{ "data": { "a": { "slug": "open-webui", "name": "Open WebUI", "vendor": "Open WebUI Inc.", "vendorUrl": "https://openwebui.com", "kind": "platform", "category": "local-ai", "summary": "Self-hosted web interface for chatting with models, from Open WebUI Inc., with a Python (FastAPI) back end and a Svelte front end.", "url": "https://www.anchorterminal.com/tools/open-webui", "markdownUrl": "https://www.anchorterminal.com/tools/open-webui.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/open-webui.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/open-webui.json", "dns": "open-webui.grade.anchorterminal.com", "repo": "https://github.com/open-webui/open-webui", "license": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "transports": [ "http" ], "packages": [ { "registry": "pypi", "name": "open-webui" }, { "registry": "oci", "name": "ghcr.io/open-webui/open-webui" } ], "auth": "api-key", "authNotes": "Sign-in is on by default (`WEBUI_AUTH`), the first account to sign up becomes admin, and sign-up then closes. An agent calls the API with `Authorization: Bearer \u003ctoken\u003e`, either an `sk-` API key from Settings \u003e Account or a session JWT, which lasts four weeks by default (`JWT_EXPIRES_IN`), and behind a reverse proxy that uses `Authorization` itself the key can go in an `x-api-key` header (https://docs.openwebui.com/reference/api-endpoints). API keys stay off until an administrator turns them on (`ENABLE_API_KEYS` defaults to false), a group permission decides who may create one, and they can be limited instance-wide to listed endpoints with `ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS` and `API_KEYS_ALLOWED_ENDPOINTS` (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/config.py). Each user has one key, `sk-` plus 32 hexadecimal characters, stored as plain text with a last-used time and no expiry set by the API (https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py). People sign in with email and password, OAuth or OIDC, LDAP or trusted headers, with SCIM 2.0 provisioning.", "pricing": "free", "pricingNotes": "Free to self-host under the Open WebUI License. Deployments with more than 50 end users in a rolling 30 days have to keep the Open WebUI branding unless they hold an enterprise licence or written permission. The enterprise licence (white-labelling, SLA-backed support, Terminals) is sold through sales to registered organisations only, with no published prices (https://docs.openwebui.com/enterprise). There's no hosted Open WebUI service. You pay your model provider, or nothing with a local model (checked 2026-10-03).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-03).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 153000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-03" }, "docsUrl": "https://docs.openwebui.com", "llmsTxt": "https://docs.openwebui.com/llms.txt", "capabilities": [ "inference.local", "agent.mcp-client", "memory.user", "knowledge.search" ], "tags": [ "self-hosted", "local", "free", "python", "docker", "openai-compatible", "llms-txt", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 52, "grade": "D", "agentReady": false, "rank": 1004, "ranked": true, "rankOf": 1510, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-03" }, "negative": -8, "negativeNotes": [ "2026-05-05. GHSA-2r4p-jpmg-48f4 (CVE-2026-44551, Critical, 9.1). LDAP sign-in accepted an empty password where the directory allows unauthenticated binds, giving full access to the victim's account. It affects 0.8.12 and earlier and was fixed in 0.9.0 (21 April 2026) before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4", "2026-07-02. GHSA-74h3-cxq7-vc5q (CVE-2026-59216, 7.7). A signed-in low-privilege user could run code and tools in another user's session through an unchecked Socket.IO session_id, which against an administrator meant code execution as the server process (root in default containers). Fixed in 0.10.0 on 29 June 2026 and published three days later, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q", "2026-08-02 and 2026-09-04. Two account takeovers through OAuth, both High. GHSA-rq84-p6rr-vf89 accepted tokens issued to any client in the OAuth token exchange (fixed in 0.11.0), and GHSA-wpmr-8h3q-fwj7 (8.1) matched OAuth and OIDC subjects by substring on SQLite, so a crafted subject could sign in as an existing account, administrators included (fixed in 0.11.1 on 25 August). Both fixed before publication, -2. https://github.com/open-webui/open-webui/security/advisories/GHSA-rq84-p6rr-vf89; https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "2025-10-03 to 2026-10-03. The rest of the year's record. GitHub reviewed 143 of the repository's advisories in the 12 months to 3 October 2026, and 129 cover flaws fixed in releases from 0.6.35 (6 November 2025) on, 58 High and 1 Critical, more than half of them access-control or authorisation flaws by their titles and CWE tags. July to September alone brought 52 (18 High, 29 Moderate, 5 Low) in batches published on 2 July, 2 August and 4 September. Each was fixed in a release before publication, so the 125 beyond the four above count together, -2. https://github.com/open-webui/open-webui/security/advisories; https://github.com/advisories?query=open-webui+type%3Areviewed+ecosystem%3Apip" ], "verdict": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.", "bestFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "disclosure": "Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations", "OpenAI-compatible `/api/chat/completions` and `/api/models`, plus an Anthropic Messages route and an Ollama proxy, so OpenAI's SDKs work against a local instance", "Roles, groups, per-model and per-knowledge access grants, a group permission for key creation and an instance-wide endpoint allowlist for keys", "An audit log at metadata, request or request-and-response level, plus events for key creation and deletion", "No product telemetry found, third-party analytics off in the Docker image, and `OFFLINE_MODE` to stop the release check and model downloads" ], "weaknesses": [ "API keys are off by default, and each user gets one key with no scopes or expiry", "The API reference covers seven route groups, and the OpenAPI file and Swagger UI need `ENV=dev`", "52 advisories published from July to September 2026, 18 of them High, including cross-user code execution (CVE-2026-59216) and two OAuth account takeovers, all fixed", "Pre-1.0 (0.11), with database migrations in patch releases and no rolling updates during them", "The branding clause makes the licence non-OSI, and the enterprise licence has no published price" ], "agentNotes": [ "Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then", "Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself", "Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections", "Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base", "Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52 } ], "editorialScores": { "ergonomics": 54, "maintenance": 91, "payments": 20, "reliability": 68, "schema": 60, "security": 63, "transparency": 66 }, "provenanceScore": 80, "checked": { "categories": { "ergonomics": "2026-10-03", "maintenance": "2026-10-03", "payments": "2026-10-03", "reliability": "2026-10-03", "schema": "2026-10-03", "security": "2026-10-03", "transparency": "2026-10-03" }, "last": "2026-10-03", "lastMoved": "2026-10-27", "oldest": "2026-10-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install open-webui \u0026\u0026 open-webui serve # or: docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main", "http": "curl -X POST http://localhost:3000/api/chat/completions \\\n -H \"Authorization: Bearer $OPEN_WEBUI_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"llama3.1\", \"messages\": [{\"role\": \"user\", \"content\": \"Why is the sky blue?\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/open-webui" }, "area": "models", "provenance": { "legalEntity": "Open WebUI Inc.", "domain": "openwebui.com", "domainRegistered": "2024-02-17", "endpointOnVendorDomain": null, "terms": "https://openwebui.com/terms", "privacy": "https://openwebui.com/privacy", "statusPage": "", "changelog": "https://github.com/open-webui/open-webui/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-03", "notes": [ "The LICENSE copyright line names Open WebUI Inc., created by Timothy Jaeryang Baek, and the privacy policy names Open WebUI, Inc. with no address.", "openwebui.com/.well-known/security.txt points to GitHub Security Advisories and expires on 2027-06-30.", "The privacy policy, last updated on 31 December 2025, covers openwebui.com and its community services only, says nothing about the self-hosted software, and gives no retention periods.", "We found no status page linked from openwebui.com. There's no hosted service, so an instance answers on its owner's own host.", "RDAP for openwebui.com gives a registration date of 2024-02-17, registrar Cloudflare. The terms page wasn't read for this check." ], "score": 80 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/open-webui.json", "live": { "slug": "open-webui", "versions": [ { "registry": "github", "name": "open-webui/open-webui", "version": "v0.13.0", "released": "2026-11-03", "seenAt": "2026-11-06T23:51:28.628674898Z" }, { "registry": "pypi", "name": "open-webui", "version": "0.13.0", "released": "2026-11-03", "seenAt": "2026-11-06T23:51:28.438718796Z" } ], "githubStars": 157952, "pypiWeekly": 249977, "securityTxt": { "url": "https://openwebui.com/.well-known/security.txt", "state": "valid", "expires": "2027-06-30T00:00:00Z", "checkedAt": "2026-11-07T16:01:37.63577102Z" }, "llmsTxt": { "url": "https://docs.openwebui.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:22.751664247Z" }, "domain": { "domain": "openwebui.com", "registered": "2024-02-17", "source": "https://rdap.verisign.com/com/v1/domain/openwebui.com", "checkedAt": "2026-11-01T14:10:23.964544919Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/open-webui/open-webui/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:22:29.254379971Z", "changedAt": "2026-11-04T08:34:44.240322734Z", "fingerprint": "5cb673f450c1" }, { "url": "https://openwebui.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:15:39.383617325Z", "changedAt": "2026-10-28T04:39:43.062313955Z", "fingerprint": "8271f6db6c25" }, { "url": "https://openwebui.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:15:42.336407014Z", "changedAt": "2026-10-28T04:39:46.063640237Z", "fingerprint": "5fbef3db2a19" } ], "github": { "repo": "open-webui/open-webui", "checkedAt": "2026-11-02T09:12:40.404186724Z", "stars": 157520, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:49:52Z", "openIssues": 150, "openPRs": 14, "issuesOpened90d": 1578, "issuesClosed90d": 1681, "prsMerged90d": 1260, "ci": { "branch": "main", "runs": 50, "success": 43, "failure": 6, "other": 1, "latest": "success", "latestAt": "2026-10-29T09:11:37Z" }, "advisories": [ { "ghsa": "GHSA-3vvh-g22g-jq6r", "severity": "medium", "published": "2026-10-18T19:50:50Z" }, { "ghsa": "GHSA-q46m-r89w-j74p", "cve": "CVE-2026-109572", "severity": "high", "published": "2026-09-28T16:36:41Z" }, { "ghsa": "GHSA-gqfh-jxvw-74rp", "cve": "CVE-2026-109292", "severity": "medium", "published": "2026-09-27T19:55:15Z" }, { "ghsa": "GHSA-whgc-vpjx-m3qh", "cve": "CVE-2026-109297", "severity": "medium", "published": "2026-09-27T19:53:56Z" }, { "ghsa": "GHSA-wf9m-46cp-c6h6", "cve": "CVE-2026-109288", "severity": "medium", "published": "2026-09-27T19:51:36Z" }, { "ghsa": "GHSA-w8j8-jv6j-3m47", "cve": "CVE-2026-109294", "severity": "medium", "published": "2026-09-27T19:49:07Z" }, { "ghsa": "GHSA-vpq8-f445-hcq7", "cve": "CVE-2026-109286", "severity": "high", "published": "2026-09-27T19:47:06Z" }, { "ghsa": "GHSA-qpqv-xwg8-cqpj", "cve": "CVE-2026-109291", "severity": "high", "published": "2026-09-27T19:45:25Z" }, { "ghsa": "GHSA-jx3w-3pqq-7f3w", "cve": "CVE-2026-109287", "severity": "medium", "published": "2026-09-27T19:34:53Z" }, { "ghsa": "GHSA-hm62-64q2-6gxw", "cve": "CVE-2026-109296", "severity": "medium", "published": "2026-09-27T19:33:41Z" }, { "ghsa": "GHSA-gww9-mhgj-pfqh", "cve": "CVE-2026-109298", "severity": "medium", "published": "2026-09-27T19:32:16Z" }, { "ghsa": "GHSA-gfjp-5hc9-852r", "cve": "CVE-2026-109295", "severity": "medium", "published": "2026-09-27T19:30:44Z" }, { "ghsa": "GHSA-f9xp-mfmq-x6cg", "cve": "CVE-2026-109290", "severity": "high", "published": "2026-09-27T19:29:00Z" }, { "ghsa": "GHSA-9wj4-mcm3-ppj6", "cve": "CVE-2026-109300", "severity": "medium", "published": "2026-09-27T19:27:08Z" }, { "ghsa": "GHSA-9cxp-636w-4997", "cve": "CVE-2026-109285", "severity": "medium", "published": "2026-09-27T19:25:50Z" }, { "ghsa": "GHSA-6g45-8g27-fh8q", "cve": "CVE-2026-109289", "severity": "medium", "published": "2026-09-27T19:22:59Z" }, { "ghsa": "GHSA-6fjc-5cg3-mgvh", "cve": "CVE-2026-109284", "severity": "medium", "published": "2026-09-27T16:42:03Z" }, { "ghsa": "GHSA-5w58-mwmh-vf2m", "cve": "CVE-2026-109299", "severity": "medium", "published": "2026-09-27T16:31:36Z" }, { "ghsa": "GHSA-2rr4-q6pg-m5g3", "cve": "CVE-2026-109283", "severity": "medium", "published": "2026-09-27T16:14:42Z" }, { "ghsa": "GHSA-2h26-836q-4jh2", "cve": "CVE-2026-109293", "severity": "medium", "published": "2026-09-27T15:58:57Z" }, { "ghsa": "GHSA-wvm9-9g5j-623f", "cve": "CVE-2026-88006", "severity": "medium", "published": "2026-09-09T21:59:45Z" }, { "ghsa": "GHSA-3g9q-v48f-hh9w", "cve": "CVE-2026-87011", "severity": "high", "published": "2026-09-04T12:08:59Z" }, { "ghsa": "GHSA-v39v-59xw-j98g", "cve": "CVE-2026-87012", "severity": "medium", "published": "2026-09-04T12:05:52Z" }, { "ghsa": "GHSA-8r35-5x5r-hv74", "cve": "CVE-2026-87013", "severity": "medium", "published": "2026-09-04T11:49:34Z" }, { "ghsa": "GHSA-wjwr-xfp9-r66p", "cve": "CVE-2026-87014", "severity": "medium", "published": "2026-09-04T11:48:27Z" }, { "ghsa": "GHSA-p78m-89r6-pgf7", "cve": "CVE-2026-87015", "severity": "medium", "published": "2026-09-04T11:47:12Z" }, { "ghsa": "GHSA-wpmr-8h3q-fwj7", "cve": "CVE-2026-87016", "severity": "high", "published": "2026-09-04T11:43:51Z" }, { "ghsa": "GHSA-pcvc-8vrv-8q6w", "cve": "CVE-2026-87017", "severity": "medium", "published": "2026-08-31T16:13:50Z" }, { "ghsa": "GHSA-fmqh-xp37-5hr8", "cve": "CVE-2026-87994", "severity": "medium", "published": "2026-08-31T15:48:12Z" }, { "ghsa": "GHSA-jmc6-2wr8-h3wj", "cve": "CVE-2026-87995", "severity": "high", "published": "2026-08-31T15:43:57Z" }, { "ghsa": "GHSA-4v28-j6q3-5m4r", "cve": "CVE-2026-87996", "severity": "high", "published": "2026-08-31T15:42:38Z" }, { "ghsa": "GHSA-3pf7-q2g3-wj28", "cve": "CVE-2026-87997", "severity": "medium", "published": "2026-08-30T17:00:13Z" }, { "ghsa": "GHSA-2724-6cpj-gf3v", "cve": "CVE-2026-87998", "severity": "high", "published": "2026-08-30T16:54:04Z" }, { "ghsa": "GHSA-34r3-9m95-vq73", "cve": "CVE-2026-87999", "severity": "high", "published": "2026-08-30T16:48:07Z" }, { "ghsa": "GHSA-3cgp-3cqx-j8w2", "cve": "CVE-2026-88000", "severity": "medium", "published": "2026-08-29T11:52:10Z" }, { "ghsa": "GHSA-5x7x-4c3c-qf5w", "cve": "CVE-2026-88001", "severity": "medium", "published": "2026-08-29T11:49:13Z" }, { "ghsa": "GHSA-jqhh-cjmq-vmv6", "cve": "CVE-2026-88002", "severity": "medium", "published": "2026-08-29T10:57:26Z" }, { "ghsa": "GHSA-4qg5-cxx4-g927", "cve": "CVE-2026-88005", "severity": "medium", "published": "2026-08-29T10:45:07Z" }, { "ghsa": "GHSA-8x5v-cpv7-8jjp", "cve": "CVE-2026-70485", "severity": "high", "published": "2026-08-02T23:12:13Z" }, { "ghsa": "GHSA-3vf6-64vr-3g56", "cve": "CVE-2026-70483", "severity": "low", "published": "2026-08-02T23:10:05Z" }, { "ghsa": "GHSA-pwxh-7358-jq2x", "cve": "CVE-2026-70492", "severity": "high", "published": "2026-08-02T23:08:30Z" }, { "ghsa": "GHSA-6xhv-rxhv-pwm4", "cve": "CVE-2026-70487", "severity": "medium", "published": "2026-08-02T23:07:17Z" }, { "ghsa": "GHSA-jxc9-xmc4-gr23", "cve": "CVE-2026-70488", "severity": "medium", "published": "2026-08-02T23:05:27Z" }, { "ghsa": "GHSA-5gpj-vj23-vhhv", "cve": "CVE-2026-70490", "severity": "medium", "published": "2026-08-02T23:04:23Z" }, { "ghsa": "GHSA-g423-grf7-98rv", "cve": "CVE-2026-70484", "severity": "medium", "published": "2026-08-02T22:58:19Z" }, { "ghsa": "GHSA-rffm-9q57-q649", "cve": "CVE-2026-70480", "severity": "medium", "published": "2026-08-02T22:54:08Z" }, { "ghsa": "GHSA-3r7g-q6cg-q2vx", "cve": "CVE-2026-70491", "severity": "medium", "published": "2026-08-02T22:47:08Z" }, { "ghsa": "GHSA-3xpf-xq7r-v8c5", "cve": "CVE-2026-70486", "severity": "high", "published": "2026-08-02T22:30:32Z" }, { "ghsa": "GHSA-2f54-p244-32q6", "cve": "CVE-2026-70493", "severity": "medium", "published": "2026-08-02T22:28:14Z" }, { "ghsa": "GHSA-73cq-mcgh-379c", "cve": "CVE-2026-70489", "severity": "medium", "published": "2026-08-02T22:08:09Z" }, { "ghsa": "GHSA-mj5r-jf49-m3w7", "cve": "CVE-2026-70481", "severity": "medium", "published": "2026-08-02T21:40:08Z" }, { "ghsa": "GHSA-w2rx-84hp-gg95", "cve": "CVE-2026-70479", "severity": "high", "published": "2026-08-02T21:36:36Z" }, { "ghsa": "GHSA-3cg5-48j3-v4gv", "cve": "CVE-2026-70494", "severity": "high", "published": "2026-08-02T21:21:29Z" }, { "ghsa": "GHSA-rq84-p6rr-vf89", "cve": "CVE-2026-70482", "severity": "high", "published": "2026-08-02T21:03:25Z" }, { "ghsa": "GHSA-frvj-c5qp-xj4w", "cve": "CVE-2026-59221", "severity": "high", "published": "2026-07-02T19:47:03Z" }, { "ghsa": "GHSA-m3qf-58wf-w979", "cve": "CVE-2026-59225", "severity": "medium", "published": "2026-07-02T16:33:50Z" }, { "ghsa": "GHSA-2xwm-4h2q-ggfx", "cve": "CVE-2026-59212", "severity": "medium", "published": "2026-07-02T15:58:11Z" }, { "ghsa": "GHSA-j657-m4c4-24jq", "cve": "CVE-2026-59224", "severity": "high", "published": "2026-07-02T15:10:12Z" }, { "ghsa": "GHSA-qg3f-8x3j-ggf2", "cve": "CVE-2026-59223", "severity": "medium", "published": "2026-07-02T14:56:49Z" }, { "ghsa": "GHSA-gh7p-78x6-jw6m", "cve": "CVE-2026-59222", "severity": "medium", "published": "2026-07-02T14:53:06Z" }, { "ghsa": "GHSA-73x5-h92w-xc2j", "cve": "CVE-2026-59215", "severity": "low", "published": "2026-07-02T14:45:45Z" }, { "ghsa": "GHSA-3wp3-xxj9-5jqq", "cve": "CVE-2026-59213", "severity": "low", "published": "2026-07-02T13:58:12Z" }, { "ghsa": "GHSA-7r7x-gjvr-448g", "cve": "CVE-2026-59217", "severity": "medium", "published": "2026-07-02T13:39:00Z" }, { "ghsa": "GHSA-74h3-cxq7-vc5q", "cve": "CVE-2026-59216", "severity": "high", "published": "2026-07-02T13:20:56Z" }, { "ghsa": "GHSA-x2ff-v5v8-m75m", "cve": "CVE-2026-59714", "severity": "high", "published": "2026-07-02T12:52:22Z" }, { "ghsa": "GHSA-855v-hq7w-jmjw", "cve": "CVE-2026-59219", "severity": "high", "published": "2026-07-02T12:41:09Z" }, { "ghsa": "GHSA-rqj7-6wrp-6g2g", "cve": "CVE-2026-59227", "severity": "medium", "published": "2026-06-29T23:29:25Z" }, { "ghsa": "GHSA-ffpj-xv5c-p3gw", "cve": "CVE-2026-59220", "severity": "medium", "published": "2026-06-29T23:25:59Z" }, { "ghsa": "GHSA-mvx4-532p-xfm9", "cve": "CVE-2026-59226", "severity": "low", "published": "2026-06-29T23:19:39Z" }, { "ghsa": "GHSA-9rpj-v7hf-vv2w", "cve": "CVE-2026-54021", "severity": "medium", "published": "2026-06-11T19:13:54Z" }, { "ghsa": "GHSA-p5cp-r7rg-qpxc", "cve": "CVE-2026-54019", "severity": "medium", "published": "2026-06-11T19:09:52Z" }, { "ghsa": "GHSA-cx9v-4qj2-jrw6", "cve": "CVE-2026-54016", "severity": "medium", "published": "2026-06-11T19:06:16Z" }, { "ghsa": "GHSA-4r4w-2wgp-w7cj", "cve": "CVE-2026-54015", "severity": "medium", "published": "2026-06-11T19:05:34Z" }, { "ghsa": "GHSA-j2c8-v969-8r5c", "cve": "CVE-2026-54014", "severity": "medium", "published": "2026-06-11T19:04:46Z" }, { "ghsa": "GHSA-v2qm-5wxj-qhj7", "cve": "CVE-2026-54013", "severity": "high", "published": "2026-06-11T19:02:12Z" }, { "ghsa": "GHSA-vjqm-6gcc-62cr", "cve": "CVE-2026-54012", "severity": "high", "published": "2026-06-11T18:58:16Z" }, { "ghsa": "GHSA-v8qj-hxv7-mgvv", "cve": "CVE-2026-54011", "severity": "high", "published": "2026-06-11T18:58:03Z" }, { "ghsa": "GHSA-vrhc-3fr6-pc3c", "cve": "CVE-2026-54010", "severity": "high", "published": "2026-06-11T18:57:21Z" }, { "ghsa": "GHSA-wch8-mhj5-9frg", "cve": "CVE-2026-54009", "severity": "medium", "published": "2026-06-11T18:57:04Z" }, { "ghsa": "GHSA-226f-f24g-524w", "cve": "CVE-2026-54008", "severity": "high", "published": "2026-06-11T18:56:45Z" }, { "ghsa": "GHSA-3vv5-8xxp-4f55", "cve": "CVE-2026-54007", "severity": "high", "published": "2026-06-11T18:56:24Z" }, { "ghsa": "GHSA-f3g7-59qc-pqg6", "cve": "CVE-2026-54006", "severity": "medium", "published": "2026-06-11T18:55:57Z" }, { "ghsa": "GHSA-3wgj-c2hg-vm6q", "severity": "high", "published": "2026-05-10T19:49:20Z" }, { "ghsa": "GHSA-65pg-qhhw-mxwg", "cve": "CVE-2026-45397", "severity": "medium", "published": "2026-05-10T19:35:12Z" }, { "ghsa": "GHSA-rjmp-vjf2-qf4g", "cve": "CVE-2026-45396", "severity": "medium", "published": "2026-05-10T19:34:32Z" }, { "ghsa": "GHSA-p4fx-23fq-jfg6", "cve": "CVE-2026-45395", "severity": "high", "published": "2026-05-10T19:34:01Z" }, { "ghsa": "GHSA-hcwp-82g6-8wxc", "cve": "CVE-2026-45318", "severity": "medium", "published": "2026-05-09T08:02:58Z" }, { "ghsa": "GHSA-jx2x-j75f-xq3j", "cve": "CVE-2026-45316", "severity": "low", "published": "2026-05-09T08:02:53Z" }, { "ghsa": "GHSA-m8f9-9whg-f4xr", "cve": "CVE-2026-45315", "severity": "high", "published": "2026-05-09T08:02:50Z" }, { "ghsa": "GHSA-3856-3vxq-m6fc", "cve": "CVE-2026-45314", "severity": "high", "published": "2026-05-09T08:02:43Z" }, { "ghsa": "GHSA-rcvp-6fgw-c7fh", "cve": "CVE-2026-44563", "severity": "medium", "published": "2026-05-05T11:19:27Z" }, { "ghsa": "GHSA-mqq6-cqcx-38vg", "cve": "CVE-2026-44562", "severity": "medium", "published": "2026-05-05T11:19:22Z" }, { "ghsa": "GHSA-7rjh-px4v-5w55", "cve": "CVE-2026-44558", "severity": "medium", "published": "2026-05-05T11:19:02Z" }, { "ghsa": "GHSA-6c2x-gcp3-gp73", "cve": "CVE-2026-44557", "severity": "medium", "published": "2026-05-05T11:18:53Z" }, { "ghsa": "GHSA-9vvh-qmjx-p4q8", "cve": "CVE-2026-44555", "severity": "high", "published": "2026-05-05T11:18:42Z" }, { "ghsa": "GHSA-7r82-qhg4-6wvj", "cve": "CVE-2026-44554", "severity": "high", "published": "2026-05-05T11:18:35Z" }, { "ghsa": "GHSA-45m8-cpm2-3v65", "cve": "CVE-2026-44553", "severity": "high", "published": "2026-05-05T11:18:29Z" }, { "ghsa": "GHSA-3x8w-4f7p-xxc2", "cve": "CVE-2026-44552", "severity": "high", "published": "2026-05-05T11:18:22Z" }, { "ghsa": "GHSA-2r4p-jpmg-48f4", "cve": "CVE-2026-44551", "severity": "critical", "published": "2026-05-05T11:18:17Z" }, { "ghsa": "GHSA-hr43-rjmr-7wmm", "cve": "CVE-2026-44550", "severity": "medium", "published": "2026-05-05T11:18:11Z" } ] }, "updatedAt": "2026-11-07T16:01:37.63577102Z" } }, "answer": "PrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "privategpt", "name": "PrivateGPT", "vendor": "Zylon (PriBAI Technology Spain S.L.)", "vendorUrl": "https://docs.privategpt.dev", "kind": "http-api", "category": "local-ai", "summary": "PrivateGPT is Zylon's open-source server that puts an Anthropic-style messages API, document ingestion, retrieval with citations, built-in tools and MCP connectors in front of any OpenAI-compatible local model server. The owner runs it.", "url": "https://www.anchorterminal.com/tools/privategpt", "markdownUrl": "https://www.anchorterminal.com/tools/privategpt.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/privategpt.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/privategpt.json", "dns": "privategpt.grade.anchorterminal.com", "repo": "https://github.com/zylon-ai/private-gpt", "license": "Apache-2.0", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "zylonai/private-gpt" } ], "auth": "none", "authNotes": "Authentication is off by default. When `server.auth.enabled` is set, every request must carry one static secret in the `Authorization` header, compared with the whole header value. There are no per-user keys, scopes or rotation, and the docs show it as a Bearer token, a Basic value and an Anthropic API key in different places (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with no account or card. The cost is the owner's hardware and model server. Zylon sells a separate enterprise platform built on PrivateGPT through demos, with no public price (checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, the OpenAPI file or the docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57600, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.privategpt.dev/introduction", "llmsTxt": "https://docs.privategpt.dev/llms.txt", "openapi": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/fern/openapi/openapi.json", "capabilities": [ "inference.local", "memory.search", "agent.mcp-client" ], "tags": [ "open-source", "local", "self-hosted", "docker", "openapi", "llms-txt", "rag", "mcp-client", "anthropic-compatible", "python", "free" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 53.2, "grade": "D", "agentReady": false, "rank": 960, "ranked": true, "rankOf": 1510, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -7, "negativeNotes": [ "Issue #2269, opened 11 June 2026, reports that the async ingestion API reads any local path given as a URI artifact. The stale bot closed it as not planned on 5 July with no maintainer reply, and `load_file_from_uri` in the source of 29 October 2026 still falls back to reading a local file for any value that isn't a URL, s3 or base64. With authentication off and a 0.0.0.0 bind by default, that is an open file-read path on a default install. Read from the source, not run (-7). https://github.com/zylon-ai/private-gpt/issues/2269" ], "verdict": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.", "bestFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "strengths": [ "Messages API modelled on Anthropic's, so Claude Code and Anthropic SDKs work by changing the base URL", "OpenAPI file of 38 paths, llms.txt and Markdown copies of every docs page", "Retrieval with citations, async ingestion, web, database and tabular tools, and remote MCP servers in one API", "Apache-2.0, with no telemetry to Zylon found in the source and OpenTelemetry tracing off by default", "Works with Ollama, llama.cpp, vLLM, LM Studio or any OpenAI-compatible server" ], "weaknesses": [ "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin", "When on, authentication is one shared static secret, with no per-user keys or scopes", "A June 2026 report of local file reads through URI artifacts was closed by a stale bot, and the source still reads local paths", "No release since 1.0.1 in June 2026 while main has moved on, including a breaking change", "Code execution runs as a host subprocess with resource limits, not in a container" ], "agentNotes": [ "Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller", "Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`", "Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`", "Pass ingested documents through `tool_context` to get answers with citations", "Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.2 } ], "editorialScores": { "ergonomics": 64, "maintenance": 41, "payments": 60, "reliability": 70, "schema": 83, "security": 32, "transparency": 67 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "brew tap zylon-ai/tap\nbrew install private-gpt", "http": "curl http://localhost:8080/v1/messages \\\n -H \"Content-Type: application/json\" \\\n -d '{\"model\": \"qwen3.5:35b\", \"messages\": [{\"role\": \"user\", \"content\": \"Explain retrieval-augmented generation.\"}]}'" }, "letme": { "capability": "https://letme.dev/inference.local", "tool": "https://letme.dev/privategpt" }, "area": "models", "provenance": { "legalEntity": "PriBAI Technology Spain S.L.", "domain": "privategpt.dev", "domainRegistered": "2023-10-16", "endpointOnVendorDomain": null, "terms": "https://github.com/zylon-ai/private-gpt/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://github.com/zylon-ai/private-gpt/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Self-hosted software with no hosted endpoint, so the Apache-2.0 licence stands in for terms and no privacy policy is scored.", "The zylon.ai terms name PriBAI Technology Spain S.L. (VAT ESB56550130) under Spanish law and cover the website and Zylon services. They forbid access through bots, scripts or scrapers, outside standard search engine or browser use. We read the terms and two public pages.", "RDAP gives privategpt.dev a registration date of 16 October 2023.", "docs.privategpt.dev/.well-known/security.txt and www.zylon.ai/.well-known/security.txt answer 404. SECURITY.md in the repository is the reporting route.", "docs.privategpt.dev and www.zylon.ai robots.txt allow our reader. wheels.privategpt.dev has no robots.txt (404)." ], "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/privategpt.json", "live": { "slug": "privategpt", "versions": [ { "registry": "github", "name": "zylon-ai/private-gpt", "version": "v1.0.1", "released": "2026-06-18", "seenAt": "2026-11-06T23:58:40.643071731Z" } ], "githubStars": 57632, "securityTxt": { "url": "https://privategpt.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:53.351491852Z" }, "llmsTxt": { "url": "https://docs.privategpt.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:41.730243326Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:15.016082629Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "767d5dd99544" }, { "url": "https://raw.githubusercontent.com/zylon-ai/private-gpt/main/LICENSE", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:17.075442465Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "839fbbcddc72" } ], "updatedAt": "2026-11-07T15:59:53.351491852Z" } }, "edges": [ { "by": 50, "category": "maintenance", "leads": "open-webui", "name": "Maintenance \u0026 community", "reasons": { "a": "0.11.4 on 21 September 2026 (30). Five releases in the 90 days to 3 October, 0.11.0 (27 July) to 0.11.4 (20). Recent bug reports are labelled and confirmed within a day and pull requests merge daily, but we couldn't see reply times (20 of 25). Read as current official builds, as the calibration dossiers read this line for local software. PyPI, GHCR and desktop builds ship from each release, and there's no SDK of its own (13 of 15). Dependabot monthly for uv, pip, npm and Actions, a uv.lock, and CI passing, with codespell and both lint workflows switched off (8 of 10).", "b": "The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41." }, "scores": { "a": 91, "b": 41 } }, { "by": 40, "category": "payments", "leads": "privategpt", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the self-hosted rule, scoring the paid option, as the Marmot dossier does with its hosted plan. The paid option is the enterprise licence (white-labelling, SLA-backed support, Terminals), sold to registered organisations through sales. No payment protocol (0). No published price (0). Self-hosting is free with no account at Open WebUI Inc. and no card, for any number of users who keep the branding (20). The licence goes through sales, and on a self-hosted instance an administrator has to turn API keys on before an agent can get one (0).", "b": "Read with the self-hosted rule. PrivateGPT is Apache-2.0 with nothing to buy. Zylon, the company's enterprise platform built on it, is a separate product sold through demos, and is not the surface graded. No payment protocol (0). Free with no account and no card, so 20, 20 and 20 on the last three lines." }, "scores": { "a": 20, "b": 60 } }, { "by": 31, "category": "security", "leads": "open-webui", "name": "Security \u0026 auth", "reasons": { "a": "Graded on the HTTP API with the tool lines. API keys stay off until an administrator sets `ENABLE_API_KEYS`, and a group permission decides who may create one. Each user has one `sk-` key, regenerable, stored as plain text with a last-used time and no expiry set by the API, sent as a Bearer token or an `x-api-key` header. An administrator can hold every key to an endpoint allowlist, but keys have no scopes of their own and carry their user's rights, and session JWTs last four weeks by default. No secret in a query string (22 of 30). Roles, groups, per-feature permissions, per-model and per-knowledge access grants and the allowlist can keep a key to chat and models, and sign-up closes once the first account becomes admin. An admin's key reaches everything, API deletes ask for no confirmation, and the per-call tool approval added in 0.11.1 works in saved chats in the interface, off by default, not on the API. More than half of the past year's advisories were access-control or authorisation flaws in this permission model, all fixed (10 of 20). Retrieved context is wrapped in tags and a debug log flags context that contains them, and we found no injection guidance (5 of 15). An audit log at metadata, request or request-and-response level, off by default (`AUDIT_LOG_LEVEL=NONE`), events for key creation and deletion, and opt-in OpenTelemetry (12 of 15). SECURITY.md, a security.txt valid to 30 June 2027, reports only through GitHub advisories, and each accepted report published as an advisory after the fix. No bounty and no SOC 2, and the policy refuses reports for flaws already fixed in the open, which then get no advisory (14 of 20).", "b": "Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32." }, "scores": { "a": 63, "b": 32 } }, { "by": 23, "category": "schema", "leads": "privategpt", "name": "Schema \u0026 documentation", "reasons": { "a": "Graded on the HTTP API an agent calls, the OpenAI-compatible /api/chat/completions and /api/models plus the /api/v1 file, knowledge and retrieval routes. Open WebUI is an MCP client and runs no MCP server. FastAPI's OpenAPI document and Swagger UI exist only with `ENV=dev`, which the docs explain, while the chat and model routes follow OpenAI's published request shapes (12 of 25). llms.txt with an index of every page, and a Markdown copy of each page (10). The API reference at docs.openwebui.com/reference/api-endpoints explains seven route groups (models, chat completions, the Anthropic Messages route with token counting, the Ollama proxy, file upload with processing status, knowledge and web retrieval) and what each is for, out of hundreds of routes (10 of 20). `/api/chat/completions` takes a free-form `form_data: dict`, while most /api/v1 routes use Pydantic forms (6 of 15). curl and Python examples for the documented routes, and the reference names 400, 403 and 502 for a few cases (9 of 15). /api/v1 prefixes on most routes and a dated CHANGELOG.md entry for every release (13 of 15).", "b": "An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83." }, "scores": { "a": 60, "b": 83 } }, { "by": 10, "category": "ergonomics", "leads": "privategpt", "name": "Agent ergonomics", "reasons": { "a": "Graded on the HTTP API. Chat completions take OpenAI's sizing controls such as `max_tokens` and can stream, but `/api/models` returns every model with its full metadata and nothing selects fields (14 of 25). File, knowledge, chat and model lists page with `page`, file search takes `skip` and `limit` (1 to 1,000), and files, chats and knowledge can be searched (13 of 20). Errors are FastAPI `detail` strings from a shared message table with HTTP codes, and upstream provider errors pass through. Readable, and mostly undocumented (12 of 20). Reads are GETs, and we found no idempotency keys or retry guidance for writes (5 of 20). A completion needs two fields and OpenAI's SDKs work against the chat routes, but Open WebUI publishes no SDK of its own (10 of 15).", "b": "Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64." }, "scores": { "a": 54, "b": 64 } }, { "by": 9, "category": "transparency", "leads": "open-webui", "name": "Transparency \u0026 trust", "reasons": { "a": "The Open WebUI License is BSD-3-Clause with a clause that forbids changing the branding in deployments over 50 users in a rolling 30 days without written permission or an enterprise licence. It isn't OSI-approved and contributors sign a CLA, but the source is public, the terms are short, commercial use is allowed, and older code stays under MIT or BSD-3-Clause per LICENSE_HISTORY (22 of 30). The FAQ says Open WebUI doesn't send data to external services and makes no external calls by default, while the server checks api.github.com for releases by default and downloads its embedding model at start unless `OFFLINE_MODE` is on. The privacy policy of 31 December 2025 covers only openwebui.com and gives no retention periods, and the chat data privacy page sets out who can read chats without retention defaults (16 of 30). Dated changelog entries flag migrations, renamed settings keep deprecated aliases and Pipelines is marked legacy, with no deprecation policy (10 of 20). We found no product telemetry to the vendor. The Docker image sets `DO_NOT_TRACK`, `SCARF_NO_ANALYTICS` and `ANONYMIZED_TELEMETRY=false`, Chroma's telemetry is off in code, and `ENABLE_VERSION_UPDATE_CHECK=false` or `OFFLINE_MODE` stops the release check (18 of 20).", "b": "Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67." }, "scores": { "a": 73, "b": 64 } } ], "facts": [ { "a": "Platform", "b": "HTTP API", "name": "Kind" }, { "a": "Open WebUI Inc.", "b": "Zylon (PriBAI Technology Spain S.L.)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-21", "b": "2026-06-18", "name": "Last release" }, { "a": "2026-07-07", "b": "no date given", "name": "Terms last updated" }, { "a": "2025-12-31", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "153k stars", "b": "58k stars", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "PrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Open WebUI or PrivateGPT?" }, { "answer": "No hosted endpoint is listed for Open WebUI. No hosted endpoint is listed for PrivateGPT.", "question": "Can an agent call Open WebUI and PrivateGPT without installing anything?" }, { "answer": "No open-source release is listed for Open WebUI. PrivateGPT is open source (Apache-2.0).", "question": "Are Open WebUI and PrivateGPT open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 63 against 32", "Maintenance \u0026 community, 91 against 41", "Transparency \u0026 trust, 73 against 64" ], "also": null, "goodFor": "A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.", "slug": "open-webui", "watchFor": "API keys are off by default, and each user gets one key with no scopes or expiry" }, { "aheadOn": [ "Schema \u0026 documentation, 83 against 60", "Agent ergonomics, 64 against 54", "Payments \u0026 pricing, 60 against 20" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.", "slug": "privategpt", "watchFor": "Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin" } ], "history": { "open-webui": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 51.8, "fromGrade": "D", "to": 52, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 52, "fromGrade": "D", "to": 51.8, "toGrade": "D" } ], "privategpt": null }, "job": { "capability": "inference.local", "name": "Local inference" }, "others": [ { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.json", "title": "AnythingLLM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.json", "title": "AnythingLLM vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/anythingllm-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-open-webui.json", "title": "Berth vs Open WebUI", "url": "https://www.anchorterminal.com/compare/berth-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/berth-vs-privategpt.json", "title": "Berth vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/berth-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/bitrun-vs-open-webui.json", "title": "BitRun vs Open WebUI", "url": "https://www.anchorterminal.com/compare/bitrun-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt.json", "title": "BitRun vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/bitrun-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.json", "title": "Docker Model Runner vs Open WebUI", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.json", "title": "Docker Model Runner vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.json", "title": "Foundry Local vs Open WebUI", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.json", "title": "Foundry Local vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/foundry-local-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.json", "title": "Core vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.json", "title": "Core vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ghost-core-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.json", "title": "GPT4All vs Open WebUI", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.json", "title": "GPT4All vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/gpt4all-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/hyperqwen-vs-open-webui.json", "title": "HyperQwen vs Open WebUI", "url": "https://www.anchorterminal.com/compare/hyperqwen-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.json", "title": "HyperQwen vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-open-webui.json", "title": "Jan vs Open WebUI", "url": "https://www.anchorterminal.com/compare/jan-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/jan-vs-privategpt.json", "title": "Jan vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/jan-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-open-webui.json", "title": "Khoj vs Open WebUI", "url": "https://www.anchorterminal.com/compare/khoj-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.json", "title": "KoboldCpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.json", "title": "KoboldCpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui.json", "title": "Lemonade vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lemonade-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt.json", "title": "Lemonade vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lemonade-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.json", "title": "llama.cpp vs Open WebUI", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.json", "title": "llama.cpp vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.json", "title": "LM Studio vs Open WebUI", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.json", "title": "LM Studio vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/lm-studio-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-open-webui.json", "title": "LocalAI vs Open WebUI", "url": "https://www.anchorterminal.com/compare/localai-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/localai-vs-privategpt.json", "title": "LocalAI vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/localai-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.json", "title": "MLX LM vs Open WebUI", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.json", "title": "MLX LM vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-open-webui.json", "title": "Ollama vs Open WebUI", "url": "https://www.anchorterminal.com/compare/ollama-vs-open-webui" }, { "json": "https://www.anchorterminal.com/compare/ollama-vs-privategpt.json", "title": "Ollama vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/ollama-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.json", "title": "Open WebUI vs screenpipe", "url": "https://www.anchorterminal.com/compare/open-webui-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.json", "title": "Open WebUI vs TextGen", "url": "https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/open-webui-vs-vllm.json", "title": "Open WebUI vs vLLM", "url": "https://www.anchorterminal.com/compare/open-webui-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.json", "title": "PrivateGPT vs screenpipe", "url": "https://www.anchorterminal.com/compare/privategpt-vs-screenpipe" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.json", "title": "PrivateGPT vs TextGen", "url": "https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui" }, { "json": "https://www.anchorterminal.com/compare/privategpt-vs-vllm.json", "title": "PrivateGPT vs vLLM", "url": "https://www.anchorterminal.com/compare/privategpt-vs-vllm" }, { "json": "https://www.anchorterminal.com/compare/khoj-vs-privategpt.json", "title": "Khoj vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/khoj-vs-privategpt" }, { "json": "https://www.anchorterminal.com/compare/localghost-vs-privategpt.json", "title": "LocalGhost vs PrivateGPT", "url": "https://www.anchorterminal.com/compare/localghost-vs-privategpt" } ], "panel": null, "scores": [ { "by": 2, "edge": "privategpt", "key": "reliability", "name": "Reliability", "open-webui": 68, "privategpt": 70, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "edge": "privategpt", "key": "schema", "name": "Schema \u0026 documentation", "open-webui": 60, "privategpt": 83, "weight": 13 }, { "by": 10, "edge": "privategpt", "key": "ergonomics", "name": "Agent ergonomics", "open-webui": 54, "privategpt": 64, "weight": 13 }, { "by": 31, "edge": "open-webui", "key": "security", "name": "Security \u0026 auth", "open-webui": 63, "privategpt": 32, "weight": 14 }, { "by": 40, "edge": "privategpt", "key": "payments", "name": "Payments \u0026 pricing", "open-webui": 20, "privategpt": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 50, "edge": "open-webui", "key": "maintenance", "name": "Maintenance \u0026 community", "open-webui": 91, "privategpt": 41, "weight": 7 }, { "by": 9, "edge": "open-webui", "key": "transparency", "name": "Transparency \u0026 trust", "open-webui": 73, "privategpt": 64, "weight": 7 } ], "summary": "PrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.", "tasks": null, "tutorials": [], "verdicts": { "open-webui": "Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.", "privategpt": "PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt", "json": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt.min.md" }, "markdown": "PrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust. Both do local inference.\n\n- Open WebUI: grade D, 52/100, rank #1004 of 1510. Markdown https://www.anchorterminal.com/tools/open-webui.md · JSON https://www.anchorterminal.com/api/v1/tools/open-webui.json\n- PrivateGPT: grade D, 53.2/100, rank #960 of 1510. Markdown https://www.anchorterminal.com/tools/privategpt.md · JSON https://www.anchorterminal.com/api/v1/tools/privategpt.json\n- Best local AI models and assistants: https://www.anchorterminal.com/best/local-ai/index.md\n- All 280 local ai comparisons: https://www.anchorterminal.com/compare/local-ai/index.md\n\n## Which one, for what\n\n### Open WebUI (D)\n\nGood for: A household or team that wants one chat interface over local and hosted models, with shared knowledge bases, memories, tools and access control, on their own server.\n\nAhead on:\n- Security \u0026 auth, 63 against 32\n- Maintenance \u0026 community, 91 against 41\n- Transparency \u0026 trust, 73 against 64\n\nWatch for: API keys are off by default, and each user gets one key with no scopes or expiry\n\n### PrivateGPT (D)\n\nGood for: A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models.\n\nAhead on:\n- Schema \u0026 documentation, 83 against 60\n- Agent ergonomics, 64 against 54\n- Payments \u0026 pricing, 60 against 20\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: Authentication is off by default, the server binds 0.0.0.0 and CORS allows every origin\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Open WebUI +50\n\n- Open WebUI (91): 0.11.4 on 21 September 2026 (30). Five releases in the 90 days to 3 October, 0.11.0 (27 July) to 0.11.4 (20). Recent bug reports are labelled and confirmed within a day and pull requests merge daily, but we couldn't see reply times (20 of 25). Read as current official builds, as the calibration dossiers read this line for local software. PyPI, GHCR and desktop builds ship from each release, and there's no SDK of its own (13 of 15). Dependabot monthly for uv, pip, npm and Actions, a uv.lock, and CI passing, with codespell and both lint workflows switched off (8 of 10).\n- PrivateGPT (41): The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.\n\n### Payments \u0026 pricing: PrivateGPT +40\n\n- Open WebUI (20): Read with the self-hosted rule, scoring the paid option, as the Marmot dossier does with its hosted plan. The paid option is the enterprise licence (white-labelling, SLA-backed support, Terminals), sold to registered organisations through sales. No payment protocol (0). No published price (0). Self-hosting is free with no account at Open WebUI Inc. and no card, for any number of users who keep the branding (20). The licence goes through sales, and on a self-hosted instance an administrator has to turn API keys on before an agent can get one (0).\n- PrivateGPT (60): Read with the self-hosted rule. PrivateGPT is Apache-2.0 with nothing to buy. Zylon, the company's enterprise platform built on it, is a separate product sold through demos, and is not the surface graded. No payment protocol (0). Free with no account and no card, so 20, 20 and 20 on the last three lines.\n\n### Security \u0026 auth: Open WebUI +31\n\n- Open WebUI (63): Graded on the HTTP API with the tool lines. API keys stay off until an administrator sets `ENABLE_API_KEYS`, and a group permission decides who may create one. Each user has one `sk-` key, regenerable, stored as plain text with a last-used time and no expiry set by the API, sent as a Bearer token or an `x-api-key` header. An administrator can hold every key to an endpoint allowlist, but keys have no scopes of their own and carry their user's rights, and session JWTs last four weeks by default. No secret in a query string (22 of 30). Roles, groups, per-feature permissions, per-model and per-knowledge access grants and the allowlist can keep a key to chat and models, and sign-up closes once the first account becomes admin. An admin's key reaches everything, API deletes ask for no confirmation, and the per-call tool approval added in 0.11.1 works in saved chats in the interface, off by default, not on the API. More than half of the past year's advisories were access-control or authorisation flaws in this permission model, all fixed (10 of 20). Retrieved context is wrapped in tags and a debug log flags context that contains them, and we found no injection guidance (5 of 15). An audit log at metadata, request or request-and-response level, off by default (`AUDIT_LOG_LEVEL=NONE`), events for key creation and deletion, and opt-in OpenTelemetry (12 of 15). SECURITY.md, a security.txt valid to 30 June 2027, reports only through GitHub advisories, and each accepted report published as an advisory after the fix. No bounty and no SOC 2, and the policy refuses reports for flaws already fixed in the open, which then get no advisory (14 of 20).\n- PrivateGPT (32): Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.\n\n### Schema \u0026 documentation: PrivateGPT +23\n\n- Open WebUI (60): Graded on the HTTP API an agent calls, the OpenAI-compatible /api/chat/completions and /api/models plus the /api/v1 file, knowledge and retrieval routes. Open WebUI is an MCP client and runs no MCP server. FastAPI's OpenAPI document and Swagger UI exist only with `ENV=dev`, which the docs explain, while the chat and model routes follow OpenAI's published request shapes (12 of 25). llms.txt with an index of every page, and a Markdown copy of each page (10). The API reference at docs.openwebui.com/reference/api-endpoints explains seven route groups (models, chat completions, the Anthropic Messages route with token counting, the Ollama proxy, file upload with processing status, knowledge and web retrieval) and what each is for, out of hundreds of routes (10 of 20). `/api/chat/completions` takes a free-form `form_data: dict`, while most /api/v1 routes use Pydantic forms (6 of 15). curl and Python examples for the documented routes, and the reference names 400, 403 and 502 for a few cases (9 of 15). /api/v1 prefixes on most routes and a dated CHANGELOG.md entry for every release (13 of 15).\n- PrivateGPT (83): An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.\n\n### Agent ergonomics: PrivateGPT +10\n\n- Open WebUI (54): Graded on the HTTP API. Chat completions take OpenAI's sizing controls such as `max_tokens` and can stream, but `/api/models` returns every model with its full metadata and nothing selects fields (14 of 25). File, knowledge, chat and model lists page with `page`, file search takes `skip` and `limit` (1 to 1,000), and files, chats and knowledge can be searched (13 of 20). Errors are FastAPI `detail` strings from a shared message table with HTTP codes, and upstream provider errors pass through. Readable, and mostly undocumented (12 of 20). Reads are GETs, and we found no idempotency keys or retry guidance for writes (5 of 20). A completion needs two fields and OpenAI's SDKs work against the chat routes, but Open WebUI publishes no SDK of its own (10 of 15).\n- PrivateGPT (64): Read for an HTTP API an agent calls on a local instance. Token counting, `top_k` style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing `ANTHROPIC_BASE_URL` at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.\n\n### Transparency \u0026 trust: Open WebUI +9\n\n- Open WebUI (73): The Open WebUI License is BSD-3-Clause with a clause that forbids changing the branding in deployments over 50 users in a rolling 30 days without written permission or an enterprise licence. It isn't OSI-approved and contributors sign a CLA, but the source is public, the terms are short, commercial use is allowed, and older code stays under MIT or BSD-3-Clause per LICENSE_HISTORY (22 of 30). The FAQ says Open WebUI doesn't send data to external services and makes no external calls by default, while the server checks api.github.com for releases by default and downloads its embedding model at start unless `OFFLINE_MODE` is on. The privacy policy of 31 December 2025 covers only openwebui.com and gives no retention periods, and the chat data privacy page sets out who can read chats without retention defaults (16 of 30). Dated changelog entries flag migrations, renamed settings keep deprecated aliases and Pipelines is marked legacy, with no deprecation policy (10 of 20). We found no product telemetry to the vendor. The Docker image sets `DO_NOT_TRACK`, `SCARF_NO_ANALYTICS` and `ANONYMIZED_TELEMETRY=false`, Chroma's telemetry is off in code, and `ENABLE_VERSION_UPDATE_CHECK=false` or `OFFLINE_MODE` stops the release check (18 of 20).\n- PrivateGPT (64): Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.\n\n## Score by category\n\n| Category | Weight | Open WebUI | PrivateGPT | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 68 | 70 | PrivateGPT +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 60 | 83 | PrivateGPT +23 |\n| Agent ergonomics | 13% (16.2 this run) | 54 | 64 | PrivateGPT +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 32 | Open WebUI +31 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 60 | PrivateGPT +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 91 | 41 | Open WebUI +50 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 73 | 64 | Open WebUI +9 |\n| Negative events | ≤15 | -8 | -7 | |\n| **Total** | | **52 · D** | **53.2 · D** | |\n\n## Facts side by side\n\n| Fact | Open WebUI | PrivateGPT |\n| --- | --- | --- |\n| Kind | Platform | HTTP API |\n| Vendor | Open WebUI Inc. | Zylon (PriBAI Technology Spain S.L.) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | HTTP |\n| Auth | API key | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Open WebUI License. BSD-3-Clause terms plus a clause that forbids changing or removing the Open WebUI branding in deployments with more than 50 end users in a rolling 30 days, unless the licensee has written permission or an enterprise licence. Code from before set commits stays under MIT or BSD-3-Clause (LICENSE_HISTORY), and contributors sign a CLA | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-21 | 2026-06-18 |\n| Terms last updated | 2026-07-07 | no date given |\n| Privacy policy last updated | 2025-12-31 | no document linked |\n| Customer content may train models | yes, with an opt-out | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 153k stars | 58k stars |\n| Agent reviews | 2.5/5 (2) | none |\n\n## How the scores have moved\n\n### Open WebUI\n\n- +0.2 on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n\n### PrivateGPT\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Open WebUI.** Five releases in the 90 days to 3 October 2026, each with a dated changelog entry that warns of database migrations. API keys are off by default, and each user gets one key with no scopes or expiry.\n\n**PrivateGPT.** PrivateGPT 1.0 is an Apache-2.0 server that gives local models an Anthropic-style messages API with retrieval, citations, tools and MCP, documented by an OpenAPI file and llms.txt. A default start has authentication off, listens on every interface and reads local paths given as URIs, and a public report of that was closed without a reply.\n\n## Before you call either\n\n### Open WebUI\n\n1. Ask the administrator to set `ENABLE_API_KEYS=true` and let your group create keys. `sk-` keys are refused until then\n2. Send OpenAI's request shape to `/api/chat/completions` with a Bearer key, or use `x-api-key` behind a proxy that takes `Authorization` for itself\n3. Call `/api/models` first and use an `id` from it. Model IDs depend on the instance's connections\n4. Poll `GET /api/v1/files/{id}/process/status` until it reads `completed` before adding a file to a knowledge base\n5. Expect a 403 on routes outside `API_KEYS_ALLOWED_ENDPOINTS` when the administrator has set an allowlist\n\n### PrivateGPT\n\n1. Turn on `server.auth` and bind to 127.0.0.1 before exposing an instance, since a default start answers any caller\n2. Point Anthropic SDKs or Claude Code at the server with `ANTHROPIC_BASE_URL=http://localhost:8080`\n3. Start an OpenAI-compatible model server and an embedding server first, and set `OPENAI_API_BASE` and `OPENAI_EMBEDDING_API_BASE`\n4. Pass ingested documents through `tool_context` to get answers with citations\n5. Treat web fetch, search and MCP results as untrusted, since PrivateGPT documents no prompt-injection handling\n\n## Questions\n\n### Which is better for AI agents, Open WebUI or PrivateGPT?\n\nPrivateGPT scores 53.2 (D) on agent readiness against Open WebUI's 52 (D), and leads in 4 of 7 scored categories. Open WebUI leads on security \u0026 auth, maintenance \u0026 community and transparency \u0026 trust.\n\n### Can an agent call Open WebUI and PrivateGPT without installing anything?\n\nNo hosted endpoint is listed for Open WebUI. No hosted endpoint is listed for PrivateGPT.\n\n### Are Open WebUI and PrivateGPT open source?\n\nNo open-source release is listed for Open WebUI. PrivateGPT is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/open-webui-vs-privategpt.json, and with the fewest tokens: https://www.anchorterminal.com/compare/open-webui-vs-privategpt.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"open-webui\", \"b\": \"privategpt\"}`. From a terminal: `anchor compare open-webui privategpt`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/open-webui.json and https://www.anchorterminal.com/api/v1/tools/privategpt.json\n\n## Other comparisons with Open WebUI or PrivateGPT\n\n- [AnythingLLM vs Open WebUI](https://www.anchorterminal.com/compare/anythingllm-vs-open-webui.md)\n- [AnythingLLM vs PrivateGPT](https://www.anchorterminal.com/compare/anythingllm-vs-privategpt.md)\n- [Berth vs Open WebUI](https://www.anchorterminal.com/compare/berth-vs-open-webui.md)\n- [Berth vs PrivateGPT](https://www.anchorterminal.com/compare/berth-vs-privategpt.md)\n- [BitRun vs Open WebUI](https://www.anchorterminal.com/compare/bitrun-vs-open-webui.md)\n- [BitRun vs PrivateGPT](https://www.anchorterminal.com/compare/bitrun-vs-privategpt.md)\n- [Docker Model Runner vs Open WebUI](https://www.anchorterminal.com/compare/docker-model-runner-vs-open-webui.md)\n- [Docker Model Runner vs PrivateGPT](https://www.anchorterminal.com/compare/docker-model-runner-vs-privategpt.md)\n- [Foundry Local vs Open WebUI](https://www.anchorterminal.com/compare/foundry-local-vs-open-webui.md)\n- [Foundry Local vs PrivateGPT](https://www.anchorterminal.com/compare/foundry-local-vs-privategpt.md)\n- [Core vs Open WebUI](https://www.anchorterminal.com/compare/ghost-core-vs-open-webui.md)\n- [Core vs PrivateGPT](https://www.anchorterminal.com/compare/ghost-core-vs-privategpt.md)\n- [GPT4All vs Open WebUI](https://www.anchorterminal.com/compare/gpt4all-vs-open-webui.md)\n- [GPT4All vs PrivateGPT](https://www.anchorterminal.com/compare/gpt4all-vs-privategpt.md)\n- [HyperQwen vs Open WebUI](https://www.anchorterminal.com/compare/hyperqwen-vs-open-webui.md)\n- [HyperQwen vs PrivateGPT](https://www.anchorterminal.com/compare/hyperqwen-vs-privategpt.md)\n- [Jan vs Open WebUI](https://www.anchorterminal.com/compare/jan-vs-open-webui.md)\n- [Jan vs PrivateGPT](https://www.anchorterminal.com/compare/jan-vs-privategpt.md)\n- [Khoj vs Open WebUI](https://www.anchorterminal.com/compare/khoj-vs-open-webui.md)\n- [KoboldCpp vs Open WebUI](https://www.anchorterminal.com/compare/koboldcpp-vs-open-webui.md)\n- [KoboldCpp vs PrivateGPT](https://www.anchorterminal.com/compare/koboldcpp-vs-privategpt.md)\n- [Lemonade vs Open WebUI](https://www.anchorterminal.com/compare/lemonade-vs-open-webui.md)\n- [Lemonade vs PrivateGPT](https://www.anchorterminal.com/compare/lemonade-vs-privategpt.md)\n- [llama.cpp vs Open WebUI](https://www.anchorterminal.com/compare/llama-cpp-vs-open-webui.md)\n- [llama.cpp vs PrivateGPT](https://www.anchorterminal.com/compare/llama-cpp-vs-privategpt.md)\n- [LM Studio vs Open WebUI](https://www.anchorterminal.com/compare/lm-studio-vs-open-webui.md)\n- [LM Studio vs PrivateGPT](https://www.anchorterminal.com/compare/lm-studio-vs-privategpt.md)\n- [LocalAI vs Open WebUI](https://www.anchorterminal.com/compare/localai-vs-open-webui.md)\n- [LocalAI vs PrivateGPT](https://www.anchorterminal.com/compare/localai-vs-privategpt.md)\n- [MLX LM vs Open WebUI](https://www.anchorterminal.com/compare/mlx-lm-vs-open-webui.md)\n- [MLX LM vs PrivateGPT](https://www.anchorterminal.com/compare/mlx-lm-vs-privategpt.md)\n- [Ollama vs Open WebUI](https://www.anchorterminal.com/compare/ollama-vs-open-webui.md)\n- [Ollama vs PrivateGPT](https://www.anchorterminal.com/compare/ollama-vs-privategpt.md)\n- [Open WebUI vs screenpipe](https://www.anchorterminal.com/compare/open-webui-vs-screenpipe.md)\n- [Open WebUI vs TextGen](https://www.anchorterminal.com/compare/open-webui-vs-text-generation-webui.md)\n- [Open WebUI vs vLLM](https://www.anchorterminal.com/compare/open-webui-vs-vllm.md)\n- [PrivateGPT vs screenpipe](https://www.anchorterminal.com/compare/privategpt-vs-screenpipe.md)\n- [PrivateGPT vs TextGen](https://www.anchorterminal.com/compare/privategpt-vs-text-generation-webui.md)\n- [PrivateGPT vs vLLM](https://www.anchorterminal.com/compare/privategpt-vs-vllm.md)\n- [Khoj vs PrivateGPT](https://www.anchorterminal.com/compare/khoj-vs-privategpt.md)\n- [LocalGhost vs PrivateGPT](https://www.anchorterminal.com/compare/localghost-vs-privategpt.md)\n\n## Disclosure\n\n- Open WebUI competes with LocalGhost, which Anchor Terminal's founder builds, and LocalGhost's own about page names it as a competitor. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Open WebUI vs PrivateGPT", "url": "" } ], "description": "PrivateGPT scores 53.2 (D) to Open WebUI's 52 (D) for local inference. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Open WebUI D 52", "PrivateGPT D 53.2", "scores" ], "h1": "Open WebUI vs PrivateGPT", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/open-webui-vs-privategpt", "published": "2026-10-01", "section": "tools", "title": "Open WebUI vs PrivateGPT for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/open-webui-vs-privategpt" }, "tokens": { "markdown": 5750, "slim": 3430 }, "version": 1 }