master across backends and a check on the vendored code, with no Dependabot (8 of 10). 30 + 20 + 15 + 8 + 8 = 81.

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

llama.cpp 47

No spec of its own. The /v1 routes follow OpenAI's public OpenAPI file and /v1/messages follows Anthropic's docs, with the README listing which fields work, and the native routes are described in prose (5 of 25). No llms.txt (llama.app/llms.txt still returned 404 on 3 November 2026). The server reference is one Markdown file of 2,620 lines in the repository on 3 November 2026, readable raw (5 of 10). Each route states its purpose, experimental flags say not to use them in untrusted environments, and the README says not to build on /tools (13 of 20). Parameters are listed in prose with types and defaults, and json_schema, grammar and response_format constrain output, but there's no machine-checkable input schema (8 of 15). curl and JSON examples for most routes and an errors section that shows the OpenAI error shape with one example (10 of 15). Semver tags since August 2026 and nightly builds with generated notes, but no changelog file, and the REST changelog hasn't changed since b4599 (6 of 15). 5 + 5 + 13 + 8 + 10 + 6 = 47.

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

llama.cpp 52

Read with the tool checklist, credential model first. Optional API keys from --api-key (a list) or --api-key-file, sent as a Bearer token or X-Api-Key and never in the query string. They have no scopes, change only with a restart and are off by default. TLS is built in, and the server binds 127.0.0.1 by default (15 of 30). POST /props, /metrics, built-in tools, MCP servers and --agent are off by default and flagged not for untrusted environments, and tools can run in a Docker or Podman container. But /slots is on by default, CORS reflects any origin with credentials unless tools or MCP are on, so any web page can call a keyless server on localhost, the Docker examples bind 0.0.0.0 with no key, and every key can do everything (8 of 20). SECURITY.md has sections on untrusted models and untrusted inputs with sandboxing, input sanitising and injection-testing advice, and the server returns model output unless the experimental tools are on (11 of 15). Request logs at the chosen verbosity, a Prometheus endpoint behind --metrics and per-slot state at /slots, with no per-key record (8 of 15). SECURITY.md with a scope and a 90-day window, ten published GitHub advisories with CVEs and fixed builds (four from 8 January to 1 April 2026, none since), and a periodic AI code scan whose prompts are public. Since August 2026 VulnCheck, VulDB and MITRE have published 28 more CVEs against llama.cpp with no advisory from the project. Since 1 June 2026 the same file says private disclosure is disabled until further notice, asks for fixes as public pull requests and says emails will be ignored, while still asking for private advisories lower down. SECURITY.md was unchanged on 3 November. No security.txt or bug bounty (10 of 20). 15 + 8 + 11 + 8 + 10 = 52.

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.

llama.cpp 57

Read with the local-software lines, since llama-server runs on the owner's machine with no hosted service. Official installs through the llama.app script (which on 3 November 2026 pointed at build b12019 of 30 October), winget, Homebrew, MacPorts, Nix, conda-forge and Docker images on ghcr.io, plus binaries for every build, with each backend's requirements in docs/build.md (20). Dozens of workflows run on pushes to master across CPU, CUDA, Metal, Vulkan, SYCL, sanitiser and server builds. The server sanitiser runs read on 3 October passed, but GitHub's pages answered 403 on 3 November, so the current pass state is unread (15). 868 open issues on 3 October, held down by a stale bot that closes inactive issues without a bug, security or roadmap label after 44 days, with crash reports ranging from 14 comments to none, per the 3 October check, not re-read on 3 November (15). Semver since v0.1.0 on 17 August 2026, with a written rule that a breaking change to llama.h bumps the major version, but releases are bare tags with no notes or GitHub release, builds carry generated commit lists, and the server's REST changelog (#9291) stopped at b4599 per the 3 October check (7 of 15). Version 0.8.0, pre-1.0 (0). 20 + 15 + 15 + 7 + 0 = 57.

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.

llama.cpp 73

Read for an API. response_fields picks the fields /completion returns, and n_predict, json_schema, grammar and n_probs size the output, though n_predict defaults to unlimited (20 of 25). Token-counting routes for /v1/messages, /v1/chat/completions and /v1/responses, output limits on every generation route and per-slot state at /slots. Model lists aren't paged (16 of 20). Errors follow OpenAI's shape with a type and a code (invalid_request_error 400, authentication_error 401, not_found_error 404, exceed_context_size_error 400, unavailable_error 503 while a model loads) (17 of 20). Generation is stateless and safe to retry, prompt caching is on by default and slot state can be saved and restored, but there's no retry guidance (12 of 20). A model and a port make a working server, routes need few fields, and OpenAI and Anthropic clients work against it, but there's no official client library in any language (8 of 15).

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.