# PrivateGPT vs vLLM (slim)

> PrivateGPT scores 53.2 (D) to vLLM's 48.4 (D) for local inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/privategpt-vs-vllm.md (~5,250 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/privategpt-vs-vllm.json · canonical https://www.anchorterminal.com/compare/privategpt-vs-vllm
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

PrivateGPT scores 53.2 (D) on agent readiness against vLLM's 48.4 (D), and leads in 2 of 7 scored categories. vLLM leads on security & auth, maintenance & community and transparency & trust. Both do local inference.

- PrivateGPT: D 53.2, rank #954 of 1486 · https://www.anchorterminal.com/tools/privategpt.min.md
- vLLM: D 48.4, rank #1117 of 1486 · https://www.anchorterminal.com/tools/vllm.min.md
- PrivateGPT, good for A local backend for apps and agents that want an Anthropic-style API with document retrieval, citations and tools over local models. Ahead on Reliability, 70 against 59; Schema & documentation, 83 against 68.
- vLLM, good for An owner with a GPU server who wants many concurrent requests against one open-weight model behind OpenAI or Anthropic compatible routes. Ahead on Security & auth, 50 against 32; Maintenance & community, 88 against 41; Transparency & trust, 71 against 64. Also Free to start without a card.

| Category | PrivateGPT | vLLM |
| --- | --- | --- |
| Reliability (16%) | 70 | 59 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 68 |
| Agent ergonomics (13%) | 64 | 64 |
| Security & auth (14%) | 32 | 50 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 41 | 88 |
| Transparency & trust (7%) | 64 | 71 |

| Fact (where they differ) | PrivateGPT | vLLM |
| --- | --- | --- |
| Vendor | Zylon (PriBAI Technology Spain S.L.) | vLLM project (PyTorch Foundation) |
| llms.txt | yes | no |
| Last release | 2026-06-18 | 2026-11-01 |
| Terms last updated | no date given | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 58k stars | 93k stars |

Why the edge:
- Maintenance & community, vLLM +47: PrivateGPT 41 (The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.); vLLM 88 (v0.33.0 is tagged 1 November 2026 (30). Eight stable releases in the 90 days from 6 August, v0.27.0 (10 August), v0.27.1, v0.28.0, v0.29.0, v0.30.0, v0.31.0, v0.32.0 (17 October) and v0.33.0, with release candidates between them, dated from the tags in a clone (20). Per the 9 October check, not re-read on 4 November (GitHub's pages and API refuse this session): 2,592 open issues, and 42 of 48 bug reports from the week of 22 September had a comment by 9 October (19 of 25). The Python library ships in the same package as the server, and a Rust proto crate is tagged separately (proto-v0.6.0 is the newest). The server has no client library of its own (10 of 15). Dependabot runs weekly for pip and GitHub Actions, with pre-commit and Buildkite checks on each commit (9 of 10). 30 + 20 + 19 + 10 + 9 = 88.)
- Security & auth, vLLM +18: PrivateGPT 32 (Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole `Authorization` header, with a sample `secret:key` value in settings.yaml. There are no per-user keys or scopes, `private-gpt serve` binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.); vLLM 50 (Read with the tool checklist. Optional static keys from `--api-key` or `VLLM_API_KEY`, compared in constant time and read only from the `Authorization` header. They are off by default, have no scopes, and are checked only under `/v1`, `/v2`, `/inference` and `/cohere`, so `/invocations` runs the same inference without a key. With `--host` unset the server binds every interface, and gRPC has no authentication (10 of 30). Development routes, runtime LoRA loading, tool servers and endpoint plugins are off by default. `/pause`, `/abort_requests` and `/update_weights` answer without a key on generation servers, and there is no read-only mode (6 of 20). The security guide covers model-generated code in the demo code interpreter, allowed domains for media URLs, cache salting and the lack of tenant isolation (10 of 15). Access logs, `--enable-log-requests`, Prometheus `/metrics` and OpenTelemetry examples, with no per-key record (9 of 15). SECURITY.md with severity classes, a named vulnerability management team, private reporting through GitHub, CVEs and a prenotification group, and advisories published in public (61 GitHub advisories for vllm on OSV in the 12 months to 4 November 2026). No security.txt and no bounty found (15 of 20).)
- Schema & documentation, PrivateGPT +15: PrivateGPT 83 (An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a `/v1/messages/validate` route, with error shapes not documented as a list (9 of 15). `/v1` paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.); vLLM 68 (The server is a FastAPI application with Pydantic request models, so a running instance serves its own OpenAPI document and Swagger page unless `--disable-fastapi-docs` is set, and the gRPC services have published proto files. No static OpenAPI file is published in the docs or the repository (15 of 25). docs.vllm.ai/llms.txt returns 404. vllm.ai/llms.txt lists site pages and blog posts, and the docs are Markdown files in the repository (5 of 10). The serving pages say which model types each route applies to, which OpenAI fields are ignored, and which routes must not be exposed (15 of 20). Typed request models, with structured outputs by JSON schema, choice, regex or grammar (12 of 15). Examples for most routes in the docs and the `examples` folder. The error shape (message, type, param, code) is defined in the source, and no error reference page was found (9 of 15). GitHub releases with full notes about every two weeks and vllm.ai/releases. The HTTP API has no version of its own beyond the `/v1` prefix (12 of 15).)
- Reliability, PrivateGPT +11: PrivateGPT 70 (Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, `uv tool install` from Zylon's own wheel index (not PyPI) and Docker Hub images `zylonai/private-gpt` 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.); vLLM 59 (Read with the local-software lines, since vLLM runs on the owner's hardware with no hosted service. Installs from PyPI (`vllm`) and Docker images, with Linux and Python 3.11 to 3.14 stated in `pyproject.toml` at v0.33.0 (20). A public Buildkite pipeline (`.buildkite/test-pipeline.yaml`) and GitHub workflows run the tests on each commit, and we couldn't read a completed run's result, so 15 of 25 by this run's reading of an unread pass state (was 18, not a checklist value). Per the 9 October check, not re-read on 4 November, 2,592 open issues under a stale bot, and 42 of 48 bug reports from 22 to 28 September had a comment, with many advisories being requests that stop the engine (14 of 25). Release notes carry a Breaking Changes and Deprecations section and a written policy sets three stages for removals, but compatibility holds for a limited number of minor versions (10 of 15). Version 0.33.0, pre-1.0 (0). 20 + 15 + 14 + 10 + 0 = 59.)
- Transparency & trust, vLLM +7: PrivateGPT 64 (Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.); vLLM 71 (The editorial half. Apache-2.0, all of it public (30). The usage statistics page lists what is collected, links the collecting code, keeps a local copy at `~/.config/vllm/usage_stats.json` and says a cleaned subset is published. No privacy policy, retention period or recipient list for stats.vllm.ai was found, and vllm.ai links no privacy policy (16 of 30). A written deprecation policy with three stages across minor releases, and breaking changes listed in each release's notes (17 of 20). Telemetry is disclosed with three opt-outs, `VLLM_NO_USAGE_STATS`, `DO_NOT_TRACK` and a file. It is on by default and reports every ten minutes. The fields in `usage_lib.py` at v0.33.0 are a random per-run UUID, hardware, platform, model architecture and five vLLM settings, which matches the page's anonymous claim (17 of 20).)