Before you download a 20 GB model, it helps to know whether it will run. llmfit looks at your CPU cores, system RAM, graphics card and video memory, or the unified memory on Apple Silicon, then scores hundreds of open models for fit, speed, quality and context length on that hardware. It picks a sensible quantisation for each one and estimates tokens per second, so you can see at a glance which models will be quick, which will crawl and which will not load at all.
Run it with no arguments and you get an interactive terminal browser with your specs at the top and every model ranked below. From there you can filter, simulate other hardware, download a model and benchmark it for real against Ollama, llama.cpp, MLX, LM Studio or Docker Model Runner. There is also a classic command-line mode with JSON output for scripts and agents, and llmfit serve starts a web dashboard and a REST API.
llmfit is MIT-licensed and written in Rust, with about 39,000 stars and 181 contributors since February 2026. It moves fast: version 1.1.20, from 3 November 2026, is its 138th release.
- Repository: github.com/AlexsJones/llmfit
- Licence: MIT (MIT License)
- Language: Rust. Stars: 38.9K. Forks: 2,511. Last push: Nov 10, 2026.
- Scan: safe, Nov 10, 2026, commit 7d929f2
Who it is for
People getting started with local AI who want to know what their laptop can handle, anyone choosing between models or quantisations, and builders deciding what hardware to buy for running models at home.
Getting started
1. Install on macOS or Linux with Homebrew (Windows: winget install --exact --id AlexsJones.llmfit)
brew install AlexsJones/llmfit/llmfit2. Or try it without installing, with uv
uvx llmfit3. Open the interactive browser ranked for your hardware
llmfit4. Or print the top picks as JSON
llmfit recommend --jsonThere is also a curl | sh quick installer. It downloads the release binary from GitHub and uses sudo to place it in /usr/local/bin unless you pass --local; the package managers above avoid running a script at all.
Safety scan
We cloned AlexsJones/llmfit at commit 7d929f2 on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no committed binaries across 792 files and about 125,000 lines, mostly Rust. The 2 pattern hits are usage comments at the top of install.sh showing the curl | sh command.
- install.sh is about 195 lines. It fetches the latest release from GitHub and uses sudo to install into /usr/local/bin, or ~/.local/bin with --local. The three build.rs files embed the community benchmark data and app metadata into the binary at build time and download nothing.
- 40 advisories. All 3 critical ones, 2 in tinypool and 1 in Vitest, are in llmfit-web/package-lock.json, and both are test runners for the web dashboard's code that are not part of the shipped tool. The same lockfile holds 10 of the 12 high ones, mostly build tools such as Vite, PostCSS and browserslist. The Rust tool itself has 2 high (quick-xml, slow parsing on crafted XML), 3 moderate and 3 unrated.
- Benchmark sharing is opt-in. Results are saved locally first, and only if you press s before a run does llmfit sign in to GitHub through the device flow, fork the repo and open a public pull request with your result and hardware details. Leave it off and nothing is sent.
- The hosts in the code are Hugging Face for model data and downloads, GitHub, Ollama and example addresses in tests. We found no analytics service.
- 7 workflows, none using pull_request_target. 12 of 27 third-party actions are pinned to a commit. Dependabot is on and there is a contributing guide and code of conduct; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 2 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 3 Cargo build scripts. 2 installer scripts (one can call sudo) |
| Committed binaries | None. |
| CI workflows | 7 workflows. None use pull_request_target. 15 of 27 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 14 distinct hosts referenced from source; most often huggingface.co, github.com, ollama.example.com, ray.example.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 40 advisories across 900 pinned packages: 3 critical, 12 high, 19 moderate, 3 low, 3 unrated. Cargo.lock: 659 packages, 8 advisories; llmfit-python/uv.lock: 45 packages, 3 advisories; llmfit-web/package-lock.json: 196 packages, 29 advisories. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (2)
| Where | Rule | Match |
|---|---|---|
| install.sh:3 | download-piped-to-shell | # Usage: curl -fsSL https://raw.githubusercontent.com/AlexsJones/llmfit/main/install.sh | sh |
| install.sh:4 | download-piped-to-shell | # curl -fsSL ... | sh -s -- --local # Install to ~/.local/bin (no sudo) |
Installer scripts (2)
- install.sh, 195 lines, uses sudo; talks to github.com, raw.githubusercontent.com
- scripts/install-openclaw-skill.sh, 35 lines
Worst known vulnerabilities (24 of 40)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-5gmw-xhrv-c9v3 | critical | tinypool@1.1.1 | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution |
| GHSA-85c8-ppgw-ccpr | critical | tinypool@1.1.1 | Tinypool: Prototype Pollution Gadget to RCE in run() options |
| GHSA-5xrq-8626-4rwp | critical | vitest@2.1.9 | When Vitest UI server is listening, arbitrary file can be read and executed |
| RUSTSEC-2026-0194 | high | quick-xml@0.38.4 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.38.4 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-73wf-gq98-2v4g | high | browserslist@4.28.1 | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
| GHSA-c83g-rgw3-j3cx | high | browserslist@4.28.1 | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
| GHSA-28wg-ghj8-5hjv | high | nanoid@3.3.11 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.11 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-xwg4-73v4-xw9w | high | nanoid@3.3.11 | nanoid: Integer Overflow or Wraparound |
| GHSA-6g55-p6wh-862q | high | postcss@8.5.8 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.8 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-68fv-2mgg-jv7q | high | source-map-js@1.2.1 | source-map-js allows event-loop denial of service through indexed source-map section offsets |
| GHSA-587h-7wmj-h5pm | high | vite@5.4.21 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-96hv-2xvq-fx4p | high | ws@8.19.0 | ws: Memory exhaustion DoS from tiny fragments and data chunks |
| GHSA-wrw7-89jp-8q8g | moderate | glib@0.18.5 | Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` |
| GHSA-c9f9-cp8h-jcj5 | moderate | rmcp@3.7.0 | Unbounded response body buffering in Streamable HTTP clients |
| GHSA-7gcf-g7xr-8hxj | moderate | serde_with@3.18.0 | serde_with: KeyValueMap serialization panics on empty sequence or map entries |
| GHSA-6w46-j5rx-g56g | moderate | pytest@8.3.5 | pytest has vulnerable tmpdir handling |
| GHSA-6w46-j5rx-g56g | moderate | pytest@8.4.2 | pytest has vulnerable tmpdir handling |
| GHSA-82fw-gwwq-j7x9 | moderate | @vitest/mocker@2.1.9 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
| GHSA-qxg6-89mg-rqv8 | moderate | @vitest/mocker@2.1.9 | Vitest: Code injection via unauthenticated manual mock registration |
| GHSA-w5vr-8v7q-w6rv | moderate | baseline-browser-mapping@2.10.8 | baseline-browser-mapping process termination on invalid input causes denial of service |
| GHSA-67mh-4wv8-2f99 | moderate | esbuild@0.21.5 | esbuild enables any website to send any requests to the development server and read the response |
By the numbers
| Stars | 38.9K |
|---|---|
| Forks | 2,511 |
| Contributors | 181 |
| Commits | 1,376 |
| Open issues | 35 |
| Open pull requests | 26 |
| Releases | 138 |
| Latest release | v1.1.20 |
| Licence | MIT |
| Main language | Rust |
| Project age | 8 months |
| Last push | Nov 10, 2026 |
| Tracked files | 792 |
| Lines of code | 125K |
| Checkout size | 34 MB |
Lines by language: Rust 75.5K, JSON 24.5K, Python 7,332, Markdown 6,408, JavaScript 5,568, YAML 3,087.
Questions
Is llmfit free?
Yes. llmfit is free and open source under the MIT licence, and it needs no account.
Does llmfit download or run models?
Only if you ask it to. By default it reads your hardware and scores models from its built-in data. From the interactive view you can choose to download a model and benchmark it through a runtime such as Ollama.
How accurate are the speed estimates?
They are estimates unless marked as measured. When you benchmark a model yourself, your real numbers replace the estimate, and community results for identical hardware ship in later releases.
What should I use to run the model it recommends?
Any of the runtimes it supports. Ollama is the simplest start, and we list it in this GitHub section along with llama.cpp and Jan.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.