MLX LM vs vLLM

MLX LM

MIT, with no telemetry found in the source, and the tests passed on the last eight pushes to main. mlx_lm.server has no API key option, answers any origin by default and loads whichever model a request names, and its own docs say it is not recommended for production.

vLLM

Apache-2.0 software with a release about every two weeks, each with notes that list breaking changes and security fixes. The optional API key covers only some path prefixes, so /invocations and control routes such as /pause answer without it, and at least 81 security advisories were published in the 12 months to 9 October 2026.

MLX LM

1. Keep mlx_lm.server on 127.0.0.1 and pass --allowed-origins with the origins you trust. There is no API key, and the default answers every origin
2. Treat any caller as able to load any model. The model and adapters request fields accept any Hugging Face repository or local path
3. Send max_tokens or max_completion_tokens when you need more than 512 tokens, the server default
4. Read errors as {"error": "<text>"} with 400 for a bad field and 404 for a model that failed to load. They are not OpenAI error objects
5. Poll GET /health before the first request. It answers 503 with unavailable when the generation thread has stopped

vLLM

1. Put a reverse proxy that allowlists routes in front of the server. --api-key leaves /invocations and the control routes open
2. Pass --host 127.0.0.1 for single-machine use. With no --host the server listens on every interface
3. Set VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 before starting if nothing should be sent to stats.vllm.ai
4. Start with --enable-auto-tool-choice and the --tool-call-parser for the model before sending tools. Tool calling is off without them
5. Send max_tokens on every request, and read the breaking changes section of the release notes before upgrading a minor version