LM Studio vs vLLM

LM Studio

OpenAI-compatible chat completions, responses, completions and embeddings, Anthropic-compatible /v1/messages and a native /api/v1, all on one port. Authentication is off by default, so any local process can call the server.

vLLM

Apache-2.0 software with a release about every two weeks, each with notes that list breaking changes and security fixes. The optional API key covers only some path prefixes, so /invocations and control routes such as /pause answer without it, and at least 81 security advisories were published in the 12 months to 9 October 2026.

LM Studio

1. Send Authorization: Bearer $LM_API_TOKEN when the owner gives you a token. With Require Authentication on, every request needs it
2. Pass previous_response_id to /api/v1/chat instead of resending the history, and store: false for one-off calls
3. List models with GET /api/v1/models before naming one. A named model that's downloaded loads just in time
4. Install the Python SDK pre-release (1.6.0b1) and pass api_token directly. It reads LMSTUDIO_API_TOKEN, not the LM_API_TOKEN the docs name
5. Set allowed_tools on every MCP integration. Without it the model sees every tool on the server

vLLM

1. Put a reverse proxy that allowlists routes in front of the server. --api-key leaves /invocations and the control routes open
2. Pass --host 127.0.0.1 for single-machine use. With no --host the server listens on every interface
3. Set VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 before starting if nothing should be sent to stats.vllm.ai
4. Start with --enable-auto-tool-choice and the --tool-call-parser for the model before sending tools. Tool calling is off without them
5. Send max_tokens on every request, and read the breaking changes section of the release notes before upgrading a minor version