TextGen: Run Local LLMs with Every Knob Exposed (GitHub, Scanned)

TextGen is the project most people still know as oobabooga's text-generation-webui, renamed and repackaged as a desktop app. It loads models through llama.cpp, ik_llama.cpp, Transformers, ExLlamaV3 or TensorRT-LLM and switches between them without a restart, with chat, instruct and free-form notebook modes, image and document attachments, tool calling with MCP support, and an API compatible with both OpenAI and Anthropic clients. The full install adds LoRA training and an image-generation tab for diffusers models.

It has been around since December 2022, which makes it one of the oldest tools on this list, and it still exposes the sampler settings and loader options that friendlier apps hide. The portable builds have removed most of the old setup pain: download, unzip, double-click. It is AGPL-3.0, led by oobabooga with nearly 400 contributors, and states it runs with no telemetry.

• Repository: github.com/oobabooga/textgen
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: Python. Stars: 47.7K. Forks: 5,993. Last push: Aug 17, 2026.
• Scan: safe, Aug 17, 2026, commit c93f887

Who it is for

Tinkerers who want to compare backends and sampler settings on the same model, people training small LoRAs on their own data, and anyone who wants a local API that speaks both OpenAI and Anthropic formats.

Getting started

1. Easiest: download a portable build from the GitHub releases page, unzip it and double-click textgen. From source:

git clone https://github.com/oobabooga/textgen && cd textgen

2. Create a virtual environment and install the portable requirements (files for other hardware are in requirements/portable)

python -m venv venv && source venv/bin/activate && pip install -r requirements/portable/requirements.txt --upgrade

3. Launch with the API on, and open the interface in your browser

python server.py --portable --api --auto-launch

Portable mode runs GGUF models only; put them in user_data/models. For Transformers, ExLlamaV3, training and extensions, the one-click scripts (start_linux.sh, start_macos.sh, start_windows.bat) install Miniforge and PyTorch into installer_files/, about 10 GB, without admin rights.

Safety scan

We cloned oobabooga/textgen at commit c93f887 on Aug 17, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no self-decoding code, no binaries, no bare-IP URLs and no pattern hits in a compact 40,000 lines of Python.
• start_linux.sh and start_macos.sh, the one-click installers, download a pinned Miniforge release from GitHub with curl and install it inside the project folder; no sudo, no shell-profile changes. The requirements pull a custom Gradio build and llama.cpp binaries from oobabooga's own GitHub releases, so you are trusting that account for compiled code as well as source.
• The advisory count overstates things. The requirements pin numpy and transformers with wildcards (numpy==2.2.*), which the scanner read as a truncated version and matched against advisories for releases years older; two of the four criticals come from that. The exact pin that does carry advisories is mcp 1.27.0, whose issues are in MCP server transports, while TextGen uses the SDK to connect to servers.
• The other two criticals are real and optional: the Superbooga and Superbooga v2 extensions pin chromadb 0.4.24 and 0.6.3, both under a code-injection advisory, and both pin posthog, the client ChromaDB uses for its anonymous telemetry. Neither is installed unless you install extension requirements.
• Seven workflows, none using pull_request_target; the six third-party actions are pinned to tags. Dependabot is on; there is no security policy or contributing guide. --share (a public Gradio link) and --public-api (a Cloudflare tunnel) are off by default, and --api-key exists for when you need them.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 27K, CSS 4,012, JavaScript 3,518, Markdown 2,725, YAML 1,832, JSON 688.

Questions

Is TextGen free?

Yes. TextGen is AGPL-3.0 and free for any use, with no paid tier and no cloud service. The AGPL only bites if you modify it and offer it to other people over a network: then you must publish your changes. Models are separate downloads from Hugging Face, each under its own licence, and nothing in the app is tied to an account.

Is TextGen the same project as text-generation-webui?

Yes. The repository created in December 2022 as oobabooga/text-generation-webui was renamed TextGen and now lives at oobabooga/textgen, with its history, issues and stars intact. The browser interface still exists at 127.0.0.1:7860; the portable builds wrap it as a desktop app that opens in its own window when you double-click it.

Does TextGen have an API?

Yes. Start it with --api and it serves OpenAI-compatible Chat and Completions endpoints and an Anthropic-compatible Messages endpoint, with tool calling, on port 5000 by default. Point any OpenAI or Anthropic client at it by changing the base URL. Set --api-key before exposing it beyond localhost, and remember that --public-api publishes it through a Cloudflare tunnel.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.