llama.cpp
Version in force v0.2.0 (canal estable) / b10618 (compilacion diaria)2026-08-21 (v0.2.0) / 2026-08-25 (b10618)Tree audited master, commit eb25b7263e1604b4382295563f5a924002d6f87c (2026-08-25)Licence MIT
For anyone who wants total control and the widest hardware support, and does not mind the terminal.
The engine. It is the C/C++ implementation almost every other consumer local-AI program is built on, and you can use it directly: a command-line tool and a server with its own web interface.
Steps to the first token
Measured by Local AI Scope
Hosts it contacts out of the box
Measured by Local AI Scope
Licence
Measured by Local AI Scope
How we checked this
Everything this sheet says about the network comes from reading the published source code and the official documentation on the date shown — not from watching the traffic. We have not run the program with a network analyser in front of it, so this is static analysis, not observation. A real capture is still pending; the day we have one, these cells move up a level of evidence. We would rather say that than let you assume we sniffed the wire.
What leaves your machine
The four questions a local runtime has to answer before it deserves your documents: what it sends on its own, who else it calls, on which address it listens, and whether you can check any of it yourself.
Telemetry out of the box
None at all — and here that is a fact, not a promise. Verified by us in the primary source
We swept the whole tree at commit eb25b72 looking for telemetry, analytics, posthog, mixpanel, sentry.io, google-analytics and gtag( across every .c, .cpp, .h, .hpp, .ts, .tsx, .svelte and .js file: not one real match. The only domains written anywhere in the code are documentation URLs inside comments. There is no endpoint to send usage data to. It is also the only one of the five that does not check for updates: with a local model file it does not open a single connection.
How to switch it off: Nothing to switch off: there is none.
Source · consulted 2026-08-25
Other calls home
| What | Where to | When | Can you avoid it | Evidence |
|---|---|---|---|---|
| Model download | huggingface.co |
Only if you use -hf, –model-url or the download subcommand. With a local file it opens nothing. It does send a user agent identifying the build. | Use local files | verified by us |
| Downloading models packaged as container images | auth.docker.io · registry-1.docker.io |
Only with the –docker-repo option. | Do not use it | verified by us |
| Prebuilt web interface, at COMPILE time | huggingface.co |
Only when building from source with the default option on. With no network it warns and builds without the interface. | LLAMA_USE_PREBUILT_UI=OFF | verified by us |
| Manual self-update | llama.app |
Only if you run the update subcommand by hand, and only on installs made with their script. It never fires on its own. | Do not run it | verified by us |
Source · consulted 2026-08-25
Which address it listens on
| Setting | Out of the box |
|---|---|
| Listens on | 127.0.0.1:8080 |
| Authentication out of the box | none |
| CORS out of the box | Reflects any Origin back and allows credentials; the server warns on the console when there is no key either |
It listens on localhost — and that has always been true: across the whole history of the repository, of the 719 revisions of the files that declare the host, 471 declare 127.0.0.1 and none declares anything else. The price of that silence is CORS: the server reflects any Origin back with credentials allowed, so any web page you visit can talk to your llama-server while it is running. It says so itself on the console when there is no API key either. It is also the only one of the five that tightens its own CORS policy according to how dangerous what it exposes is: turning on the agent tools — which include reading, writing and editing files and running shell commands — makes it fall back to localhost origins only. Verified by us in the primary source
«By default the server reflects any Origin header back with credentials allowed. […] CORS is set to allow all origins (‘*’) and no API key is set — this can be a security risk (cross-origin attacks).»
Source · consulted 2026-08-25
Can this be audited?
Yes, and it is the reason this row can say none about telemetry with a straight face. MIT, the whole engine, the server and the web interface in one public repository. It is the only one of the five where we can state, having read the code, that it neither sends telemetry nor checks for updates. Verified by us in the primary source
Source · consulted 2026-08-25
Privacy policy
There is no privacy policy, and here that is not a gap: there is no service behind the program and no data controller to demand one from. not verified
What it runs, and where
Platforms, accelerators and model formats — the three walls you hit on the first evening, and the ones nobody writes down until you have hit them.
Where it runs
| Platform | Support | Evidence |
|---|---|---|
| Windows | Yes: prebuilt binaries for x64 and ARM64, in CPU, CUDA, Vulkan, ROCm, SYCL, OpenVINO and OpenCL/Adreno flavours. Installable with winget. | verified by us |
| macOS Apple Silicon | Yes: prebuilt binary plus Homebrew, MacPorts or Nix packages. | verified by us |
| macOS Intel | Yes, but CPU only. There is an Intel Mac binary, and the release workflow builds it with Metal disabled on purpose — the comment in their own file says the runners have no GPU. | verified by us |
| Linux | Yes: x64, ARM64 and even s390x (IBM Z), in CPU, Vulkan, ROCm, SYCL and OpenVINO flavours. | verified by us |
| + | Android ARM64 and an xcframework for iOS/macOS. It also documents RISC-V builds. | verified by us |
What it accelerates
| Backend | Status | Evidence |
|---|---|---|
| CUDA | Yes, but the binary exists only for Windows. On Linux you have to compile or use Docker — which makes the most common setup in the world, NVIDIA on Linux, the one case with no ready-made build. | verified by us |
| ROCm | Yes, with binaries: ROCm 7.14, on Windows and Linux. | verified by us |
| Metal | Yes, built into the macOS ARM64 binary. Disabled on Intel Macs. | verified by us |
| Vulkan | Yes, with binaries: x64 and ARM64 on Linux, x64 on Windows. | verified by us |
| CPU | Yes, with SIMD per architecture. It is the whole reason the project exists. | verified by us |
| SYCL / OpenCL / OpenVINO | Yes: SYCL for Intel, OpenCL/Adreno for Qualcomm phones, and OpenVINO. | verified by us |
| NPU | We could not verify this. It publishes OpenVINO builds, and OpenVINO is Intel’s stack for CPU, GPU and NPU — but no official statement says llama.cpp runs inference on the NPU, so we do not claim it. | not verified |
Model formats it runs
GGUF only. GGUF is its native format — this project invented it. Safetensors have to be converted first with the script the repository itself ships. verified by us
Source · consulted 2026-08-25
Installing it, and living with it
How many steps to the first token, what it leaves on your disk, under which licence and at what pace it changes under you.
Steps to the first token
2 steps. Install the package and run `llama serve -hf <hugging-face-repo>`: it downloads the model and opens the web interface. What raises the difficulty is not installing it but that everything is configured through command-line flags. verified by us
What it writes to your disk
| What | Where | Evidence |
|---|---|---|
| Models downloaded with -hf — the standard Hugging Face cache, shared with every other program that uses it, so downloads are not duplicated | ~/.cache/huggingface/hub — the Hugging Face cache (LLAMA_CACHE → HF_HUB_CACHE → HF_HOME/hub → XDG_CACHE_HOME) |
verified by us |
| Other artefacts and the RPC server cache | $LLAMA_CACHE · $XDG_CACHE_HOME · ~/.cache/llama.cpp/ |
verified by us |
| Web interface conversations — in your browser, not on the server | In your browser, not on the server: IndexedDB (LlamaUi database) and localStorage with the LlamaUi prefix. Clearing the site data deletes them, and they do not sync between browsers | verified by us |
| Prompt cache — in memory, not on disk, unless you ask for it | In memory, not on disk (8192 MiB by default). It only reaches the disk with –slot-save-path or –prompt-cache | verified by us |
| Logs — only if you ask for them | Only with –log-file; dumping prompts to disk (–log-prompts-dir) is off by default | verified by us |
Licence
MIT. The whole engine, the server and the web interface. verified by us
Source · consulted 2026-08-25
Version and release pace
Two rhythms. The development channel publishes around eight builds a day (266 in 30 days). The stable channel was only born on 21 August 2026 and is on its fourth tag in total. verified by us
«tag vX.Y.Z – stable, slower release cadence, recommended for downstream distribution and casual users; tag b[NUM] – bleeding edge, faster release cadence, recommended for developers and technical users.»
Source · consulted 2026-08-25
What to know before you install it
- It is the only one of the five where we can state, having read the code, that it sends no telemetry and checks for no updates. With a local model file it does not open a single connection.
- Since 21 August 2026 there is a stable channel (v0.2.0) alongside the daily builds. Any text saying «llama.cpp has no stable releases» is now out of date. Careful, though: the winget package still ships the daily build.
- The price of that silence is CORS: the server reflects any origin and allows credentials, so any web page you visit can talk to your llama-server while it is running. The server warns you on the console. Narrow it with –cors-origins localhost.
- The most common setup in the world — NVIDIA on Linux — is precisely the one with no prebuilt binary: you compile or use Docker.
- Its distributed-compute helper server carries a blunt warning in its own documentation: the RPC backend is a proof of concept, fragile and insecure, and must never be run on an open network.