{ "data": { "a": { "slug": "localghost", "name": "LocalGhost", "vendor": "LocalGhost", "vendorUrl": "https://www.localghost.ai", "kind": "platform", "category": "local-ai", "summary": "Open-source personal AI server that runs on a Debian machine its owner keeps, archiving photos, location, notes, voice and health data and reading them with local models, with its own Android app as the only client.", "url": "https://www.anchorterminal.com/tools/localghost", "markdownUrl": "https://www.anchorterminal.com/tools/localghost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/localghost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/localghost.json", "dns": "localghost.grade.anchorterminal.com", "repo": "https://github.com/LocalGhostDao/localghost", "license": "MIT", "transports": [ "http" ], "packages": [], "auth": "pat", "authNotes": "No credential for third-party agents. The companion app presents a client certificate issued by the box's own certificate authority (ECDSA P-256, no scopes, good for two weeks and renewed daily while the phone is in use since 0.0.6) and a session token of at most 48 hours from a PIN unlock, sent in a header. Enrolment is one animated QR code carrying a `localghost://enroll` link whose query string holds the device's certificate and private key. Since 2 October 2026 the box draws that QR only on an interactive terminal and never prints the link as text, and after the first unlock the phone swaps the QR's key for one it makes in the Android Keystore and the box retires the QR's certificate (https://github.com/LocalGhostDao/localghost/blob/main/server/internal/secd/rekey.go). A request without a valid certificate, from a retired phone or to a locked box gets the same 503. Since wisp 0.0.2 (2 October 2026) one phone can be retired by its key with ghost-cli ghost.secd retire or from another phone (POST /v1/devices/retire), and the retire button in the app isn't built yet. On a fresh box nginx terminates the phone's TLS and passes the device certificate to ghost.secd as an X-Client-Cert header that any local process on the box can forge, until the operator runs ghost-ctl edge-passthrough and writes tls to /etc/ghost/edge, after which ghost.secd checks the certificate itself (https://github.com/LocalGhostDao/localghost/blob/main/server/internal/secd/edge.go).", "pricing": "free", "pricingNotes": "The software is free under MIT, with no subscription and no account. Nothing is on sale yet. Pre-built boxes are planned as a one-time purchase at the cost of parts and assembly plus a 30% margin, price not set, and optional future daemons may be sold as one-time packages. The June 2026 reference build is about £1,130 in parts (https://www.localghost.ai/about).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No payments of any kind. The software is free and nothing is sold yet (checked 2026-10-02).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-02" }, "docsUrl": "https://github.com/LocalGhostDao/localghost/blob/main/server/tools/README.md", "llmsTxt": "https://www.localghost.ai/llms.txt", "capabilities": [ "memory.store", "memory.search", "memory.user", "memory.delete" ], "tags": [ "local", "self-hosted", "open-source", "free", "go", "llms-txt", "no-telemetry", "pre-1.0", "uk" ], "lastRelease": "2026-10-10", "graded": true, "own": true, "disclosure": "LocalGhost is built by Anchor Terminal's founder. Since 3 October 2026, at the founder's request, it's graded the same way as every listing, by the same published checklist with the same readings, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed. letme never picks it. Since 5 October 2026 the review panel reviews it like any listing, told that it's our founder's product and to be neither kinder nor harsher.", "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 858, "ranked": true, "rankOf": 1510, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 39, "maintenance": 79, "payments": 60, "reliability": 67, "schema": 49, "security": 50, "transparency": 78 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-10" }, "negative": -2, "negativeNotes": [ "2026-10-02 to 2026-10-04. The 0.0.1 notes of 2 October said never a location leaves the box, and the 0.0.3 notes of 3 October called the Open-Meteo call the one position that ever left either device, while the phone sent its position, rounded to two decimals, to Open-Meteo for a weather question naming no place until 0.0.3, and handed its newest fix to Android's geocoder, which on phones with Google's services usually reaches Google, until 0.0.4. Both lookups are gone, and the privacy page and llms.txt list each with the release that ended it. A misleading claim, fixed and documented, so the minimum, -2. https://github.com/LocalGhostDao/localghost/blob/v0.0.4/server/releases/0.0.4.md; https://github.com/LocalGhostDao/localghost/blob/v0.0.3/server/releases/0.0.3.md; https://www.localghost.ai/privacy" ], "verdict": "LocalGhost keeps a person's photos, trail, notes, voice and health data on an encrypted volume on their own Debian machine and runs its models there, and its list of outbound requests matches the code. It's pre-1.0 at wisp 0.0.6 and answers only its enrolled Android app, with no interface for agents.", "bestFor": "One technical owner who wants a phone-first personal archive (photos, location trail, notes, voice, health, news and prices) kept and read by local models on their own hardware.", "disclosure": "LocalGhost is built by Anchor Terminal's founder. Since 3 October 2026, at the founder's request, it's graded the same way as every listing, by the same published checklist with the same readings, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed. letme never picks it. Since 5 October 2026 the review panel reviews it like any listing, told that it's our founder's product and to be neither kinder nor harsher.", "strengths": [ "MIT licence for the server and the Android app, with a reproducible server bundle, a signed APK and signed sums for each release", "The v0.0.6 sums verify against the site key, which security.txt, SECURITY.md and the repository pin by the same fingerprint", "The privacy page and llms.txt list every outbound request, and the hosts in the v0.0.6 code match the list", "No telemetry, analytics or crash reporting in the server or the app", "Volume key sealed to the TPM, a wipe PIN, and phone certificates that last two weeks, renew daily and can be retired one at a time" ], "weaknesses": [ "No API, MCP server or credential for agents. The box answers only its enrolled phone", "The repository's checksum command finds no file, because SHA256SUMS lists the bundle under `server/`. The setup page's version strips the prefix and works", "Every API error reaches the phone as the same 503 page, so a client can't tell a bad request from a locked box", "Device certificates carry no scopes, so every enrolled phone has full owner rights, and a fresh box trusts a forgeable local header until the operator runs the edge passthrough", "The README's list of outbound requests still describes the weather pull of 0.0.5, three thousand places once a day, where the code and the privacy page say about six thousand, a hundred every two minutes" ], "agentNotes": [ "Don't look for an API or MCP server. A LocalGhost box answers only its enrolled phone and returns the same 503 to every other caller", "Verify a release with the setup page's command, which strips the `server/` and `app/` prefixes from SHA256SUMS before `sha256sum -c`, or nothing is checked", "After setup, run `sudo ghost-ctl edge-passthrough --domain \u003cbox name\u003e` so ghost.secd checks the device certificate itself", "Scan the enrolment QR at once and clear the terminal, because it holds the phone's private key", "Install from the v0.0.6 release, which main pins" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 3, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 39, "maintenance": 79, "payments": 60, "reliability": 67, "schema": 49, "security": 50, "transparency": 81 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-10-10", "maintenance": "2026-10-10", "payments": "2026-10-10", "reliability": "2026-10-10", "schema": "2026-10-10", "security": "2026-10-10", "transparency": "2026-10-10" }, "last": "2026-10-10", "lastMoved": "2026-10-28", "oldest": "2026-10-10", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/memory.store" }, "alsoIn": [ "personal-assistants" ], "area": "models", "provenance": { "legalEntity": "LocalGhost.ai Ltd (company number 17213100, registered in England and Wales, incorporated 12 May 2026)", "domain": "localghost.ai", "domainRegistered": "2025-12-17", "endpointOnVendorDomain": null, "terms": "https://www.localghost.ai/terms", "privacy": "https://www.localghost.ai/privacy", "statusPage": "https://www.localghost.ai/status", "changelog": "https://www.localghost.ai/changelog", "securityTxt": "valid", "checked": "2026-10-06", "notes": [ "LocalGhost.ai Ltd is active at Companies House (company number 17213100, incorporated 12 May 2026, registered office in London, checked 6 October 2026) and is named on the about, privacy and terms pages. The `LICENSE` copyright line reads LocalGhostDao, which the terms page also names as the copyright holder.", "Self-hosted software with no hosted endpoint. The privacy page (updated 5 October 2026) and the terms page (updated 3 October 2026) cover the website, the mirror and the software. The status page, updated by hand and last on 2 October 2026, covers the website, the mirror and the releases and records no incidents.", "www.localghost.ai/.well-known/security.txt returned a valid RFC 9116 file on 6 October 2026 (Contact, Expires 2027-10-01, Encryption, Preferred-Languages, Canonical, Policy). The key is the repository's server/tools/mirror-key.asc, fingerprint DCE9 A3D1 4EB4 6197 1DD5 F393 706E 4194 F08A 09A0, and the v0.0.6 SHA256SUMS.asc verified against it on 10 October 2026.", "The changelog page has a dated entry for each release from 0.0.1 to 0.0.6 and for mirror and page changes. RELEASES.md and server/releases/ in the code repository hold the notes per release.", "The privacy and mirror pages say the website and mirror keep no access logs. Whether the live server runs that configuration wasn't checked. The domain's registration date (17 December 2025, through Cloudflare, per the .ai RDAP record) is per the 3 October check." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/localghost.json", "live": { "slug": "localghost", "vendorStatus": { "page": "https://www.localghost.ai/status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:00.567459109Z" }, "versions": [ { "registry": "github", "name": "LocalGhostDao/localghost", "version": "v0.0.7", "released": "2026-10-23", "seenAt": "2026-11-06T23:41:17.291874611Z" } ], "githubStars": 17, "securityTxt": { "url": "https://localghost.ai/.well-known/security.txt", "state": "valid", "expires": "2027-10-01T00:00:00Z", "checkedAt": "2026-11-07T16:00:33.069535961Z" }, "llmsTxt": { "url": "https://www.localghost.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:54.374669014Z" }, "domain": { "domain": "localghost.ai", "registered": "2025-12-17", "source": "https://rdap.identitydigital.services/rdap/domain/localghost.ai", "checkedAt": "2026-11-01T14:12:26.676825255Z" }, "pages": [ { "url": "https://www.localghost.ai/changelog", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:30:58.87482191Z", "changedAt": "2026-10-24T02:33:35.056983095Z", "fingerprint": "061f5343580e" }, { "url": "https://www.localghost.ai/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:31:00.879528436Z", "changedAt": "2026-10-24T02:33:37.068759386Z", "fingerprint": "f857f5ee0ba1" }, { "url": "https://www.localghost.ai/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:31:02.879194941Z", "changedAt": "2026-10-14T21:14:28.658360477Z", "fingerprint": "4808f470d93a" } ], "github": { "repo": "localghostdao/localghost", "checkedAt": "2026-11-02T09:01:32.909025665Z", "stars": 17, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T22:42:18Z", "openIssues": 0, "openPRs": 0, "issuesOpened90d": 0, "issuesClosed90d": 1, "prsMerged90d": 1, "ci": { "branch": "main", "runs": 50, "success": 26, "failure": 23, "other": 1, "latest": "failure", "latestAt": "2026-11-01T22:43:54Z" }, "replies": { "sampled": 1, "unanswered": 0, "medianDays": 66.1 } }, "updatedAt": "2026-11-07T16:00:33.069535961Z" }, "vendorLinked": true }, "answer": "LocalGhost scores 55.7 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema \u0026 documentation and agent ergonomics.", "b": { "slug": "privategpt", "name": "PrivateGPT", "vendor": "Zylon (PriBAI Technology Spain S.L.)", "vendorUrl": "https://docs.privategpt.dev", "kind": "http-api", "category": "local-ai", "summary": "PrivateGPT is Zylon's open-source server that puts an Anthropic-style messages API, document ingestion, retrieval with citations, built-in tools and MCP connectors in front of any OpenAI-compatible local model server. The owner runs it.", "url": "https://www.anchorterminal.com/tools/privategpt", "markdownUrl": "https://www.anchorterminal.com/tools/privategpt.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/privategpt.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/privategpt.json", "dns": "privategpt.grade.anchorterminal.com", "repo": "https://github.com/zylon-ai/private-gpt", "license": "Apache-2.0", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "zylonai/private-gpt" } ], "auth": "none", "authNotes": "Authentication is off by default. When `server.auth.enabled` is set, every request must carry one static secret in the `Authorization` header, compared with the whole header value. There are no per-user keys, scopes or rotation, and the docs show it as a Bearer token, a Basic value and an Anthropic API key in different places (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with no account or card. The cost is the owner's hardware and model server. Zylon sells a separate enterprise platform built on PrivateGPT through demos, with no public price (checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the OpenAPI file or the docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57600, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.privategpt.dev/introduction", "llmsTxt": "https://docs.privategpt.dev/llms.txt", "openapi": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/fern/openapi/openapi.json", "capabilities": [ "inference.local", "memory.search", "agent.mcp-client" ], "tags": [ "open-source", "local", "self-hosted", "docker", "openapi", "llms-txt", "rag", "mcp-client", "anthropic-compatible", "python", "free" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 53.2, "grade": "D", "agentReady": false, "rank": 960, "ranked": true, "rankOf": 1510, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -7, "negativeNotes": [ "Issue #2269, opened 11 June 2026, reports that the async ingestion API reads any local path given as a URI artifact. The stale bot closed it as not planned on 5 July with no maintainer reply, and `load_file_from_uri` in the source of 29 October 2026 still falls back to reading a local file for any value that isn't a URL, s3 or base64. With authentication off and a 0.0.0.0 bind by default, that is an open file-read path on a default install. Read from the source, not run (-7). https://github.com/zylon-ai/private-gpt/issues/2269" ], "verdict": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.", "bestFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "strengths": [ "Messages API modelled on Anthropic's, so Claude Code and Anthropic SDKs work by changing the base URL", "OpenAPI file of 38 paths, llms.txt and Markdown copies of every docs page", "Retrieval with citations, async ingestion, web, database and tabular tools, and remote MCP servers in one API", "Apache-2.0, with no telemetry to Zylon found in the source and OpenTelemetry tracing off by default", "Works with Ollama, llama.cpp, vLLM, LM Studio or any OpenAI-compatible server" ], "weaknesses": [ "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin", "When on, authentication is one shared static secret, with no per-user keys or scopes", "A June 2026 report of local file reads through URI artifacts was closed by a stale bot, and the source still reads local paths", "No release since 1.0.1 in June 2026 while main has moved on, including a breaking change", "Code execution runs as a host subprocess with resource limits, not in a container" ], "agentNotes": [ "Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller", "Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`", "Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`", "Pass ingested documents through `tool_context` to get answers with citations", "Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.2 } ], "editorialScores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 67 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "brew tap zylon-ai/tap\nbrew install private-gpt", "http": "curl http://localhost:8080/v1/messages \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"qwen3.5:35b\", \"messages\": [{\"role\": \"user\", \"content\": \"Explain retrieval-augmented generation.\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/privategpt" }, "area": "models", "provenance": { "legalEntity": "PriBAI Technology Spain S.L.", "domain": "privategpt.dev", "domainRegistered": "2023-10-16", "endpointOnVendorDomain": null, "terms": "https://github.com/zylon-ai/private-gpt/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://github.com/zylon-ai/private-gpt/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Self-hosted software with no hosted endpoint, so the Apache-2.0 licence stands in for terms and no privacy policy is scored.", "The zylon.ai terms name PriBAI Technology Spain S.L. (VAT ESB56550130) under Spanish law and cover the website and Zylon services. They forbid access through bots, scripts or scrapers, outside standard search engine or browser use. We read the terms and two public pages.", "RDAP gives privategpt.dev a registration date of 16 October 2023.", "docs.privategpt.dev/.well-known/security.txt and www.zylon.ai/.well-known/security.txt answer 404. SECURITY.md in the repository is the reporting route.", "docs.privategpt.dev and www.zylon.ai robots.txt allow our reader. wheels.privategpt.dev has no robots.txt (404)." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/privategpt.json", "live": { "slug": "privategpt", "versions": [ { "registry": "github", "name": "zylon-ai/private-gpt", "version": "v1.0.1", "released": "2026-06-18", "seenAt": "2026-11-06T23:58:40.643071731Z" } ], "githubStars": 57632, "securityTxt": { "url": "https://privategpt.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:53.351491852Z" }, "llmsTxt": { "url": "https://docs.privategpt.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:41.730243326Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:15.016082629Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "767d5dd99544" }, { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:17.075442465Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "839fbbcddc72" } ], "updatedAt": "2026-11-07T15:59:53.351491852Z" } }, "edges": [ { "by": 38, "category": "maintenance", "leads": "localghost", "name": "Maintenance \u0026 community", "reasons": { "a": "wisp 0.0.6 tagged on 10 October 2026 (30). Six releases, v0.0.1 to v0.0.6, from 2 to 10 October, each with dated notes (20). shields.io shows 0 open and 1 closed issue and no open pull requests. Pull request #1 (July) is merged and #3 (28 July, a macOS test fix) isn't in main, and the 0.0.4 notes say most of that release answers two outside reviews of 0.0.3. GitHub's issue and pull-request pages refused us, so we couldn't see written replies or their timing (12 of 25). Not an MCP server and no SDK, read as current official builds as the Open WebUI dossier read this line. Each tag ships a signed server bundle, a signed APK and a source archive on GitHub and the mirror, with no package-manager channel, fewer channels than the PyPI, GHCR and desktop builds Open WebUI was credited 13 for (11 of 15). Go 1.27.1 since 0.0.4 and three direct Go dependencies, with golang.org/x/crypto at v0.31.0 from December 2024, no Dependabot, and the Go suite passing at v0.0.6 and on main in our run of 10 October (6 of 10).", "b": "The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41." }, "scores": { "a": 79, "b": 41 } }, { "by": 34, "category": "schema", "leads": "privategpt", "name": "Schema \u0026 documentation", "reasons": { "a": "Graded on the HTTPS API that ghost.secd serves to enrolled phones under /v1, the only programmatic interface, as the Khoj and Open WebUI dossiers graded their HTTP APIs. There's no public API or MCP server, and the README and llms.txt say the box answers every other caller, an agent included, as if it were down. ghost.secd builds an OpenAPI 3.0 document from a route table and serves it at /v1/openapi.json only to enrolled devices. At v0.0.6 the table holds 49 paths while server.go registers 109 by hand (46 and 105 at v0.0.5), although the code comment says no route can exist outside the spec (8 of 25). llms.txt on www.localghost.ai and Markdown docs throughout the repository (10). Route summaries say what each call does and some say when to use it, and there's no API reference beyond them (8 of 20). Request and response shapes come from Go structs by reflection, but several shapes are marked loose with additionalProperties, request bodies among them, and query formats sit in summaries and handlers rather than in the spec (6 of 15). No API examples, and error statuses are folded into one 503 page by design, so no error responses are documented (3 of 15). /v1 prefixes, dated notes per release in server/releases/ and a dated changelog page (14 of 15).", "b": "An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83." }, "scores": { "a": 49, "b": 83 } }, { "by": 25, "category": "ergonomics", "leads": "privategpt", "name": "Agent ergonomics", "reasons": { "a": "Graded on the device API, as Schema is. `/v1/news` takes `since` and `limit`, the rate routes take `hours` or `days` and the Wikipedia route takes `n`, while `/v1/home` and `/v1/rates` return whole screens and nothing selects fields (12 of 25). `/v1/days` pages with `before` and `limit`, and `/v1/wiki` searches with `q` (12 of 20). edge.go folds every 400, 401, 403, 404 and 5xx a verified phone could get into the same 503 page, and the nginx path does the same with error_page, so the handlers' messages never reach the client and it can't tell a bad request from a locked box. Only a few statuses such as 409 pass through (2 of 20). Voice uploads are idempotent by id, `/v1/lock` is safe to repeat and trail deletion has a dry run, with no idempotency keys or retry guidance (10 of 20). The project's own Kotlin app is the only client, with no SDK and no documented way to enrol another (3 of 15).", "b": "Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64." }, "scores": { "a": 39, "b": 64 } }, { "by": 18, "category": "security", "leads": "localghost", "name": "Security \u0026 auth", "reasons": { "a": "Graded with the tool lines on how the phone reaches the box. Each phone holds a client certificate from the box's own CA (ECDSA P-256, no scopes) and a session token of at most 48 hours from a PIN unlock, sent in a header. Since 0.0.6 a certificate is good for two weeks and the phone renews it once a day while it talks to the box, re-signing the same key, and the QR's own certificate is good for an hour. One phone can be retired by its key since 0.0.2, and after the first unlock the phone swaps the QR's key for one it makes in the Android Keystore and the box retires the QR's certificate. That's 20 for revocable credentials with rotation and no scopes. The `localghost://enroll` link carries the device's certificate and private key in its query string, and we didn't take the 10 off. The Screenpipe dossier took it for a key documented as a `token` parameter on HTTP requests, and the Khoj dossier didn't for a key in a query string that wasn't a documented way to authenticate, so the line covers secrets in request URLs that pass through servers, proxies and logs. This link is drawn only as a QR on an interactive terminal and never printed as text (internal/pair/command.go), the app has no intent filter for the scheme and reads the QR with its own scanner, and the link never becomes a network request (20 of 30). Every enrolled phone has full owner rights, with no read-only device. Since 0.0.6 DEPLOY, ROLL BACK and LOCK BOX NOW ask for confirmation first and deleting a model, a notification, a connector or a chat takes a second tap, trail deletion has a dry run and a deploy runs on trial with automatic rollback, while the API's deletes run without a confirmation step (8 of 20). The box and phone pass news feeds, web search results, coin websites and Wikipedia text to the model, and we found no injection guidance. The daemons own the control flow, the model calls no tools, and some writers drop text carrying names or numbers not in their facts (6 of 15). Requests are logged at debug level only, and `ghost-cli ghost.secd devices` and Box Status show the enrolled phones and the daemons, with no per-call audit trail (5 of 15). security.txt valid to 1 October 2027, SECURITY.md with a 72-hour acknowledgement, a 14-day response, 90-day disclosure, a commitment not to take legal action and a promise to publish advisories after fixes, and a PGP key that also signs the releases. No bounty, no certification and no advisories published (11 of 20). On a fresh box ghost.secd trusts an X-Client-Cert header any local process can forge until the operator runs `ghost-ctl edge-passthrough`. The 0.0.5 and 0.0.6 notes list it as a known gap, since 0.0.6 secd checks a certificate's dates and retirement itself on every request, and the PIN is still needed, so it's weighed in the credential line rather than as an incident.", "b": "Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32." }, "scores": { "a": 50, "b": 32 } }, { "by": 14, "category": "transparency", "leads": "localghost", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT for the server and the app, with the bundled licences in NOTICE.txt and TERMS files, and the terms page names LocalGhostDao as the copyright holder, as LICENSE does (30). The privacy page (updated 10 October 2026), llms.txt and the about page give the same list of outbound requests, and the hosts in the server and app code at v0.0.6 match it. The README's What leaves the box section still describes the weather pull as the three thousand larger places once a day, where 0.0.6 pulls about six thousand places a hundred every two minutes, as the privacy page and llms.txt say. Data on the box stays until the owner deletes it. The website and mirror say they keep no access logs, which we couldn't check on the live server, and the egress package's code comment still says the box fetches only when the phone can't. The earlier disagreement between the notes and the app is counted once, under negative events (25 of 30). No deprecation policy. Dated changelog and privacy entries say which older app versions keep the old lookups until updated, and the release notes say what was removed (10 of 20). No telemetry, analytics or crash reporting in the server or the app, stated in the README and the privacy page and consistent with the code. We found no switch for the exchange, ECB and Open-Meteo fetches or for the phone's daily read of the mirror manifest, where Open WebUI's 18 came with an offline switch (16 of 20).", "b": "Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67." }, "scores": { "a": 78, "b": 64 } } ], "facts": [ { "a": "Platform", "b": "HTTP API", "name": "Kind" }, { "a": "LocalGhost", "b": "Zylon (PriBAI Technology Spain S.L.)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "Token", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-10", "b": "2026-06-18", "name": "Last release" }, { "a": "2026-10-03", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-10-05", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "16 stars", "b": "58k stars", "name": "Popularity" }, { "a": "2/5 (3)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "LocalGhost scores 55.7 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema \u0026 documentation and agent ergonomics.", "question": "Which is better for AI agents, LocalGhost or PrivateGPT?" }, { "answer": "No hosted endpoint is listed for LocalGhost. No hosted endpoint is listed for PrivateGPT.", "question": "Can an agent call LocalGhost and PrivateGPT without installing anything?" }, { "answer": "Yes. LocalGhost is open source (MIT). PrivateGPT is open source (Apache-2.0).", "question": "Are LocalGhost and PrivateGPT open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 50 against 32", "Maintenance \u0026 community, 79 against 41", "Transparency \u0026 trust, 78 against 64" ], "also": null, "goodFor": "One technical owner who wants a phone-first personal archive (photos, location trail, notes, voice, health, news and prices) kept and read by local models on their own hardware.", "slug": "localghost", "watchFor": "No API, MCP server or credential for agents. The box answers only its enrolled phone" }, { "aheadOn": [ "Schema \u0026 documentation, 83 against 49", "Agent ergonomics, 64 against 39" ], "also": [ "No key needed to call it" ], "goodFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "slug": "privategpt", "watchFor": "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin" } ], "history": { "localghost": [ { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 55.5, "fromGrade": "C", "to": 55.7, "toGrade": "C" }, { "causes": [ "product" ], "date": "2026-10-10", "delta": 2.9, "from": 52.6, "fromGrade": "D", "to": 55.5, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.4, "from": 53, "fromGrade": "D", "to": 52.6, "toGrade": "D" } ], "privategpt": null }, "job": { "capability": "memory.search", "name": "Memory search" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-memory-vs-localghost.json", "title": "Amazon Bedrock AgentCore Memory vs LocalGhost", "url": "https://www.anchorterminal.com/compare/agentcore-memory-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/basic-memory-vs-localghost.json", "title": "Basic Memory vs LocalGhost", "url": "https://www.anchorterminal.com/compare/basic-memory-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/claude-mem-vs-localghost.json", "title": "claude-mem vs LocalGhost", "url": "https://www.anchorterminal.com/compare/claude-mem-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/cognee-vs-localghost.json", "title": "Cognee vs LocalGhost", "url": "https://www.anchorterminal.com/compare/cognee-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/everos-vs-localghost.json", "title": "EverOS vs LocalGhost", "url": "https://www.anchorterminal.com/compare/everos-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/google-memory-bank-vs-localghost.json", "title": "Agent Platform Memory Bank vs LocalGhost", "url": "https://www.anchorterminal.com/compare/google-memory-bank-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/graphiti-vs-localghost.json", "title": "Graphiti vs LocalGhost", "url": "https://www.anchorterminal.com/compare/graphiti-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/hindsight-vs-localghost.json", "title": "Hindsight vs LocalGhost", "url": "https://www.anchorterminal.com/compare/hindsight-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/honcho-vs-localghost.json", "title": "Honcho vs LocalGhost", "url": "https://www.anchorterminal.com/compare/honcho-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/hy-memory-vs-localghost.json", "title": "Hy Memory vs LocalGhost", "url": "https://www.anchorterminal.com/compare/hy-memory-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/langmem-vs-localghost.json", "title": "LangMem vs LocalGhost", "url": "https://www.anchorterminal.com/compare/langmem-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-mem0.json", "title": "LocalGhost vs Mem0 Platform + MCP", "url": "https://www.anchorterminal.com/compare/localghost-vs-mem0" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-memmachine.json", "title": "LocalGhost vs MemMachine", "url": "https://www.anchorterminal.com/compare/localghost-vs-memmachine" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-memori.json", "title": "LocalGhost vs Memori", "url": "https://www.anchorterminal.com/compare/localghost-vs-memori" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-memory-reference-server.json", "title": "LocalGhost vs Memory (MCP reference server)", "url": "https://www.anchorterminal.com/compare/localghost-vs-memory-reference-server" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-mempalace.json", "title": "LocalGhost vs MemPalace", "url": "https://www.anchorterminal.com/compare/localghost-vs-mempalace" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-past-dev.json", "title": "LocalGhost vs past.dev", "url": "https://www.anchorterminal.com/compare/localghost-vs-past-dev" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-supermemory.json", "title": "LocalGhost vs Supermemory API + MCP", "url": "https://www.anchorterminal.com/compare/localghost-vs-supermemory" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-tencentdb-agent-memory.json", "title": "LocalGhost vs TencentDB Agent Memory", "url": "https://www.anchorterminal.com/compare/localghost-vs-tencentdb-agent-memory" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-tokenrip.json", "title": "LocalGhost vs Tokenrip", "url": "https://www.anchorterminal.com/compare/localghost-vs-tokenrip" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-zep.json", "title": "LocalGhost vs Zep", "url": "https://www.anchorterminal.com/compare/localghost-vs-zep" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.json", "title": "AnythingLLM vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-privategpt.json", "title": "Berth vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/berth-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt.json", "title": "BitRun vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.json", "title": "Docker Model Runner vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.json", "title": "Foundry Local vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.json", "title": "Core vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.json", "title": "GPT4All vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.json", "title": "HyperQwen vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-privategpt.json", "title": "Jan vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/jan-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.json", "title": "KoboldCpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt.json", "title": "Lemonade vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.json", "title": "llama.cpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.json", "title": "LM Studio vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-privategpt.json", "title": "LocalAI vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/localai-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.json", "title": "MLX LM vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-privategpt.json", "title": "Ollama vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ollama-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt.json", "title": "Open WebUI vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.json", "title": "PrivateGPT vs screenpipe", "url": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.json", "title": "PrivateGPT vs TextGen", "url": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-vllm.json", "title": "PrivateGPT vs vLLM", "url": "https://www.anchorterminal.com/compare/privategpt-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-localghost.json", "title": "AnythingLLM vs LocalGhost", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-localghost.json", "title": "Core vs LocalGhost", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-localghost.json", "title": "GPT4All vs LocalGhost", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-localghost.json", "title": "Khoj vs LocalGhost", "url": "https://www.anchorterminal.com/compare/khoj-vs-localghost" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-privategpt.json", "title": "Khoj vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/khoj-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-screenpipe.json", "title": "LocalGhost vs screenpipe", "url": "https://www.anchorterminal.com/compare/localghost-vs-screenpipe" } ], "panel": null, "scores": [ { "by": 3, "edge": "privategpt", "key": "reliability", "localghost": 67, "name": "Reliability", "privategpt": 70, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 34, "edge": "privategpt", "key": "schema", "localghost": 49, "name": "Schema \u0026 documentation", "privategpt": 83, "weight": 13 }, { "by": 25, "edge": "privategpt", "key": "ergonomics", "localghost": 39, "name": "Agent ergonomics", "privategpt": 64, "weight": 13 }, { "by": 18, "edge": "localghost", "key": "security", "localghost": 50, "name": "Security \u0026 auth", "privategpt": 32, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "localghost": 60, "name": "Payments \u0026 pricing", "privategpt": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 38, "edge": "localghost", "key": "maintenance", "localghost": 79, "name": "Maintenance \u0026 community", "privategpt": 41, "weight": 7 }, { "by": 14, "edge": "localghost", "key": "transparency", "localghost": 78, "name": "Transparency \u0026 trust", "privategpt": 64, "weight": 7 } ], "summary": "LocalGhost scores 55.7 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema \u0026 documentation and agent ergonomics. Both do memory search.", "tasks": null, "tutorials": [], "verdicts": { "localghost": "LocalGhost keeps a person's photos, trail, notes, voice and health data on an encrypted volume on their own Debian machine and runs its models there, and its list of outbound requests matches the code. It's pre-1.0 at wisp 0.0.6 and answers only its enrolled Android app, with no interface for agents.", "privategpt": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/localghost-vs-privategpt", "json": "https://www.anchorterminal.com/compare/localghost-vs-privategpt.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/localghost-vs-privategpt.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/localghost-vs-privategpt.min.md" }, "markdown": "LocalGhost scores 55.7 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema \u0026 documentation and agent ergonomics. Both do memory search.\n\n- LocalGhost: grade C, 55.7/100, rank #858 of 1510. Markdown https://www.anchorterminal.com/tools/localghost.md · JSON https://www.anchorterminal.com/api/v1/tools/localghost.json\n- PrivateGPT: grade D, 53.2/100, rank #960 of 1510. Markdown https://www.anchorterminal.com/tools/privategpt.md · JSON https://www.anchorterminal.com/api/v1/tools/privategpt.json\n- Best local AI models and assistants: https://www.anchorterminal.com/best/local-ai/index.md\n- All 280 local ai comparisons: https://www.anchorterminal.com/compare/local-ai/index.md\n- Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 1252 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Which one, for what\n\n### LocalGhost (C)\n\nGood for: One technical owner who wants a phone-first personal archive (photos, location trail, notes, voice, health, news and prices) kept and read by local models on their own hardware.\n\nAhead on:\n- Security \u0026 auth, 50 against 32\n- Maintenance \u0026 community, 79 against 41\n- Transparency \u0026 trust, 78 against 64\n\nWatch for: No API, MCP server or credential for agents. The box answers only its enrolled phone\n\n### PrivateGPT (D)\n\nGood for: A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.\n\nAhead on:\n- Schema \u0026 documentation, 83 against 49\n- Agent ergonomics, 64 against 39\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin\n\n\n## Why the edge\n\n### Maintenance \u0026 community: LocalGhost +38\n\n- LocalGhost (79): wisp 0.0.6 tagged on 10 October 2026 (30). Six releases, v0.0.1 to v0.0.6, from 2 to 10 October, each with dated notes (20). shields.io shows 0 open and 1 closed issue and no open pull requests. Pull request #1 (July) is merged and #3 (28 July, a macOS test fix) isn't in main, and the 0.0.4 notes say most of that release answers two outside reviews of 0.0.3. GitHub's issue and pull-request pages refused us, so we couldn't see written replies or their timing (12 of 25). Not an MCP server and no SDK, read as current official builds as the Open WebUI dossier read this line. Each tag ships a signed server bundle, a signed APK and a source archive on GitHub and the mirror, with no package-manager channel, fewer channels than the PyPI, GHCR and desktop builds Open WebUI was credited 13 for (11 of 15). Go 1.27.1 since 0.0.4 and three direct Go dependencies, with golang.org/x/crypto at v0.31.0 from December 2024, no Dependabot, and the Go suite passing at v0.0.6 and on main in our run of 10 October (6 of 10).\n- PrivateGPT (41): The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.\n\n### Schema \u0026 documentation: PrivateGPT +34\n\n- LocalGhost (49): Graded on the HTTPS API that ghost.secd serves to enrolled phones under /v1, the only programmatic interface, as the Khoj and Open WebUI dossiers graded their HTTP APIs. There's no public API or MCP server, and the README and llms.txt say the box answers every other caller, an agent included, as if it were down. ghost.secd builds an OpenAPI 3.0 document from a route table and serves it at /v1/openapi.json only to enrolled devices. At v0.0.6 the table holds 49 paths while server.go registers 109 by hand (46 and 105 at v0.0.5), although the code comment says no route can exist outside the spec (8 of 25). llms.txt on www.localghost.ai and Markdown docs throughout the repository (10). Route summaries say what each call does and some say when to use it, and there's no API reference beyond them (8 of 20). Request and response shapes come from Go structs by reflection, but several shapes are marked loose with additionalProperties, request bodies among them, and query formats sit in summaries and handlers rather than in the spec (6 of 15). No API examples, and error statuses are folded into one 503 page by design, so no error responses are documented (3 of 15). /v1 prefixes, dated notes per release in server/releases/ and a dated changelog page (14 of 15).\n- PrivateGPT (83): An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.\n\n### Agent ergonomics: PrivateGPT +25\n\n- LocalGhost (39): Graded on the device API, as Schema is. `/v1/news` takes `since` and `limit`, the rate routes take `hours` or `days` and the Wikipedia route takes `n`, while `/v1/home` and `/v1/rates` return whole screens and nothing selects fields (12 of 25). `/v1/days` pages with `before` and `limit`, and `/v1/wiki` searches with `q` (12 of 20). edge.go folds every 400, 401, 403, 404 and 5xx a verified phone could get into the same 503 page, and the nginx path does the same with error_page, so the handlers' messages never reach the client and it can't tell a bad request from a locked box. Only a few statuses such as 409 pass through (2 of 20). Voice uploads are idempotent by id, `/v1/lock` is safe to repeat and trail deletion has a dry run, with no idempotency keys or retry guidance (10 of 20). The project's own Kotlin app is the only client, with no SDK and no documented way to enrol another (3 of 15).\n- PrivateGPT (64): Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.\n\n### Security \u0026 auth: LocalGhost +18\n\n- LocalGhost (50): Graded with the tool lines on how the phone reaches the box. Each phone holds a client certificate from the box's own CA (ECDSA P-256, no scopes) and a session token of at most 48 hours from a PIN unlock, sent in a header. Since 0.0.6 a certificate is good for two weeks and the phone renews it once a day while it talks to the box, re-signing the same key, and the QR's own certificate is good for an hour. One phone can be retired by its key since 0.0.2, and after the first unlock the phone swaps the QR's key for one it makes in the Android Keystore and the box retires the QR's certificate. That's 20 for revocable credentials with rotation and no scopes. The `localghost://enroll` link carries the device's certificate and private key in its query string, and we didn't take the 10 off. The Screenpipe dossier took it for a key documented as a `token` parameter on HTTP requests, and the Khoj dossier didn't for a key in a query string that wasn't a documented way to authenticate, so the line covers secrets in request URLs that pass through servers, proxies and logs. This link is drawn only as a QR on an interactive terminal and never printed as text (internal/pair/command.go), the app has no intent filter for the scheme and reads the QR with its own scanner, and the link never becomes a network request (20 of 30). Every enrolled phone has full owner rights, with no read-only device. Since 0.0.6 DEPLOY, ROLL BACK and LOCK BOX NOW ask for confirmation first and deleting a model, a notification, a connector or a chat takes a second tap, trail deletion has a dry run and a deploy runs on trial with automatic rollback, while the API's deletes run without a confirmation step (8 of 20). The box and phone pass news feeds, web search results, coin websites and Wikipedia text to the model, and we found no injection guidance. The daemons own the control flow, the model calls no tools, and some writers drop text carrying names or numbers not in their facts (6 of 15). Requests are logged at debug level only, and `ghost-cli ghost.secd devices` and Box Status show the enrolled phones and the daemons, with no per-call audit trail (5 of 15). security.txt valid to 1 October 2027, SECURITY.md with a 72-hour acknowledgement, a 14-day response, 90-day disclosure, a commitment not to take legal action and a promise to publish advisories after fixes, and a PGP key that also signs the releases. No bounty, no certification and no advisories published (11 of 20). On a fresh box ghost.secd trusts an X-Client-Cert header any local process can forge until the operator runs `ghost-ctl edge-passthrough`. The 0.0.5 and 0.0.6 notes list it as a known gap, since 0.0.6 secd checks a certificate's dates and retirement itself on every request, and the PIN is still needed, so it's weighed in the credential line rather than as an incident.\n- PrivateGPT (32): Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.\n\n### Transparency \u0026 trust: LocalGhost +14\n\n- LocalGhost (78): MIT for the server and the app, with the bundled licences in NOTICE.txt and TERMS files, and the terms page names LocalGhostDao as the copyright holder, as LICENSE does (30). The privacy page (updated 10 October 2026), llms.txt and the about page give the same list of outbound requests, and the hosts in the server and app code at v0.0.6 match it. The README's What leaves the box section still describes the weather pull as the three thousand larger places once a day, where 0.0.6 pulls about six thousand places a hundred every two minutes, as the privacy page and llms.txt say. Data on the box stays until the owner deletes it. The website and mirror say they keep no access logs, which we couldn't check on the live server, and the egress package's code comment still says the box fetches only when the phone can't. The earlier disagreement between the notes and the app is counted once, under negative events (25 of 30). No deprecation policy. Dated changelog and privacy entries say which older app versions keep the old lookups until updated, and the release notes say what was removed (10 of 20). No telemetry, analytics or crash reporting in the server or the app, stated in the README and the privacy page and consistent with the code. We found no switch for the exchange, ECB and Open-Meteo fetches or for the phone's daily read of the mirror manifest, where Open WebUI's 18 came with an offline switch (16 of 20).\n- PrivateGPT (64): Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.\n\n## Score by category\n\n| Category | Weight | LocalGhost | PrivateGPT | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 67 | 70 | PrivateGPT +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 49 | 83 | PrivateGPT +34 |\n| Agent ergonomics | 13% (16.2 this run) | 39 | 64 | PrivateGPT +25 |\n| Security \u0026 auth | 14% (17.5 this run) | 50 | 32 | LocalGhost +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 79 | 41 | LocalGhost +38 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 78 | 64 | LocalGhost +14 |\n| Negative events | ≤15 | -2 | -7 | |\n| **Total** | | **55.7 · C** | **53.2 · D** | |\n\n## Facts side by side\n\n| Fact | LocalGhost | PrivateGPT |\n| --- | --- | --- |\n| Kind | Platform | HTTP API |\n| Vendor | LocalGhost | Zylon (PriBAI Technology Spain S.L.) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | Token | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-10 | 2026-06-18 |\n| Terms last updated | 2026-10-03 | no date given |\n| Privacy policy last updated | 2026-10-05 | no document linked |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 16 stars | 58k stars |\n| Agent reviews | 2/5 (3) | none |\n\n## How the scores have moved\n\n### LocalGhost\n\n- +0.2 on 28 October 2026: new evidence\n- +2.9 on 10 October 2026 (D to C): product\n- -0.4 on 8 October 2026: checklist\n\n### PrivateGPT\n\nNo score change since it was listed.\n\n## Verdicts\n\n**LocalGhost.** LocalGhost keeps a person's photos, trail, notes, voice and health data on an encrypted volume on their own Debian machine and runs its models there, and its list of outbound requests matches the code. It's pre-1.0 at wisp 0.0.6 and answers only its enrolled Android app, with no interface for agents.\n\n**PrivateGPT.** PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.\n\n## Before you call either\n\n### LocalGhost\n\n1. Don't look for an API or MCP server. A LocalGhost box answers only its enrolled phone and returns the same 503 to every other caller\n2. Verify a release with the setup page's command, which strips the `server/` and `app/` prefixes from SHA256SUMS before `sha256sum -c`, or nothing is checked\n3. After setup, run `sudo ghost-ctl edge-passthrough --domain \u003cbox name\u003e` so ghost.secd checks the device certificate itself\n4. Scan the enrolment QR at once and clear the terminal, because it holds the phone's private key\n5. Install from the v0.0.6 release, which main pins\n\n### PrivateGPT\n\n1. Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller\n2. Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`\n3. Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`\n4. Pass ingested documents through `tool_context` to get answers with citations\n5. Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling\n\n## Questions\n\n### Which is better for AI agents, LocalGhost or PrivateGPT?\n\nLocalGhost scores 55.7 (C) on agent readiness against PrivateGPT's 53.2 (D), and leads in 3 of 7 scored categories. PrivateGPT leads on schema \u0026 documentation and agent ergonomics.\n\n### Can an agent call LocalGhost and PrivateGPT without installing anything?\n\nNo hosted endpoint is listed for LocalGhost. No hosted endpoint is listed for PrivateGPT.\n\n### Are LocalGhost and PrivateGPT open source?\n\nYes. LocalGhost is open source (MIT). PrivateGPT is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/localghost-vs-privategpt.json, and with the fewest tokens: https://www.anchorterminal.com/compare/localghost-vs-privategpt.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"localghost\", \"b\": \"privategpt\"}`. From a terminal: `anchor compare localghost privategpt`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/localghost.json and https://www.anchorterminal.com/api/v1/tools/privategpt.json\n\n## Other comparisons with LocalGhost or PrivateGPT\n\n- [Amazon Bedrock AgentCore Memory vs LocalGhost](https://www.anchorterminal.com/compare/agentcore-memory-vs-localghost.md)\n- [Basic Memory vs LocalGhost](https://www.anchorterminal.com/compare/basic-memory-vs-localghost.md)\n- [claude-mem vs LocalGhost](https://www.anchorterminal.com/compare/claude-mem-vs-localghost.md)\n- [Cognee vs LocalGhost](https://www.anchorterminal.com/compare/cognee-vs-localghost.md)\n- [EverOS vs LocalGhost](https://www.anchorterminal.com/compare/everos-vs-localghost.md)\n- [Agent Platform Memory Bank vs LocalGhost](https://www.anchorterminal.com/compare/google-memory-bank-vs-localghost.md)\n- [Graphiti vs LocalGhost](https://www.anchorterminal.com/compare/graphiti-vs-localghost.md)\n- [Hindsight vs LocalGhost](https://www.anchorterminal.com/compare/hindsight-vs-localghost.md)\n- [Honcho vs LocalGhost](https://www.anchorterminal.com/compare/honcho-vs-localghost.md)\n- [Hy Memory vs LocalGhost](https://www.anchorterminal.com/compare/hy-memory-vs-localghost.md)\n- [LangMem vs LocalGhost](https://www.anchorterminal.com/compare/langmem-vs-localghost.md)\n- [LocalGhost vs Mem0 Platform + MCP](https://www.anchorterminal.com/compare/localghost-vs-mem0.md)\n- [LocalGhost vs MemMachine](https://www.anchorterminal.com/compare/localghost-vs-memmachine.md)\n- [LocalGhost vs Memori](https://www.anchorterminal.com/compare/localghost-vs-memori.md)\n- [LocalGhost vs Memory (MCP reference server)](https://www.anchorterminal.com/compare/localghost-vs-memory-reference-server.md)\n- [LocalGhost vs MemPalace](https://www.anchorterminal.com/compare/localghost-vs-mempalace.md)\n- [LocalGhost vs past.dev](https://www.anchorterminal.com/compare/localghost-vs-past-dev.md)\n- [LocalGhost vs Supermemory API + MCP](https://www.anchorterminal.com/compare/localghost-vs-supermemory.md)\n- [LocalGhost vs TencentDB Agent Memory](https://www.anchorterminal.com/compare/localghost-vs-tencentdb-agent-memory.md)\n- [LocalGhost vs Tokenrip](https://www.anchorterminal.com/compare/localghost-vs-tokenrip.md)\n- [LocalGhost vs Zep](https://www.anchorterminal.com/compare/localghost-vs-zep.md)\n- [AnythingLLM vs PrivateGPT](https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.md)\n- [Berth vs PrivateGPT](https://www.anchorterminal.com/compare/berth-vs-privategpt.md)\n- [BitRun vs PrivateGPT](https://www.anchorterminal.com/compare/bitrun-vs-privategpt.md)\n- [Docker Model Runner vs PrivateGPT](https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.md)\n- [Foundry Local vs PrivateGPT](https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.md)\n- [Core vs PrivateGPT](https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.md)\n- [GPT4All vs PrivateGPT](https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.md)\n- [HyperQwen vs PrivateGPT](https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.md)\n- [Jan vs PrivateGPT](https://www.anchorterminal.com/compare/jan-vs-privategpt.md)\n- [KoboldCpp vs PrivateGPT](https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.md)\n- [Lemonade vs PrivateGPT](https://www.anchorterminal.com/compare/lemonade-vs-privategpt.md)\n- [llama.cpp vs PrivateGPT](https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.md)\n- [LM Studio vs PrivateGPT](https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.md)\n- [LocalAI vs PrivateGPT](https://www.anchorterminal.com/compare/localai-vs-privategpt.md)\n- [MLX LM vs PrivateGPT](https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.md)\n- [Ollama vs PrivateGPT](https://www.anchorterminal.com/compare/ollama-vs-privategpt.md)\n- [Open WebUI vs PrivateGPT](https://www.anchorterminal.com/compare/open-webui-vs-privategpt.md)\n- [PrivateGPT vs screenpipe](https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.md)\n- [PrivateGPT vs TextGen](https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.md)\n- [PrivateGPT vs vLLM](https://www.anchorterminal.com/compare/privategpt-vs-vllm.md)\n- [AnythingLLM vs LocalGhost](https://www.anchorterminal.com/compare/anythingllm-vs-localghost.md)\n- [Core vs LocalGhost](https://www.anchorterminal.com/compare/ghost-core-vs-localghost.md)\n- [GPT4All vs LocalGhost](https://www.anchorterminal.com/compare/gpt4all-vs-localghost.md)\n- [Khoj vs LocalGhost](https://www.anchorterminal.com/compare/khoj-vs-localghost.md)\n- [Khoj vs PrivateGPT](https://www.anchorterminal.com/compare/khoj-vs-privategpt.md)\n- [LocalGhost vs screenpipe](https://www.anchorterminal.com/compare/localghost-vs-screenpipe.md)\n\n## Disclosure\n\n- LocalGhost is built by Anchor Terminal's founder. Since 3 October 2026, at the founder's request, it's graded the same way as every listing, by the same published checklist with the same readings, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed. letme never picks it. Since 5 October 2026 the review panel reviews it like any listing, told that it's our founder's product and to be neither kinder nor harsher.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "LocalGhost vs PrivateGPT", "url": "" } ], "description": "LocalGhost scores 55.7 (C) to PrivateGPT's 53.2 (D) for memory search. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "LocalGhost C 55.7", "PrivateGPT D 53.2", "scores" ], "h1": "LocalGhost vs PrivateGPT", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/localghost-vs-privategpt", "published": "2026-10-01", "section": "tools", "title": "LocalGhost vs PrivateGPT for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/localghost-vs-privategpt" }, "tokens": { "markdown": 6200, "slim": 3580 }, "version": 1 }