AnythingLLM

The only documented exports are chat logs (CSV/JSON/JSONL) and per-chat exports. Desktop documentation gives the storage folder location but no documented backup, export, import or migration procedure for the whole instance or a workspace, so there is no documented export of the agent.

• AnythingLLM Docs: Where is my data stored? (Desktop)
• AnythingLLM Docs: Chat logs
• Source: chat export formats (convertTo.js)
• GitHub issue #3087: choose storage location (open)

The default export route covers conversation text only. Configuration, prompts, memories, custom skills, flows, scheduled jobs, documents, embeddings and integration settings are not in any export; they remain only in the local storage folder.

• AnythingLLM Docs: Chat logs
• AnythingLLM Docs: Where is my data stored? (Desktop)
• Source: export-chats endpoint

The free Desktop app needs no account or licence check, and the self-hosted terms say it needs no connection to Mintplex servers (the embedder has a Hugging Face primary source with a Mintplex CDN fallback). However, the Desktop Terms of Use grant only a non-exclusive, non-transferable licence that they do not state is perpetual or irrevocable, so public evidence does not establish an irrevocable right to run the distributed Desktop binary (G12). The MIT server core offers another route, but no documented migration path onto it exists.

• AnythingLLM Desktop Terms of Use (v. July 14, 2025)
• TERMS_SELF_HOSTED.md
• Source: native embedder model download with CDN fallback

The default LLM is a built-in local engine (Ollama). Many local providers are supported (Ollama, LM Studio, LocalAI, etc.), and so are local embedders, speech-to-text, text-to-speech and image generators (Ollama, LocalAI, Lemonade). Agent tools run in the runtime, and an 'UnTooled' prompt-based fallback covers models without native tool calling. The only model-locked feature found is a beta-preview computer-use feature fixed to an Anthropic model, which is not part of the evaluated default.

• AnythingLLM Docs: Built-in LLM (Desktop)
• AnythingLLM Docs: Language models
• AnythingLLM Docs: Configuration (PROVIDER_DISABLE_NATIVE_TOOL_CALLING)
• Source: UnTooled fallback
• AnythingLLM Docs: Computer use (beta)

Desktop needs no account. All state (anythingllm.db, documents, vector DB, plugins, .env) lives in a local storage folder on the owner's device, so a current copy is always in the owner's hands whatever happens to the provider.

• AnythingLLM Docs: Where is my data stored? (Desktop)
• TERMS_SELF_HOSTED.md

State is kept in SQLite with a public Prisma schema, JSON documents and vector cache, LanceDB (an open format), JSON flow definitions, JavaScript skill source and a plaintext .env, all in an owner-held folder. Built-in skill and prompt logic is published as MIT source, and no provider-held keys are involved.

• Source: Prisma schema
• Source: storage README
• AnythingLLM Docs: Custom agent skill developer guide

The UI shows the workspace system prompt, the model, and enabled skills and MCP tools. Some context additions can be seen only in source code: the agent role prompt, the appended clarifying-questions instruction, the UnTooled function-picker prompt and the memory header. No view or log of the fully assembled context was found, so G3 caps this test at partial.

• Source: agent defaults (role and clarifying-question prompts)
• Source: memory header injection
• AnythingLLM Docs: System prompt variables

On by default, the app sends usage events (chat sent, agent tool name, documents uploaded, LLM provider and model, etc.) to PostHog with a stable per-instance UUID. The Desktop privacy policy does not disclose how long this data is kept. The README says sent events appear in the local output log, but retention is undisclosed.

• AnythingLLM Desktop Privacy Policy
• Source: telemetry model (PostHog, telemetry_id)
• README: Telemetry & Privacy

The one provider-chosen default found is You.com as the agent web-search provider, which the changelog and blog disclose as a partnership. The owner can switch the search provider or disable web browsing. Source code shows no sponsored or paid placement in agent context or tool defaults. The Community Hub pages could not be opened (HTTP 403).

• AnythingLLM changelog v1.16.2
• AnythingLLM blog: You.com search
• Source: web-browsing plugin

Interactive agent sessions store only the final response in workspace_chats. Tool calls and their arguments go only to the live websocket and are not stored (scheduled-job runs do store a full trace). No mechanism tells the owner when recording fails. Two shortfalls apply: entries lack arguments and targets, and recording can fail silently.

• Source: chat-history plugin (what is persisted)
• Source: scheduled job run persistence
• AnythingLLM Docs: Event logs

Chats, event logs, invocations and job runs are plain SQLite rows with no hashing, signing or chaining. An admin endpoint can clear all event logs.

• Source: EventLogs model
• Source: clear event logs endpoint

Built-in default skills cannot write the chat or event tables. The SQL agent connects only to external databases, and the filesystem agent is sandboxed and available only in Docker. However, owner-enabled custom skills (in-process Node handlers) and stdio MCP servers run arbitrary code with access to anythingllm.db, and nothing separates the record from them. The protection holds by default except for this one path.

• Source: custom skill loader
• Source: SQL connectors
• AnythingLLM Docs: Custom skills introduction

The Desktop Electron wrapper, a required component of the evaluated offering, has no public source. Its Terms of Use call the software's source code a trade secret and forbid modification and reverse engineering. The server core is MIT, and release binaries ship without checksums or provenance.

• AnythingLLM Desktop Terms of Use
• LICENSE (MIT, core)
• GitHub API: release v1.16.2 assets

The agent has no identity of its own. Outbound actions go through channels the owner holds, such as a Gmail Apps Script deployment the owner runs or an Outlook OAuth app the owner registers, with no Mintplex client or broker. Attribution is therefore per channel only.

• Source: Gmail agent (owner Apps Script deployment)
• Source: Outlook agent (owner Azure app)
• AnythingLLM Docs: Gmail agent

Workspace system prompt changes are kept in a prompt history with author and one-click restore, and the event log records that the LLM, embedder or vector DB changed (without values). Other settings, skills, memories and model changes have no change history or restore.

• Source: prompt history model
• Source: prompt history restore UI
• Source: settings change event logging

The workspace system prompt and the instance default system prompt can be edited in the UI, and custom skills and flows are owner-defined. Several hardcoded instructions (agent role prompt, clarifying-questions instruction, UnTooled tool-selection prompt, memory header) can be changed only by editing source.

• Source: default system prompt endpoint
• Source: agent defaults

Memories (workspace and global) are listed with create, edit and delete controls. However, the default-on rag-memory skill's 'store' action embeds text straight into the workspace vector DB with no document record, so those items are not itemised or individually editable in the UI.

• AnythingLLM Docs: Memories
• Source: memory endpoints (GET/POST/PUT/DELETE)
• Source: rag-memory store action

The owner can add custom skills (plugins/agent-skills handler.js), MCP servers and Agent Flows without provider review. Every built-in skill, including the four default-on ones, can be disabled, and individual MCP tools can be suppressed.

• Source: default and disableable skills
• Source: MCP hypervisor (suppressedTools)
• AnythingLLM Docs: MCP on Desktop

Some protections are configurable (tool-call chain limit, approval timeout, MCP cooldown, auto-approved skills), but on Desktop only through environment variables that the docs tell Desktop users not to edit. Others are hardcoded: the 100-round agent limit, the 5-minute agent websocket timeout, and the memory count limits.

• AnythingLLM Docs: Configuration
• Source: aibitat limits
• Source: memory limits

Desktop updates are owner-initiated reinstalls (an in-app banner only links to downloads), and no remote flag or server-side configuration code was found. The default model is local. Keeping the installed version acts as an indefinite pin.

• AnythingLLM Docs: Update AnythingLLM Desktop
• AnythingLLM Docs: Debugging & logs (update banner)

Contact and web reach are on/off only: the Gmail/Outlook skills and web browsing/scraping have no per-recipient or per-domain allow or deny lists. There is also no owner control over which sources the agent takes instructions from. Spend is treated as met under G11 because there is no payment capability. File scope has per-folder grants, but only in Docker.

• AnythingLLM Docs: Agent setup
• AnythingLLM Docs: File System Agent
• Source: skill defaults

Approval prompts exist only for a fixed set of built-in write actions (filesystem writes, file creation, Gmail/Outlook/Calendar writes, job creation) and for custom skills that request them. MCP tools, SQL, web and flows cannot be gated, and scheduled-job runs auto-approve every tool.

• Source: requestToolApproval
• Source: scheduled job auto-approval
• AnythingLLM Docs: custom skill handler.js

The stop button fully aborts the foreground agent session and inference (v1.16.0). Scheduled jobs must be stopped per run or disabled separately, and background jobs such as memory extraction keep running. There is no single global stop.

• AnythingLLM changelog v1.16.0
• AnythingLLM Docs: Scheduled jobs, viewing runs
• Source: background workers

Non-content telemetry is on by default and can be disabled in Settings > Privacy. By default, agent web-search queries go to You.com, a destination the owner did not specifically choose, though web browsing can be turned off. The privacy policy says data is not sold. Policy changes take effect after posted notice, without specific consent.

• AnythingLLM Desktop Privacy Policy
• Source: telemetry toggle
• AnythingLLM changelog v1.16.2

All credentials are held locally: provider keys in the plaintext storage .env, integration configs in SQLite. Mintplex holds none and uses no broker. The UI shows only whether each key is set, across several settings pages, and LLM provider keys can be overwritten but not individually revoked or listed in one place.

• Source: dumpENV (key storage)
• Source: masked integration configs

No provider-side copy of the agent exists. Full deletion is a documented multi-step manual process (uninstall, then delete the storage folder) with no in-app single action or completion confirmation. Telemetry already sent to PostHog is not agent state.

• AnythingLLM Docs: Uninstall AnythingLLM Desktop
• AnythingLLM Docs: Privacy and data handling