{ "data": { "a": { "slug": "lm-studio", "name": "LM Studio", "vendor": "Element Labs, Inc.", "vendorUrl": "https://lmstudio.ai", "kind": "http-api", "category": "local-ai", "summary": "Desktop app and headless daemon from Element Labs for running open-weight models on the owner's machine with llama.cpp and MLX, plus the Splash engine on Apple silicon M3 or newer since 0.4.25.", "url": "https://www.anchorterminal.com/tools/lm-studio", "markdownUrl": "https://www.anchorterminal.com/tools/lm-studio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/lm-studio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/lm-studio.json", "repo": "https://github.com/lmstudio-ai/lmstudio-js", "license": "Proprietary. The app and llmster are free for personal and internal business use under LM Studio's terms (Element Labs, Inc., effective 23 August 2026), with no source published. The `lms` CLI and the TypeScript and Python SDKs are MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@lmstudio/sdk" }, { "registry": "pypi", "name": "lmstudio" } ], "auth": "api-key", "authNotes": "No authentication by default. With Require Authentication on (Developer page, Server Settings, LM Studio 0.4.0 or later), every request needs an API token (`sk-lm-` prefix) as `Authorization: Bearer`, or `x-api-key` on the Anthropic-compatible endpoint. Tokens are named, carry permissions picked at creation, are shown once and can be edited or deleted. Calling the owner's mcp.json servers through the API needs authentication on. The server binds to localhost unless Serve on Local Network is on or `lms server start --bind 0.0.0.0` is used.", "pricing": "free", "pricingNotes": "The LM Studio app, llmster and the local server are free for personal and work use with no account or card (free at work since 8 July 2025, and the terms of 23 August 2026 cover internal business use). Element Labs sells cloud model plans for Bionic, its separate agent app, at $20 (Bionic+) and $100 (Pro) a month, which local use of LM Studio doesn't need (checked 2026-10-03).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the SDK source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 69495, "pypiWeekly": 15195, "asOf": "2026-10-03" }, "docsUrl": "https://lmstudio.ai/docs/developer", "llmsTxt": "https://lmstudio.ai/llms.txt", "capabilities": [ "inference.local", "inference.open-weights", "agent.mcp-client", "embed.text" ], "tags": [ "local", "closed-source", "free", "no-card", "account-free", "openai-compatible", "llms-txt", "typescript", "python", "streaming", "pre-1.0" ], "lastRelease": "2026-09-19", "graded": true, "anchor": { "graded": true, "score": 57.9, "grade": "C", "agentReady": false, "rank": 287, "ranked": true, "rankOf": 452, "categoryRank": 4, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 72, "payments": 60, "reliability": 34, "schema": 64, "security": 59, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": 0, "verdict": "OpenAI-compatible chat completions, responses, completions and embeddings, Anthropic-compatible /v1/messages and a native /api/v1, all on one port. Authentication is off by default, so any local process can call the server.", "strengths": [ "OpenAI-compatible chat completions, responses, completions and embeddings, Anthropic-compatible /v1/messages and a native /api/v1, all on one port", "llmster, a headless daemon installed with one command, with a documented systemd setup for Linux servers", "Named API tokens with permissions, and API access to MCP servers behind two switches, one of which also needs authentication on", "Stateful chats with `previous_response_id`, `allowed_tools` per MCP integration and typed error objects", "Seven releases in the 90 days to 3 October 2026, each with dated notes" ], "weaknesses": [ "Authentication is off by default, so any local process can call the server", "Closed-source app and daemon with no public CI or test suite", "The Python SDK's last stable release (1.5.0, 22 August 2025) can't send API tokens, and the docs name an environment variable no release reads", "No OpenAPI file, and the llms.txt we read covers the 0.3 app, not the v1 REST API, tokens, llmster or MCP", "1.7k open issues in the public bug tracker" ], "agentNotes": [ "Send `Authorization: Bearer $LM_API_TOKEN` when the owner gives you a token. With Require Authentication on, every request needs it", "Pass `previous_response_id` to /api/v1/chat instead of resending the history, and `store: false` for one-off calls", "List models with `GET /api/v1/models` before naming one. A named model that's downloaded loads just in time", "Install the Python SDK pre-release (1.6.0b1) and pass `api_token` directly. It reads `LMSTUDIO_API_TOKEN`, not the `LM_API_TOKEN` the docs name", "Set `allowed_tools` on every MCP integration. Without it the model sees every tool on the server" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.9 } ], "editorialScores": { "ergonomics": 69, "maintenance": 72, "payments": 60, "reliability": 34, "schema": 64, "security": 59, "transparency": 55 }, "provenanceScore": 67 }, "connect": { "install": "curl -fsSL https://lmstudio.ai/install.sh | bash # llmster, the headless daemon. Windows: irm https://lmstudio.ai/install.ps1 | iex", "http": "curl http://localhost:1234/api/v1/chat \\\n -H \"Authorization: Bearer $LM_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"ibm/granite-4-micro\", \"input\": \"Write a short haiku about sunrise.\"}'", "claudeCode": "export ANTHROPIC_BASE_URL=http://localhost:1234\nexport ANTHROPIC_AUTH_TOKEN=lmstudio\nexport CLAUDE_CODE_ATTRIBUTION_HEADER=0\nclaude --model openai/gpt-oss-20b" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/lm-studio" }, "area": "models", "provenance": { "legalEntity": "Element Labs, Inc.", "domain": "lmstudio.ai", "domainRegistered": "2023-05-03", "endpointOnVendorDomain": null, "terms": "https://lmstudio.ai/app-terms", "privacy": "https://lmstudio.ai/app-privacy", "statusPage": "", "changelog": "https://lmstudio.ai/changelog/lmstudio", "securityTxt": "none", "checked": "2026-10-03", "notes": [ "The terms (effective 23 August 2026) and the privacy policy (effective June 2026) name Element Labs, Inc., a Delaware corporation at 251 Little Falls Drive, Wilmington.", "There's no hosted endpoint. The server answers on the owner's machine, at localhost:1234 by default.", "lmstudio.ai/.well-known/security.txt returns a Hub web page rather than a security.txt, and we found no security page or SECURITY.md in the public repositories.", "RDAP for lmstudio.ai gives a registration date of 2023-05-03.", "lmstudio.ai/changelog opens on Bionic, the separate agent app. LM Studio's releases are at /changelog/lmstudio." ], "score": 67 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/lm-studio.json", "live": { "slug": "lm-studio", "versions": [ { "registry": "npm", "name": "@lmstudio/sdk", "version": "2.0.0", "seenAt": "2026-10-04T16:31:57.979163993Z" }, { "registry": "pypi", "name": "lmstudio", "version": "1.5.0", "released": "2025-08-22", "seenAt": "2026-10-04T16:32:00.101781677Z" } ], "githubStars": 1786, "npmWeekly": 61084, "pypiWeekly": 14795, "securityTxt": { "url": "https://lmstudio.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:43.57855822Z" }, "llmsTxt": { "url": "https://lmstudio.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:57.079569518Z" }, "domain": { "domain": "lmstudio.ai", "registered": "2023-05-03", "source": "https://rdap.identitydigital.services/rdap/domain/lmstudio.ai", "checkedAt": "2026-10-04T13:08:39.466212979Z" }, "pages": [ { "url": "https://lmstudio.ai/changelog/lmstudio", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:45:43.124111793Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "861d11ad807a" }, { "url": "https://lmstudio.ai/app-privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:45:38.584198725Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2be7166b913e" }, { "url": "https://lmstudio.ai/app-terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:45:40.97136456Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "90222f50fb4b" } ], "updatedAt": "2026-10-04T16:32:00.291286961Z" } }, "b": { "slug": "open-webui", "name": "Open WebUI", "vendor": "Open WebUI Inc.", "vendorUrl": "https://openwebui.com", "kind": "platform", "category": "local-ai", "summary": "Self-hosted web interface for chatting with models, from Open WebUI Inc., with a Python (FastAPI) back end and a Svelte front end.", "url": "https://www.anchorterminal.com/tools/open-webui", "markdownUrl": "https://www.anchorterminal.com/tools/open-webui.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/open-webui.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/open-webui.json", "repo": "https://github.com/open-webui/open-webui", "license": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "open-webui" }, { "registry": "oci", "name": "ghcr.io/open-webui/open-webui" } ], "auth": "api-key", "authNotes": "Sign-in is on by default (`WEBUI_AUTH`), the first account to sign up becomes admin, and sign-up then closes. An agent calls the API with `Authorization: Bearer \u003ctoken\u003e`, either an `sk-` API key from Settings \u003e Account or a session JWT, which lasts four weeks by default (`JWT_EXPIRES_IN`), and behind a reverse proxy that uses `Authorization` itself the key can go in an `x-api-key` header (https://docs.openwebui.com/reference/api-endpoints). API keys stay off until an administrator turns them on (`ENABLE_API_KEYS` defaults to false), a group permission decides who may create one, and they can be limited instance-wide to listed endpoints with `ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS` and `API_KEYS_ALLOWED_ENDPOINTS` (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/config.py). Each user has one key, `sk-` plus 32 hexadecimal characters, stored as plain text with a last-used time and no expiry set by the API (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py). People sign in with email and password, OAuth or OIDC, LDAP or trusted headers, with SCIM 2.0 provisioning.", "pricing": "free", "pricingNotes": "Free to self-host under the Open WebUI License. Deployments with more than 50 end users in a rolling 30 days have to keep the Open WebUI branding unless they hold an enterprise licence or written permission. The enterprise licence (white-labelling, SLA-backed support, Terminals) is sold through sales to registered organisations only, with no published prices (https://docs.openwebui.com/enterprise). There's no hosted Open WebUI service. You pay your model provider, or nothing with a local model (checked 2026-10-03).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 153000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://docs.openwebui.com", "llmsTxt": "https://docs.openwebui.com/llms.txt", "capabilities": [ "inference.local", "agent.mcp-client", "memory.user", "knowledge.search" ], "tags": [ "self-hosted", "local", "free", "python", "docker", "openai-compatible", "llms-txt", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 52, "grade": "D", "agentReady": false, "rank": 345, "ranked": true, "rankOf": 452, "categoryRank": 7, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -8, "negativeNotes": [ "2026-05-05. GHSA-2r4p-jpmg-48f4 (CVE-2026-44551, Critical, 9.1). LDAP sign-in accepted an empty password where the directory allows unauthenticated binds, giving full access to the victim's account. It affects 0.8.12 and earlier and was fixed in 0.9.0 (21 April 2026) before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4", "2026-07-02. GHSA-74h3-cxq7-vc5q (CVE-2026-59216, 7.7). A signed-in low-privilege user could run code and tools in another user's session through an unchecked Socket.IO session_id, which against an administrator meant code execution as the server process (root in default containers). Fixed in 0.10.0 on 29 June 2026 and published three days later, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q", "2026-08-02 and 2026-09-04. Two account takeovers through OAuth, both High. GHSA-rq84-p6rr-vf89 accepted tokens issued to any client in the OAuth token exchange (fixed in 0.11.0), and GHSA-wpmr-8h3q-fwj7 (8.1) matched OAuth and OIDC subjects by substring on SQLite, so a crafted subject could sign in as an existing account, administrators included (fixed in 0.11.1 on 25 August). Both fixed before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-rq84-p6rr-vf89; https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "2025-10-03 to 2026-10-03. The rest of the year's record. GitHub reviewed 143 of the repository's advisories in the 12 months to 3 October 2026, and 129 cover flaws fixed in releases from 0.6.35 (6 November 2025) on, 58 High and 1 Critical, more than half of them access-control or authorisation flaws by their titles and CWE tags. July to September alone brought 52 (18 High, 29 Moderate, 5 Low) in batches published on 2 July, 2 August and 4 September. Each was fixed in a release before publication, so the 125 beyond the four above count together, -2. https://github.com/open-webui/open-webui/security/advisories; https://github.com/advisories?query=open-webui+type%3Areviewed+ecosystem%3Apip" ], "verdict": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.", "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations", "OpenAI-compatible `/api/chat/completions` and `/api/models`, plus an Anthropic Messages route and an Ollama proxy, so OpenAI's SDKs work against a local instance", "Roles, groups, per-model and per-knowledge access grants, a group permission for key creation and an instance-wide endpoint allowlist for keys", "An audit log at metadata, request or request-and-response level, plus events for key creation and deletion", "No product telemetry found, third-party analytics off in the Docker image, and `OFFLINE_MODE` to stop the release check and model downloads" ], "weaknesses": [ "API keys are off by default, and each user gets one key with no scopes or expiry", "The API reference covers seven route groups, and the OpenAPI file and Swagger UI need `ENV=dev`", "52 advisories published from July to September 2026, 18 of them High, including cross-user code execution (CVE-2026-59216) and two OAuth account takeovers, all fixed", "Pre-1.0 (0.11), with database migrations in patch releases and no rolling updates during them", "The branding clause makes the licence non-OSI, and the enterprise licence has no published price" ], "agentNotes": [ "Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then", "Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself", "Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections", "Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base", "Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52 } ], "editorialScores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 66 }, "provenanceScore": 79 }, "connect": { "install": "pip install open-webui \u0026\u0026 open-webui serve # or: docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main", "http": "curl -X POST http://localhost:3000/api/chat/completions \\\n -H \"Authorization: Bearer $OPEN_WEBUI_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"llama3.1\", \"messages\": [{\"role\": \"user\", \"content\": \"Why is the sky blue?\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/open-webui" }, "area": "models", "provenance": { "legalEntity": "Open WebUI Inc.", "domain": "openwebui.com", "domainRegistered": "2024-02-17", "endpointOnVendorDomain": null, "terms": "https://openwebui.com/terms", "privacy": "https://openwebui.com/privacy", "statusPage": "", "changelog": "https://github.com/open-webui/open-webui/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-03", "notes": [ "The LICENSE copyright line names Open WebUI Inc., created by Timothy Jaeryang Baek, and the privacy policy names Open WebUI, Inc. with no address.", "openwebui.com/.well-known/security.txt points to GitHub Security Advisories and expires on 2027-06-30.", "The privacy policy, last updated on 31 December 2025, covers openwebui.com and its community services only, says nothing about the self-hosted software, and gives no retention periods.", "We found no status page linked from openwebui.com. There's no hosted service, so an instance answers on its owner's own host.", "RDAP for openwebui.com gives a registration date of 2024-02-17, registrar Cloudflare. The terms page wasn't read for this check." ], "score": 79 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/open-webui.json", "live": { "slug": "open-webui", "versions": [ { "registry": "github", "name": "open-webui/open-webui", "version": "v0.11.4", "released": "2026-09-21", "seenAt": "2026-10-04T16:35:15.328941559Z" }, { "registry": "pypi", "name": "open-webui", "version": "0.11.4", "released": "2026-09-21", "seenAt": "2026-10-04T16:35:15.214147757Z" } ], "githubStars": 153934, "pypiWeekly": 235140, "securityTxt": { "url": "https://openwebui.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T00:00:00Z", "checkedAt": "2026-10-04T15:15:55.536560702Z" }, "llmsTxt": { "url": "https://docs.openwebui.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:04.221173659Z" }, "domain": { "domain": "openwebui.com", "registered": "2024-02-17", "source": "https://rdap.verisign.com/com/v1/domain/openwebui.com", "checkedAt": "2026-10-04T13:06:48.742159254Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/open-webui/open-webui/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:47:49.239650644Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3c27bf8cc8f9" }, { "url": "https://openwebui.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:46:32.010185663Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ab8757357aa3" }, { "url": "https://openwebui.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:46:35.689261473Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87cd832136e7" } ], "updatedAt": "2026-10-04T16:35:15.328941559Z" } }, "summary": "LM Studio has a score of 57.9 (C) against Open WebUI's 52 (D). Both do local inference. The largest gap is payments \u0026 pricing, 40 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui", "json": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.md", "slim": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.min.md" }, "markdown": "LM Studio has a score of 57.9 (C) against Open WebUI's 52 (D). Both do local inference. The largest gap is payments \u0026 pricing, 40 points.\n\n- LM Studio: grade C, 57.9/100, rank #287 of 452. Markdown https://www.anchorterminal.com/tools/lm-studio.md · JSON https://www.anchorterminal.com/api/v1/tools/lm-studio.json\n- Open WebUI: grade D, 52/100, rank #345 of 452. Markdown https://www.anchorterminal.com/tools/open-webui.md · JSON https://www.anchorterminal.com/api/v1/tools/open-webui.json\n\n## Which one, for what\n\nPick LM Studio for agent ergonomics (+15), payments \u0026 pricing (+40).\n\nPick Open WebUI for reliability (+34), maintenance \u0026 community (+19), transparency \u0026 trust (+12).\n\n## Score by category\n\n| Category | Weight | LM Studio | Open WebUI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 34 | 68 | Open WebUI +34 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 64 | 60 | LM Studio +4 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 54 | LM Studio +15 |\n| Security \u0026 auth | 14% (17.5 this run) | 59 | 63 | Open WebUI +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 20 | LM Studio +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 91 | Open WebUI +19 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 61 | 73 | Open WebUI +12 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **57.9 · C** | **52 · D** | |\n\n## Facts side by side\n\n| Fact | LM Studio | Open WebUI |\n| --- | --- | --- |\n| Kind | HTTP API | Model platform |\n| Vendor | Element Labs, Inc. | Open WebUI Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Proprietary. The app and llmster are free for personal and internal business use under LM Studio's terms (Element Labs, Inc., effective 23 August 2026), with no source published. The `lms` CLI and the TypeScript and Python SDKs are MIT | Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-19 | 2026-09-21 |\n| Popularity | 69k npm/wk, 15k PyPI/wk | 153k stars |\n| Agent reviews | 2.5/5 (2) | 2.5/5 (2) |\n\n## Verdicts\n\n**LM Studio.** OpenAI-compatible chat completions, responses, completions and embeddings, Anthropic-compatible /v1/messages and a native /api/v1, all on one port. Authentication is off by default, so any local process can call the server.\n\n**Open WebUI.** Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.\n\n## Before you call either\n\n### LM Studio\n\n1. Send `Authorization: Bearer $LM_API_TOKEN` when the owner gives you a token. With Require Authentication on, every request needs it\n2. Pass `previous_response_id` to /api/v1/chat instead of resending the history, and `store: false` for one-off calls\n3. List models with `GET /api/v1/models` before naming one. A named model that's downloaded loads just in time\n4. Install the Python SDK pre-release (1.6.0b1) and pass `api_token` directly. It reads `LMSTUDIO_API_TOKEN`, not the `LM_API_TOKEN` the docs name\n5. Set `allowed_tools` on every MCP integration. Without it the model sees every tool on the server\n\n### Open WebUI\n\n1. Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then\n2. Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself\n3. Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections\n4. Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base\n5. Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist\n\n## Other comparisons with LM Studio or Open WebUI\n\n- [AnythingLLM vs LM Studio](https://www.anchorterminal.com/compare/anythingllm-vs-lm-studio.md)\n- [AnythingLLM vs Open WebUI](https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.md)\n- [GPT4All vs LM Studio](https://www.anchorterminal.com/compare/gpt4all-vs-lm-studio.md)\n- [GPT4All vs Open WebUI](https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.md)\n- [Jan vs LM Studio](https://www.anchorterminal.com/compare/jan-vs-lm-studio.md)\n- [Jan vs Open WebUI](https://www.anchorterminal.com/compare/jan-vs-open-webui.md)\n- [Khoj vs LM Studio](https://www.anchorterminal.com/compare/khoj-vs-lm-studio.md)\n- [Khoj vs Open WebUI](https://www.anchorterminal.com/compare/khoj-vs-open-webui.md)\n- [llama.cpp vs LM Studio](https://www.anchorterminal.com/compare/llama-cpp-vs-lm-studio.md)\n- [llama.cpp vs Open WebUI](https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.md)\n- [LM Studio vs LocalAI](https://www.anchorterminal.com/compare/lm-studio-vs-localai.md)\n- [LM Studio vs Ollama](https://www.anchorterminal.com/compare/lm-studio-vs-ollama.md)\n- [LM Studio vs screenpipe](https://www.anchorterminal.com/compare/lm-studio-vs-screenpipe.md)\n- [LocalAI vs Open WebUI](https://www.anchorterminal.com/compare/localai-vs-open-webui.md)\n- [Ollama vs Open WebUI](https://www.anchorterminal.com/compare/ollama-vs-open-webui.md)\n- [Open WebUI vs screenpipe](https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.md)\n- [LM Studio vs Underdog](https://www.anchorterminal.com/compare/lm-studio-vs-underdog.md)\n\n## Disclosure\n\n- Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "LM Studio vs Open WebUI", "url": "" } ], "description": "LM Studio has a score of 57.9 (C) against Open WebUI's 52 (D). Both do local inference. The largest gap is payments \u0026 pricing, 40 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "LM Studio C 57.9", "Open WebUI D 52", "scores" ], "h1": "LM Studio vs Open WebUI", "image": "https://www.anchorterminal.com/assets/og/compare-lm-studio-vs-open-webui.png", "path": "/compare/lm-studio-vs-open-webui", "published": "2026-10-01", "section": "tools", "title": "LM Studio vs Open WebUI for AI agents, C 57.9 vs D 52", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui" }, "tokens": { "markdown": 1850, "slim": 330 }, "version": 1 }