{ "data": { "a": { "slug": "mlx-lm", "name": "MLX LM", "vendor": "Apple Inc.", "vendorUrl": "https://opensource.apple.com/projects/mlx/", "kind": "http-api", "category": "local-ai", "summary": "Open-source Python package and command-line tools from Apple's MLX team for running, quantising and fine-tuning language models on Apple silicon. `mlx_lm.server` exposes a local HTTP API modelled on OpenAI's chat completions.", "url": "https://www.anchorterminal.com/tools/mlx-lm", "markdownUrl": "https://www.anchorterminal.com/tools/mlx-lm.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mlx-lm.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mlx-lm.json", "repo": "https://github.com/ml-explore/mlx-lm", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "mlx-lm" } ], "auth": "none", "authNotes": "No credential, and no option to add one. `mlx_lm.server` binds 127.0.0.1:8080 by default, and `--allowed-origins` defaults to `*`, so any origin's requests are answered. Access control is left to the network or a proxy in front (https://github.com/ml-explore/mlx-lm/blob/main/mlx_lm/SERVER.md).", "pricing": "free", "pricingNotes": "Free under MIT, with no account, key or card. Nothing is sold. The owner pays for the hardware and electricity.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 7300, "npmWeekly": null, "pypiWeekly": 139915, "asOf": "2026-10-08" }, "docsUrl": "https://github.com/ml-explore/mlx-lm/blob/main/mlx_lm/SERVER.md", "capabilities": [ "inference.local", "inference.open-weights" ], "tags": [ "open-source", "local", "self-hosted", "free", "no-card", "openai-compatible", "python", "pre-1.0", "no-auth", "no-telemetry" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 52.2, "grade": "D", "agentReady": false, "rank": 657, "ranked": true, "rankOf": 842, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 61, "payments": 60, "reliability": 66, "schema": 37, "security": 32, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "MIT, with no telemetry found in the source, and the tests passed on the last eight pushes to main. `mlx_lm.server` has no API key option, answers any origin by default and loads whichever model a request names, and its own docs say it is not recommended for production.", "bestFor": "An owner with an Apple silicon Mac who wants MLX-format models, local fine-tuning and quantisation from Python or the command line, with a simple local chat completions server.", "strengths": [ "MIT, with no telemetry, analytics or update check found in the source", "Installs from PyPI (`mlx-lm` 0.32.0, Python 3.11 or later) and conda-forge, with releases published to PyPI by trusted publishing from a GitHub workflow", "The Build and Test workflow passed on the last eight pushes to main, with 21 test files run on a macOS runner", "`mlx_lm.server` binds 127.0.0.1:8080 by default, caps output at 512 tokens unless told otherwise and validates field types and ranges with a 400", "127 commits from 82 authors on main in the 90 days to 8 October 2026" ], "weaknesses": [ "`mlx_lm.server` has no API key or other credential option, and `--allowed-origins` defaults to `*`", "A request's `model` and `adapters` fields make the server download or load any Hugging Face repository or local path, with no allow-list (open issue #1892)", "The docs and a start-up warning say the server is not recommended for production because it has only basic security checks", "No OpenAPI file or llms.txt, and `SERVER.md` leaves out `tools`, `seed`, `/health` and the error responses", "One PyPI release in 90 days (0.32.0 on 1 October 2026, the first since 0.31.3 on 22 April), and the version is still 0.x" ], "agentNotes": [ "Keep `mlx_lm.server` on 127.0.0.1 and pass `--allowed-origins` with the origins you trust. There is no API key, and the default answers every origin", "Treat any caller as able to load any model. The `model` and `adapters` request fields accept any Hugging Face repository or local path", "Send `max_tokens` or `max_completion_tokens` when you need more than 512 tokens, the server default", "Read errors as `{\"error\": \"\u003ctext\u003e\"}` with 400 for a bad field and 404 for a model that failed to load. They are not OpenAI error objects", "Poll `GET /health` before the first request. It answers 503 with `unavailable` when the generation thread has stopped" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.2 } ], "editorialScores": { "ergonomics": 54, "maintenance": 61, "payments": 60, "reliability": 66, "schema": 37, "security": 32, "transparency": 65 }, "provenanceScore": 67 }, "connect": { "install": "pip install mlx-lm\nmlx_lm.server --model mlx-community/Mistral-7B-Instruct-v0.3-4bit # listens on 127.0.0.1:8080", "http": "curl localhost:8080/v1/chat/completions \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"messages\": [{\"role\": \"user\", \"content\": \"Say this is a test!\"}],\n \"temperature\": 0.7\n }'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/mlx-lm" }, "area": "models", "provenance": { "legalEntity": "Apple Inc.", "domain": "apple.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/ml-explore/mlx-lm/releases", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The `LICENSE` file reads Copyright 2023 Apple Inc., and the package author on PyPI is MLX Contributors at a group.apple.com address. The repository sits in GitHub's ml-explore organisation and has no website of its own.", "opensource.apple.com/projects/mlx describes the MLX framework and does not name MLX LM. Its footer links Apple's website terms and general privacy policy, which do not govern this software, so terms and privacy are left empty.", "www.apple.com/.well-known/security.txt is valid until 6 October 2027 and is Apple's corporate file. The repository's own policy takes reports through GitHub private vulnerability reporting.", "There is no shared hosted endpoint. The server runs on the owner's machine." ], "score": 67 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mlx-lm.json" }, "answer": "MLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "open-webui", "name": "Open WebUI", "vendor": "Open WebUI Inc.", "vendorUrl": "https://openwebui.com", "kind": "platform", "category": "local-ai", "summary": "Self-hosted web interface for chatting with models, from Open WebUI Inc., with a Python (FastAPI) back end and a Svelte front end.", "url": "https://www.anchorterminal.com/tools/open-webui", "markdownUrl": "https://www.anchorterminal.com/tools/open-webui.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/open-webui.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/open-webui.json", "repo": "https://github.com/open-webui/open-webui", "license": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "open-webui" }, { "registry": "oci", "name": "ghcr.io/open-webui/open-webui" } ], "auth": "api-key", "authNotes": "Sign-in is on by default (`WEBUI_AUTH`), the first account to sign up becomes admin, and sign-up then closes. An agent calls the API with `Authorization: Bearer \u003ctoken\u003e`, either an `sk-` API key from Settings \u003e Account or a session JWT, which lasts four weeks by default (`JWT_EXPIRES_IN`), and behind a reverse proxy that uses `Authorization` itself the key can go in an `x-api-key` header (https://docs.openwebui.com/reference/api-endpoints). API keys stay off until an administrator turns them on (`ENABLE_API_KEYS` defaults to false), a group permission decides who may create one, and they can be limited instance-wide to listed endpoints with `ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS` and `API_KEYS_ALLOWED_ENDPOINTS` (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/config.py). Each user has one key, `sk-` plus 32 hexadecimal characters, stored as plain text with a last-used time and no expiry set by the API (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py). People sign in with email and password, OAuth or OIDC, LDAP or trusted headers, with SCIM 2.0 provisioning.", "pricing": "free", "pricingNotes": "Free to self-host under the Open WebUI License. Deployments with more than 50 end users in a rolling 30 days have to keep the Open WebUI branding unless they hold an enterprise licence or written permission. The enterprise licence (white-labelling, SLA-backed support, Terminals) is sold through sales to registered organisations only, with no published prices (https://docs.openwebui.com/enterprise). There's no hosted Open WebUI service. You pay your model provider, or nothing with a local model (checked 2026-10-03).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 153000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://docs.openwebui.com", "llmsTxt": "https://docs.openwebui.com/llms.txt", "capabilities": [ "inference.local", "agent.mcp-client", "memory.user", "knowledge.search" ], "tags": [ "self-hosted", "local", "free", "python", "docker", "openai-compatible", "llms-txt", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 51.8, "grade": "D", "agentReady": false, "rank": 664, "ranked": true, "rankOf": 842, "categoryRank": 13, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -8, "negativeNotes": [ "2026-05-05. GHSA-2r4p-jpmg-48f4 (CVE-2026-44551, Critical, 9.1). LDAP sign-in accepted an empty password where the directory allows unauthenticated binds, giving full access to the victim's account. It affects 0.8.12 and earlier and was fixed in 0.9.0 (21 April 2026) before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4", "2026-07-02. GHSA-74h3-cxq7-vc5q (CVE-2026-59216, 7.7). A signed-in low-privilege user could run code and tools in another user's session through an unchecked Socket.IO session_id, which against an administrator meant code execution as the server process (root in default containers). Fixed in 0.10.0 on 29 June 2026 and published three days later, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q", "2026-08-02 and 2026-09-04. Two account takeovers through OAuth, both High. GHSA-rq84-p6rr-vf89 accepted tokens issued to any client in the OAuth token exchange (fixed in 0.11.0), and GHSA-wpmr-8h3q-fwj7 (8.1) matched OAuth and OIDC subjects by substring on SQLite, so a crafted subject could sign in as an existing account, administrators included (fixed in 0.11.1 on 25 August). Both fixed before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-rq84-p6rr-vf89; https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "2025-10-03 to 2026-10-03. The rest of the year's record. GitHub reviewed 143 of the repository's advisories in the 12 months to 3 October 2026, and 129 cover flaws fixed in releases from 0.6.35 (6 November 2025) on, 58 High and 1 Critical, more than half of them access-control or authorisation flaws by their titles and CWE tags. July to September alone brought 52 (18 High, 29 Moderate, 5 Low) in batches published on 2 July, 2 August and 4 September. Each was fixed in a release before publication, so the 125 beyond the four above count together, -2. https://github.com/open-webui/open-webui/security/advisories; https://github.com/advisories?query=open-webui+type%3Areviewed+ecosystem%3Apip" ], "verdict": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.", "bestFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations", "OpenAI-compatible `/api/chat/completions` and `/api/models`, plus an Anthropic Messages route and an Ollama proxy, so OpenAI's SDKs work against a local instance", "Roles, groups, per-model and per-knowledge access grants, a group permission for key creation and an instance-wide endpoint allowlist for keys", "An audit log at metadata, request or request-and-response level, plus events for key creation and deletion", "No product telemetry found, third-party analytics off in the Docker image, and `OFFLINE_MODE` to stop the release check and model downloads" ], "weaknesses": [ "API keys are off by default, and each user gets one key with no scopes or expiry", "The API reference covers seven route groups, and the OpenAPI file and Swagger UI need `ENV=dev`", "52 advisories published from July to September 2026, 18 of them High, including cross-user code execution (CVE-2026-59216) and two OAuth account takeovers, all fixed", "Pre-1.0 (0.11), with database migrations in patch releases and no rolling updates during them", "The branding clause makes the licence non-OSI, and the enterprise licence has no published price" ], "agentNotes": [ "Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then", "Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself", "Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections", "Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base", "Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.8 } ], "editorialScores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 66 }, "provenanceScore": 76 }, "connect": { "install": "pip install open-webui \u0026\u0026 open-webui serve # or: docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main", "http": "curl -X POST http://localhost:3000/api/chat/completions \\\n -H \"Authorization: Bearer $OPEN_WEBUI_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"llama3.1\", \"messages\": [{\"role\": \"user\", \"content\": \"Why is the sky blue?\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/open-webui" }, "area": "models", "provenance": { "legalEntity": "Open WebUI Inc.", "domain": "openwebui.com", "domainRegistered": "2024-02-17", "endpointOnVendorDomain": null, "terms": "https://openwebui.com/terms", "privacy": "https://openwebui.com/privacy", "statusPage": "", "changelog": "https://github.com/open-webui/open-webui/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-03", "notes": [ "The LICENSE copyright line names Open WebUI Inc., created by Timothy Jaeryang Baek, and the privacy policy names Open WebUI, Inc. with no address.", "openwebui.com/.well-known/security.txt points to GitHub Security Advisories and expires on 2027-06-30.", "The privacy policy, last updated on 31 December 2025, covers openwebui.com and its community services only, says nothing about the self-hosted software, and gives no retention periods.", "We found no status page linked from openwebui.com. There's no hosted service, so an instance answers on its owner's own host.", "RDAP for openwebui.com gives a registration date of 2024-02-17, registrar Cloudflare. The terms page wasn't read for this check." ], "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/open-webui.json", "live": { "slug": "open-webui", "versions": [ { "registry": "github", "name": "open-webui/open-webui", "version": "v0.11.4", "released": "2026-09-21", "seenAt": "2026-10-08T16:23:23.514992236Z" }, { "registry": "pypi", "name": "open-webui", "version": "0.11.4", "released": "2026-09-21", "seenAt": "2026-10-08T16:23:23.308399663Z" } ], "githubStars": 154214, "pypiWeekly": 160246, "securityTxt": { "url": "https://openwebui.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T00:00:00Z", "checkedAt": "2026-10-08T15:38:36.883295476Z" }, "llmsTxt": { "url": "https://docs.openwebui.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-08T14:00:42.85056463Z" }, "domain": { "domain": "openwebui.com", "registered": "2024-02-17", "source": "https://rdap.verisign.com/com/v1/domain/openwebui.com", "checkedAt": "2026-10-04T13:06:48.742159254Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/open-webui/open-webui/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-08T18:24:35.718320509Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3c27bf8cc8f9" }, { "url": "https://openwebui.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:22:41.670167526Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ab8757357aa3" }, { "url": "https://openwebui.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:22:44.619195054Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87cd832136e7" } ], "updatedAt": "2026-10-08T18:24:35.718320509Z" } }, "facts": [ { "a": "HTTP API", "b": "Model platform", "name": "Kind" }, { "a": "Apple Inc.", "b": "Open WebUI Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-01", "b": "2026-09-21", "name": "Last release" }, { "a": "no document linked", "b": "2026-07-07", "name": "Terms last updated" }, { "a": "no document linked", "b": "2025-12-31", "name": "Privacy policy last updated" }, { "a": "", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "7.3k stars, 140k PyPI/wk", "b": "153k stars", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "MLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, MLX LM or Open WebUI?" }, { "answer": "No hosted endpoint is listed for MLX LM. No hosted endpoint is listed for Open WebUI.", "question": "Can an agent call MLX LM and Open WebUI without installing anything?" }, { "answer": "MLX LM is open source (MIT). No open-source release is listed for Open WebUI.", "question": "Are MLX LM and Open WebUI open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 60 against 20" ], "also": [ "No key needed to call it", "Free to start without a card", "Open source", "No incidents deducted, where Open WebUI loses 8 points for them" ], "goodFor": "An owner with an Apple silicon Mac who wants MLX-format models, local fine-tuning and quantisation from Python or the command line, with a simple local chat completions server.", "slug": "mlx-lm", "watchFor": "`mlx_lm.server` has no API key or other credential option, and `--allowed-origins` defaults to `*`" }, { "aheadOn": [ "Schema \u0026 documentation, 60 against 37", "Security \u0026 auth, 63 against 32", "Maintenance \u0026 community, 91 against 61", "Transparency \u0026 trust, 71 against 66" ], "also": null, "goodFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "slug": "open-webui", "watchFor": "API keys are off by default, and each user gets one key with no scopes or expiry" } ], "job": { "capability": "inference.local", "name": "Local inference" }, "others": [ { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm.json", "title": "AnythingLLM vs MLX LM", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.json", "title": "AnythingLLM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-mlx-lm.json", "title": "Docker Model Runner vs MLX LM", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.json", "title": "Docker Model Runner vs Open WebUI", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-mlx-lm.json", "title": "Foundry Local vs MLX LM", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.json", "title": "Foundry Local vs Open WebUI", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-mlx-lm.json", "title": "Core vs MLX LM", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.json", "title": "Core vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-mlx-lm.json", "title": "GPT4All vs MLX LM", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.json", "title": "GPT4All vs Open WebUI", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-mlx-lm.json", "title": "Jan vs MLX LM", "url": "https://www.anchorterminal.com/compare/jan-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-open-webui.json", "title": "Jan vs Open WebUI", "url": "https://www.anchorterminal.com/compare/jan-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-mlx-lm.json", "title": "Khoj vs MLX LM", "url": "https://www.anchorterminal.com/compare/khoj-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-open-webui.json", "title": "Khoj vs Open WebUI", "url": "https://www.anchorterminal.com/compare/khoj-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-mlx-lm.json", "title": "KoboldCpp vs MLX LM", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.json", "title": "KoboldCpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-mlx-lm.json", "title": "Lemonade vs MLX LM", "url": "https://www.anchorterminal.com/compare/lemonade-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui.json", "title": "Lemonade vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-mlx-lm.json", "title": "llama.cpp vs MLX LM", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.json", "title": "llama.cpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-mlx-lm.json", "title": "LM Studio vs MLX LM", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.json", "title": "LM Studio vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-mlx-lm.json", "title": "LocalAI vs MLX LM", "url": "https://www.anchorterminal.com/compare/localai-vs-mlx-lm" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-open-webui.json", "title": "LocalAI vs Open WebUI", "url": "https://www.anchorterminal.com/compare/localai-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-ollama.json", "title": "MLX LM vs Ollama", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-ollama" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-screenpipe.json", "title": "MLX LM vs screenpipe", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-text-generation-webui.json", "title": "MLX LM vs TextGen", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-open-webui.json", "title": "Ollama vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ollama-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.json", "title": "Open WebUI vs screenpipe", "url": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.json", "title": "Open WebUI vs TextGen", "url": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-underdog.json", "title": "MLX LM vs Underdog", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-underdog" } ], "scores": [ { "by": 2, "edge": "open-webui", "key": "reliability", "mlx-lm": 66, "name": "Reliability", "open-webui": 68, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "edge": "open-webui", "key": "schema", "mlx-lm": 37, "name": "Schema \u0026 documentation", "open-webui": 60, "weight": 13 }, { "by": 0, "edge": "", "key": "ergonomics", "mlx-lm": 54, "name": "Agent ergonomics", "open-webui": 54, "weight": 13 }, { "by": 31, "edge": "open-webui", "key": "security", "mlx-lm": 32, "name": "Security \u0026 auth", "open-webui": 63, "weight": 14 }, { "by": 40, "edge": "mlx-lm", "key": "payments", "mlx-lm": 60, "name": "Payments \u0026 pricing", "open-webui": 20, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 30, "edge": "open-webui", "key": "maintenance", "mlx-lm": 61, "name": "Maintenance \u0026 community", "open-webui": 91, "weight": 7 }, { "by": 5, "edge": "open-webui", "key": "transparency", "mlx-lm": 66, "name": "Transparency \u0026 trust", "open-webui": 71, "weight": 7 } ], "summary": "MLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.", "verdicts": { "mlx-lm": "MIT, with no telemetry found in the source, and the tests passed on the last eight pushes to main. `mlx_lm.server` has no API key option, answers any origin by default and loads whichever model a request names, and its own docs say it is not recommended for production.", "open-webui": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui", "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.md", "slim": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.min.md" }, "markdown": "MLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.\n\n- MLX LM: grade D, 52.2/100, rank #657 of 842. Markdown https://www.anchorterminal.com/tools/mlx-lm.md · JSON https://www.anchorterminal.com/api/v1/tools/mlx-lm.json\n- Open WebUI: grade D, 51.8/100, rank #664 of 842. Markdown https://www.anchorterminal.com/tools/open-webui.md · JSON https://www.anchorterminal.com/api/v1/tools/open-webui.json\n\n## Which one, for what\n\n### MLX LM (D)\n\nGood for: An owner with an Apple silicon Mac who wants MLX-format models, local fine-tuning and quantisation from Python or the command line, with a simple local chat completions server.\n\nAhead on:\n- Payments \u0026 pricing, 60 against 20\n\nAlso in its favour:\n- No key needed to call it\n- Free to start without a card\n- Open source\n- No incidents deducted, where Open WebUI loses 8 points for them\n\nWatch for: `mlx_lm.server` has no API key or other credential option, and `--allowed-origins` defaults to `*`\n\n### Open WebUI (D)\n\nGood for: A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.\n\nAhead on:\n- Schema \u0026 documentation, 60 against 37\n- Security \u0026 auth, 63 against 32\n- Maintenance \u0026 community, 91 against 61\n- Transparency \u0026 trust, 71 against 66\n\nWatch for: API keys are off by default, and each user gets one key with no scopes or expiry\n\n\n## Score by category\n\n| Category | Weight | MLX LM | Open WebUI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 68 | Open WebUI +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 37 | 60 | Open WebUI +23 |\n| Agent ergonomics | 13% (16.2 this run) | 54 | 54 | even |\n| Security \u0026 auth | 14% (17.5 this run) | 32 | 63 | Open WebUI +31 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 20 | MLX LM +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 61 | 91 | Open WebUI +30 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 66 | 71 | Open WebUI +5 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **52.2 · D** | **51.8 · D** | |\n\n## Facts side by side\n\n| Fact | MLX LM | Open WebUI |\n| --- | --- | --- |\n| Kind | HTTP API | Model platform |\n| Vendor | Apple Inc. | Open WebUI Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | None | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-01 | 2026-09-21 |\n| Terms last updated | no document linked | 2026-07-07 |\n| Privacy policy last updated | no document linked | 2025-12-31 |\n| Customer content may train models | | yes, with an opt-out |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | not found in the text |\n| Arbitration or class-action waiver | | yes |\n| Popularity | 7.3k stars, 140k PyPI/wk | 153k stars |\n| Agent reviews | none | 2.5/5 (2) |\n\n## Verdicts\n\n**MLX LM.** MIT, with no telemetry found in the source, and the tests passed on the last eight pushes to main. `mlx_lm.server` has no API key option, answers any origin by default and loads whichever model a request names, and its own docs say it is not recommended for production.\n\n**Open WebUI.** Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.\n\n## Before you call either\n\n### MLX LM\n\n1. Keep `mlx_lm.server` on 127.0.0.1 and pass `--allowed-origins` with the origins you trust. There is no API key, and the default answers every origin\n2. Treat any caller as able to load any model. The `model` and `adapters` request fields accept any Hugging Face repository or local path\n3. Send `max_tokens` or `max_completion_tokens` when you need more than 512 tokens, the server default\n4. Read errors as `{\"error\": \"\u003ctext\u003e\"}` with 400 for a bad field and 404 for a model that failed to load. They are not OpenAI error objects\n5. Poll `GET /health` before the first request. It answers 503 with `unavailable` when the generation thread has stopped\n\n### Open WebUI\n\n1. Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then\n2. Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself\n3. Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections\n4. Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base\n5. Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist\n\n## Questions\n\n### Which is better for AI agents, MLX LM or Open WebUI?\n\nMLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.\n\n### Can an agent call MLX LM and Open WebUI without installing anything?\n\nNo hosted endpoint is listed for MLX LM. No hosted endpoint is listed for Open WebUI.\n\n### Are MLX LM and Open WebUI open source?\n\nMLX LM is open source (MIT). No open-source release is listed for Open WebUI.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mlx-lm\", \"b\": \"open-webui\"}`. From a terminal: `anchor compare mlx-lm open-webui`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mlx-lm.json and https://www.anchorterminal.com/api/v1/tools/open-webui.json\n\n## Other comparisons with MLX LM or Open WebUI\n\n- [AnythingLLM vs MLX LM](https://www.anchorterminal.com/compare/anythingllm-vs-mlx-lm.md)\n- [AnythingLLM vs Open WebUI](https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.md)\n- [Docker Model Runner vs MLX LM](https://www.anchorterminal.com/compare/docker-model-runner-vs-mlx-lm.md)\n- [Docker Model Runner vs Open WebUI](https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.md)\n- [Foundry Local vs MLX LM](https://www.anchorterminal.com/compare/foundry-local-vs-mlx-lm.md)\n- [Foundry Local vs Open WebUI](https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.md)\n- [Core vs MLX LM](https://www.anchorterminal.com/compare/ghost-core-vs-mlx-lm.md)\n- [Core vs Open WebUI](https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.md)\n- [GPT4All vs MLX LM](https://www.anchorterminal.com/compare/gpt4all-vs-mlx-lm.md)\n- [GPT4All vs Open WebUI](https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.md)\n- [Jan vs MLX LM](https://www.anchorterminal.com/compare/jan-vs-mlx-lm.md)\n- [Jan vs Open WebUI](https://www.anchorterminal.com/compare/jan-vs-open-webui.md)\n- [Khoj vs MLX LM](https://www.anchorterminal.com/compare/khoj-vs-mlx-lm.md)\n- [Khoj vs Open WebUI](https://www.anchorterminal.com/compare/khoj-vs-open-webui.md)\n- [KoboldCpp vs MLX LM](https://www.anchorterminal.com/compare/koboldcpp-vs-mlx-lm.md)\n- [KoboldCpp vs Open WebUI](https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.md)\n- [Lemonade vs MLX LM](https://www.anchorterminal.com/compare/lemonade-vs-mlx-lm.md)\n- [Lemonade vs Open WebUI](https://www.anchorterminal.com/compare/lemonade-vs-open-webui.md)\n- [llama.cpp vs MLX LM](https://www.anchorterminal.com/compare/llama-cpp-vs-mlx-lm.md)\n- [llama.cpp vs Open WebUI](https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.md)\n- [LM Studio vs MLX LM](https://www.anchorterminal.com/compare/lm-studio-vs-mlx-lm.md)\n- [LM Studio vs Open WebUI](https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.md)\n- [LocalAI vs MLX LM](https://www.anchorterminal.com/compare/localai-vs-mlx-lm.md)\n- [LocalAI vs Open WebUI](https://www.anchorterminal.com/compare/localai-vs-open-webui.md)\n- [MLX LM vs Ollama](https://www.anchorterminal.com/compare/mlx-lm-vs-ollama.md)\n- [MLX LM vs screenpipe](https://www.anchorterminal.com/compare/mlx-lm-vs-screenpipe.md)\n- [MLX LM vs TextGen](https://www.anchorterminal.com/compare/mlx-lm-vs-text-generation-webui.md)\n- [Ollama vs Open WebUI](https://www.anchorterminal.com/compare/ollama-vs-open-webui.md)\n- [Open WebUI vs screenpipe](https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.md)\n- [Open WebUI vs TextGen](https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.md)\n- [MLX LM vs Underdog](https://www.anchorterminal.com/compare/mlx-lm-vs-underdog.md)\n\n## Disclosure\n\n- Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "MLX LM vs Open WebUI", "url": "" } ], "description": "MLX LM and Open WebUI score within a point of each other on agent readiness, 52.2 (D) and 51.8 (D). Open WebUI leads on schema \u0026 documentation, security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference. Category scores, facts, verdicts and agent…", "facts": [ "MLX LM D 52.2", "Open WebUI D 51.8", "scores" ], "h1": "MLX LM vs Open WebUI", "image": "https://www.anchorterminal.com/assets/og/compare-mlx-lm-vs-open-webui.png", "path": "/compare/mlx-lm-vs-open-webui", "published": "2026-10-01", "section": "tools", "title": "MLX LM vs Open WebUI for AI agents, D 52.2 vs D 51.8 | Anchor Terminal", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui" }, "tokens": { "markdown": 2650, "slim": 780 }, "version": 1 }