TextGen vs vLLM

TextGen

AGPL-3.0 with no telemetry, and a local API on 127.0.0.1:5000 that checks the Host header, limits CORS to localhost and separates an admin key from the caller's key. No release since v4.9 on 20 May 2026, no code commits since 31 May, no test suite, and ten security advisories in the year, all fixed.

vLLM

Apache-2.0 software with a release about every two weeks, each with notes that list breaking changes and security fixes. The optional API key covers only some path prefixes, so /invocations and control routes such as /pause answer without it, and at least 81 security advisories were published in the 12 months to 9 October 2026.

TextGen

1. Ask the owner to launch with --api. Nothing listens on port 5000 without it, and a model must be loaded first
2. Call http://127.0.0.1:5000/v1. Any Host header other than localhost or 127.0.0.1 gets 400 Invalid host header unless --listen is set
3. Send the key as Authorization: Bearer on OpenAI routes and as x-api-key on /v1/messages. Model loading needs the admin key
4. Read http://127.0.0.1:5000/docs or modules/api/typing.py for parameters. max_tokens defaults to 512 on chat completions
5. Run tool calls yourself. The API returns finish_reason: "tool_calls" and executes nothing on the server
6. Use the repository name oobabooga/textgen. The old text-generation-webui URL redirects

vLLM

1. Put a reverse proxy that allowlists routes in front of the server. --api-key leaves /invocations and the control routes open
2. Pass --host 127.0.0.1 for single-machine use. With no --host the server listens on every interface
3. Set VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 before starting if nothing should be sent to stats.vllm.ai
4. Start with --enable-auto-tool-choice and the --tool-call-parser for the model before sending tools. Tool calling is off without them
5. Send max_tokens on every request, and read the breaking changes section of the release notes before upgrading a minor version