Latest in AI
Jan 0.8.8 Adds Trusted Hosts Checks for Its Local AI API
Jan 0.8.8 tightens browser access to its local API, preserves opt-in MCP execution and updates its llama.cpp engine. Here is what integrations need to check.
Jan released version 0.8.8 on October 28, adding browser-origin checks to its local AI API alongside file-access fixes. Developers connecting Jan to browser interfaces should review Trusted Hosts after upgrading. The project recommends the update and says existing data and settings carry over. Jan release notes.
Which clients need attention
Browser requests must come from an origin Jan trusts: the same machine, Jan itself or an explicitly allowed host. A web interface on another computer, or a browser extension calling Jan directly, may need an entry in Settings > Local API Server > Trusted Hosts. Requests without a browser origin, including scripts, SDKs and Claude Code, retain their previous behavior.
MCP tool execution stays opt-in. File tools no longer follow links beyond their workspace, and sensitive folders cannot be attached as writable. Links in replies and tool results now open in the system browser. Security and integration changes.
Check the endpoint before changing permissions
The current API documentation describes an OpenAI-compatible server with a default base URL of http://127.0.0.1:1337/v1. Starting it requires a local model that Jan can load. Select that model in Local API Server settings, then start the server; a configured remote provider does not remove that startup requirement.
The default host, 127.0.0.1, limits access to the same computer. Binding to 0.0.0.0 makes it reachable from other devices. Authentication is optional: setting an API key requires clients to send a bearer token, while leaving it empty disables authentication. Jan advises against disabling it on a network-exposed server.
For an integration that stops working after the update, first identify which client is failing. A browser-origin rejection, a missing bearer token and a server that has not loaded its model are different problems. Changing the listening address is not a substitute for checking those settings, and can widen access unnecessarily.
The engine update has a separate migration detail
Version 0.8.8 also includes Jan's llama.cpp engine 0.7.0 update. The engine implementation adds per-model speculative-decoding controls and an experimental GPU cache for mixture-of-experts models. The expert cache is off by default and only applies to models whose metadata declares experts; it is not a general setting for every local model.
Saved inference state from the previous engine version is rejected and removed because the state format changed. That is separate from the application's saved conversations and settings. The new controls retain upstream defaults unless configured, so an upgrade does not require immediately retuning every model.
For teams maintaining Jan integrations, the useful upgrade check is small: confirm the local model starts, verify the intended client can connect, and inspect whether server-side tools should be enabled. Keep that connectivity check separate from any later performance tuning so a configuration issue is easier to isolate.
I'm Paras. I work at the intersection of AI, engineering and distribution.
I help technical founders turn local AI releases and integration changes into clear content developers can read, use and share.