LocalAI vs PrivateGPT

LocalAI 80

v4.12.1 on 23 October 2026, after v4.12.0 on 22 October (30). Eight releases in the 90 days from 3 August, from v4.8.0 on 5 August to v4.12.1, all changing code (20). Recent bug reports carry an unconfirmed label, comment threads didn't render for our reader on 3 October, github.com refused us on 1 November, and a stale bot closes quiet issues after 95 days, per the 3 October check (15 of 25). No official MCP registry entry for local-ai mcp-server (a search for localai on 1 November returned three unrelated servers) and no LocalAI client SDK, though OpenAI, Anthropic and Ollama SDKs work against it (5 of 15). Renovate and daily bump workflows keep the backends current, and CI passes on master per the 3 October check (10).

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

LocalAI 62

Read with the tool checklist. Credentials are off until the operator sets them. With neither keys nor accounts the server answers every caller, and it refuses to start on a public address in that state unless --allow-insecure-public-bind is set, while loopback, LAN and VPN binds stay open. Keys from LOCALAI_API_KEY grant full admin. With LOCALAI_AUTH, users create their own keys, stored as HMAC-SHA256, revocable, pausable since v4.12.0 and with an optional expiry in the source, each carrying the user's role and per-model and per-capability permissions. No key in a query string (22 of 30). The user role reaches inference only, agents, skills and fine-tuning start off for new users, per-user quotas cap requests and tokens, and the MCP server has a --read-only mode. Its mutating tools are held back by a system-prompt rule alone, and the docs say there's no code-side preview or apply step (14 of 20). Agents and MCP tools bring web pages and tool output into the model, and we found no prompt-injection guidance. A PII redaction tier and a moderation endpoint exist (4 of 15). Traces, backend logs and per-user and per-key usage for admins, and Prometheus metrics at /metrics (13 of 15). SECURITY.md with security@localai.io, a 48-hour acknowledgement and Huntr, GitHub private reporting, gosec on every push and cosign-signed backend images. No bounty, no security.txt, SECURITY.md still calls 3.x the current series, backend integrity checks warn rather than refuse by default (LOCALAI_REQUIRE_BACKEND_INTEGRITY), no GitHub advisory for CVE-2026-59707, and none found for the alias-route authentication bypass fixed in v4.9.0 (9 of 20).

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.

LocalAI 84

Read with the local-software lines, since LocalAI runs on the owner's hardware with no hosted service behind it. Docker Hub images per accelerator (CUDA 12 and 13, ROCm, Intel oneAPI, Vulkan, Jetson L4T and CPU), Linux binaries for amd64 and arm64 on GitHub releases, a Kubernetes guide and Go 1.26 for source builds. The macOS DMG isn't signed by Apple and needs its quarantine flag removed, and issue #11410 reports that the 4.8.0 DMG held 4.7.1 (18 of 20). The Tests workflow runs on every push to master and on pull requests, and its last 10 runs on master had passed on 3 October 2026, beside end-to-end, UI, AIO and gosec workflows, per the 3 October check, not re-read on 1 November (github.com refused us). Commits of 23 and 24 October fix failures on master (25). The issues tab showed 87 open and the repository header 113 on 3 October, not re-read on 1 November. Recent bug reports carry an unconfirmed label, among them a start-up warm-up that downloads over 1 GB each time (#11483) and pinned models unloaded after every request (#11101), and a stale bot closes issues after 95 quiet days, which keeps the count down (18 of 25). Semver tags with notes on every release, but no breaking-change section, and v4.9.0's new credential requirement on /version and generated-file URLs sat in the body of the notes (8 of 15). v4.12.1 on 23 October 2026, stable (15).

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.

LocalAI 53

MIT, with each backend image carrying its upstream engine under that engine's licence (30). There's no privacy policy for localai.io or the software. The README and the overview say data never leaves the machine, and we found no telemetry in the source, but a default start fetches the gallery index from index.localai.io and probes model files to estimate their size, and nothing says what index.localai.io logs or keeps (12 of 30). Deprecated flags are marked in the CLI reference and still work, and SECURITY.md dates the end of 1.x and 2.x support, but it hasn't been updated for 3.x or 4.x (8 of 20). No telemetry or analytics library in the Go source, OpenTelemetry metrics stay on the instance, and the gallery fetches are documented with an offline cache. The start-up size probes aren't described as network calls anywhere we read (17 of 20).

PrivateGPT 64

Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.

LocalAI 71

Read with the API lines for the OpenAI-compatible surface an agent calls. Responses size through max_tokens and streaming, and the llama.cpp prompt cache has been on by default since 4.3.0. The MCP admin server is the heavier surface, 42 tools in about 6,300 characters of descriptions, and --read-only halves it to 21 (18 of 25). limit and offset or starting_after on some list endpoints, and a capability filter on installed models (14 of 20). Errors arrive in the caller's own envelope (OpenAI, Anthropic or Open Responses) with a type and a message, 401 adds WWW-Authenticate, and 429 and 503 carry Retry-After, with load progress while a model warms (18 of 20). No idempotency keys, and no readOnlyHint or destructiveHint on the MCP tools. Inference calls are stateless and safe to repeat, and Retry-After says when (9 of 20). One command starts a model (local-ai run <model>), and existing OpenAI, Anthropic and Ollama clients work unchanged, but there's no LocalAI client SDK (12 of 15).

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.