LocalGhost vs PrivateGPT

LocalGhost 79

wisp 0.0.6 tagged on 10 October 2026 (30). Six releases, v0.0.1 to v0.0.6, from 2 to 10 October, each with dated notes (20). shields.io shows 0 open and 1 closed issue and no open pull requests. Pull request #1 (July) is merged and #3 (28 July, a macOS test fix) isn't in main, and the 0.0.4 notes say most of that release answers two outside reviews of 0.0.3. GitHub's issue and pull-request pages refused us, so we couldn't see written replies or their timing (12 of 25). Not an MCP server and no SDK, read as current official builds as the Open WebUI dossier read this line. Each tag ships a signed server bundle, a signed APK and a source archive on GitHub and the mirror, with no package-manager channel, fewer channels than the PyPI, GHCR and desktop builds Open WebUI was credited 13 for (11 of 15). Go 1.27.1 since 0.0.4 and three direct Go dependencies, with golang.org/x/crypto at v0.31.0 from December 2024, no Dependabot, and the Go suite passing at v0.0.6 and on main in our run of 10 October (6 of 10).

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

LocalGhost 49

Graded on the HTTPS API that ghost.secd serves to enrolled phones under /v1, the only programmatic interface, as the Khoj and Open WebUI dossiers graded their HTTP APIs. There's no public API or MCP server, and the README and llms.txt say the box answers every other caller, an agent included, as if it were down. ghost.secd builds an OpenAPI 3.0 document from a route table and serves it at /v1/openapi.json only to enrolled devices. At v0.0.6 the table holds 49 paths while server.go registers 109 by hand (46 and 105 at v0.0.5), although the code comment says no route can exist outside the spec (8 of 25). llms.txt on www.localghost.ai and Markdown docs throughout the repository (10). Route summaries say what each call does and some say when to use it, and there's no API reference beyond them (8 of 20). Request and response shapes come from Go structs by reflection, but several shapes are marked loose with additionalProperties, request bodies among them, and query formats sit in summaries and handlers rather than in the spec (6 of 15). No API examples, and error statuses are folded into one 503 page by design, so no error responses are documented (3 of 15). /v1 prefixes, dated notes per release in server/releases/ and a dated changelog page (14 of 15).

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

LocalGhost 39

Graded on the device API, as Schema is. /v1/news takes since and limit, the rate routes take hours or days and the Wikipedia route takes n, while /v1/home and /v1/rates return whole screens and nothing selects fields (12 of 25). /v1/days pages with before and limit, and /v1/wiki searches with q (12 of 20). edge.go folds every 400, 401, 403, 404 and 5xx a verified phone could get into the same 503 page, and the nginx path does the same with error_page, so the handlers' messages never reach the client and it can't tell a bad request from a locked box. Only a few statuses such as 409 pass through (2 of 20). Voice uploads are idempotent by id, /v1/lock is safe to repeat and trail deletion has a dry run, with no idempotency keys or retry guidance (10 of 20). The project's own Kotlin app is the only client, with no SDK and no documented way to enrol another (3 of 15).

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.

LocalGhost 50

Graded with the tool lines on how the phone reaches the box. Each phone holds a client certificate from the box's own CA (ECDSA P-256, no scopes) and a session token of at most 48 hours from a PIN unlock, sent in a header. Since 0.0.6 a certificate is good for two weeks and the phone renews it once a day while it talks to the box, re-signing the same key, and the QR's own certificate is good for an hour. One phone can be retired by its key since 0.0.2, and after the first unlock the phone swaps the QR's key for one it makes in the Android Keystore and the box retires the QR's certificate. That's 20 for revocable credentials with rotation and no scopes. The localghost://enroll link carries the device's certificate and private key in its query string, and we didn't take the 10 off. The Screenpipe dossier took it for a key documented as a token parameter on HTTP requests, and the Khoj dossier didn't for a key in a query string that wasn't a documented way to authenticate, so the line covers secrets in request URLs that pass through servers, proxies and logs. This link is drawn only as a QR on an interactive terminal and never printed as text (internal/pair/command.go), the app has no intent filter for the scheme and reads the QR with its own scanner, and the link never becomes a network request (20 of 30). Every enrolled phone has full owner rights, with no read-only device. Since 0.0.6 DEPLOY, ROLL BACK and LOCK BOX NOW ask for confirmation first and deleting a model, a notification, a connector or a chat takes a second tap, trail deletion has a dry run and a deploy runs on trial with automatic rollback, while the API's deletes run without a confirmation step (8 of 20). The box and phone pass news feeds, web search results, coin websites and Wikipedia text to the model, and we found no injection guidance. The daemons own the control flow, the model calls no tools, and some writers drop text carrying names or numbers not in their facts (6 of 15). Requests are logged at debug level only, and ghost-cli ghost.secd devices and Box Status show the enrolled phones and the daemons, with no per-call audit trail (5 of 15). security.txt valid to 1 October 2027, SECURITY.md with a 72-hour acknowledgement, a 14-day response, 90-day disclosure, a commitment not to take legal action and a promise to publish advisories after fixes, and a PGP key that also signs the releases. No bounty, no certification and no advisories published (11 of 20). On a fresh box ghost.secd trusts an X-Client-Cert header any local process can forge until the operator runs ghost-ctl edge-passthrough. The 0.0.5 and 0.0.6 notes list it as a known gap, since 0.0.6 secd checks a certificate's dates and retirement itself on every request, and the PIN is still needed, so it's weighed in the credential line rather than as an incident.

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.

LocalGhost 78

MIT for the server and the app, with the bundled licences in NOTICE.txt and TERMS files, and the terms page names LocalGhostDao as the copyright holder, as LICENSE does (30). The privacy page (updated 10 October 2026), llms.txt and the about page give the same list of outbound requests, and the hosts in the server and app code at v0.0.6 match it. The README's What leaves the box section still describes the weather pull as the three thousand larger places once a day, where 0.0.6 pulls about six thousand places a hundred every two minutes, as the privacy page and llms.txt say. Data on the box stays until the owner deletes it. The website and mirror say they keep no access logs, which we couldn't check on the live server, and the egress package's code comment still says the box fetches only when the phone can't. The earlier disagreement between the notes and the app is counted once, under negative events (25 of 30). No deprecation policy. Dated changelog and privacy entries say which older app versions keep the old lookups until updated, and the release notes say what was removed (10 of 20). No telemetry, analytics or crash reporting in the server or the app, stated in the README and the privacy page and consistent with the code. We found no switch for the exchange, ECB and Open-Meteo fetches or for the phone's daily read of the mirror manifest, where Open WebUI's 18 came with an offline switch (16 of 20).

PrivateGPT 64

Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.