---
title: "Open source AI agent comparison: 15 personal agents"
description: "Compare 15 open source AI agents with REA graph mapping and source reading: runtime, models, memory, tools, approvals, telemetry, isolation and tradeoffs."
url: https://personalagentbench.com/open-source-personal-agents/
last_updated: 2026-10-12
---

# Open source AI agent comparison: 15 personal agents

Choose an open source AI agent by checking the work it can perform, the permissions it needs and the environment that runs it. This comparison focuses on personal assistants and related memory or device agents: 15 source-reviewed projects, including OpenClaw and 14 alternatives. It is not a catalogue of every agent framework. Use the table to shortlist architectures, then follow the project links to pinned source and configuration evidence.

- Compare tool availability, approval policy and execution isolation separately; each answers a different deployment question.
- Use the model and memory columns to locate provider choices and persistent stores before connecting your own data.
- Read telemetry settings component by component, using the linked defaults rather than assuming self-hosting keeps every connection local.
- REA mapped the JS/TS application graph (Electron boundaries, imports, storage, request call sites); behavioural conclusions (approval paths, defaults, telemetry) were confirmed by reading the source. The reproduction section records coverage and limits.

## Open source AI agent comparison: 15 agents, eight questions

Start with the columns relevant to your task: runtime/scheduling, model selection, memory, tool availability, approval/control, egress/telemetry, execution isolation and a notable distinction. These are a source-review worksheet, not the site's scored exam axes. Model values are scoped as defaults, examples or unresolved choices. Tool totals, where shown, describe the inspected static registry rather than every possible configured session.

| Agent | Runs / schedules | Models | Memory | Tool availability / reach | Approval / control | Egress / telemetry | Execution isolation | Notable |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| OpenMuse | [Server + worker](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L120-L164) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/worker.ts#L23-L85) | [Configurable; unset](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L105-L145) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/tanstack-agent.ts#L23-L63) [3](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/model.ts#L20-L27) | [PGlite/Postgres](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/db.ts#L1-L31) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/db.ts#L154-L180) [3](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/service.ts#L138-L155) [4](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L141-L142) | [Computer + Google](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/model.ts#L48-L75) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer-tools.ts#L49-L110) [3](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/actions.ts#L59-L76) | [Google review](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/actions.ts#L59-L148) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer.ts#L416-L488) | [Sampling 100% intent](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L26-L28) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L145-L159) [3](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/agent.ts#L55-L68) | [Docker/E2B option](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer.ts#L85-L105) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer.ts#L488-L518) [3](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L120-L132) | [Hosted key required](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L26-L28) [2](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L150-L152) |
| OpenPoke | [FastAPI + triggers](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/app.py#L68-L83) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/services/trigger_scheduler.py#L37-L44) | [OpenRouter/Sonnet 4](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/config.py#L52-L64) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/openrouter_client/client.py#L10-L13) | [Local logs](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/services/conversation/log.py#L19-L20) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/services/conversation/summarization/working_memory_log.py#L16-L17) [3](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/services/conversation/summarization/working_memory_log.py#L44-L70) | [Email + triggers](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/interaction_agent/tools.py#L24-L120) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/registry.py#L12-L29) [3](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/gmail.py#L523-L535) | [Send handler direct](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/gmail.py#L374-L383) | [Model/Composio; telemetry NE](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/openrouter_client/client.py#L10-L13) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/gmail.py#L374-L383) [3](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/config.py#L62-L64) | NE | [Draft is not send gate](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/interaction_agent/tools.py#L64-L84) [2](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/gmail.py#L374-L383) |
| OpenInstinct | [Next/Eve + schedules](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/package.json#L1-L35) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/schedules/dynamic.ts#L1-L35) | [GPT-6.1 / Muse](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/db/services/settings.ts#L5-L35) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/agent.ts#L7-L29) [3](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/subagents/browser-agent/agent.ts#L4-L20) | [Profile/Blob](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/lib/profile-memory.ts#L12-L48) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/db/services/user-profile.ts#L1-L25) | [Google/Link/browser; bash disabled](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/gmail.ts#L66-L80) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/link__create_spend_request.ts#L1-L20) [3](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/subagents/browser-agent/tools/bash.ts#L1-L3) | [Link asks; mail scoped](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/link__create_spend_request.ts#L1-L20) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/gmail.ts#L52-L80) | [Hosted services; telemetry NE](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/lib/profile-memory.ts#L12-L35) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/subagents/browser-agent/lib/kernel.ts#L1-L4) [3](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/db/services/settings.ts#L5-L23) | NE | [Scheduled mail read-only](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/link__create_spend_request.ts#L8-L19) [2](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/gmail.ts#L66-L80) |
| [OpenClaw](https://personalagentbench.com/openclaw-security/) | [Gateway + cron](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/gateway/server-cron.ts#L165-L178) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/gateway/server-cron.ts#L500-L520) | [OpenAI/gpt-6-astra](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/defaults.ts#L1-L10) | [Markdown + SQLite](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/extensions/memory-core/src/short-term-promotion-apply.ts#L185-L205) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/extensions/memory-core/src/memory/manager.ts#L15-L25) | [Dynamic/plugins](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/openclaw-tools.ts#L54-L104) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/openclaw-tools.ts#L126-L175) | [Exec fallback full/off](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/infra/exec-approvals-config.ts#L95-L97) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/infra/exec-approvals-resolver.ts#L30-L45) | [OTel opt-in](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/extensions/diagnostics-otel/src/service.ts#L214-L230) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/defaults.ts#L1-L6) | [Default off](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/sandbox/config.ts#L90-L103) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/sandbox/config.ts#L215-L231) | [Defaults differ from deployment](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/infra/exec-approvals-config.ts#L95-L97) [2](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/sandbox/config.ts#L221-L222) |
| CowAgent | [Python + Electron](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/app.py#L1-L35) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/tools/scheduler/scheduler_service.py#L1-L45) [3](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/desktop/src/main/index.ts#L328-L349) | [DeepSeek flash](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L1-L20) | [SQLite + files](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/memory/storage.py#L136-L166) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/memory/config.py#L69-L80) | [Shell/browser/send](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/tools/tool_manager.py#L45-L90) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L108-L129) [3](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/desktop/src/main/preload.ts#L10-L29) | [Full-access default](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L42-L42) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L39-L49) [3](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L115-L138) | [Provider APIs; telemetry NE](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L1-L20) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/tools/tool_manager.py#L80-L90) | [Renderer boundary; tool isolation NE](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/desktop/src/main/index.ts#L343-L349) | [Template beats comment](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L45-L47) [2](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L42-L42) |
| QwenPaw | [Uvicorn services](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/cli/app_cmd.py#L1-L18) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/app/_app.py#L700-L720) [3](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/cli/cron_cmd.py#L1-L25) | [Configurable; default NE](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/agents/model_factory.py#L25-L35) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L198-L205) | [ReMe working dir](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/agents/memory/reme_light_memory_manager.py#L220-L249) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/agents/memory/reme_light_memory_manager.py#L870-L885) | [Shell/browser/mail](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/agents/tools/__init__.py#L1-L30) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L2875-L2920) | [Guards on](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L2953-L2962) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L3028-L3043) | [Telemetry opt-out](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L20-L28) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L223-L245) [3](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/app/_app.py#L243-L252) | [Default off](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L3028-L3043) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/sandbox/config.py#L110-L166) | [Guard is not sandbox](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L2953-L2962) [2](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L3035-L3043) |
| [ZeroClaw](https://personalagentbench.com/open-source-personal-agents/#zeroclaw) | [Rust daemon](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/src/daemon/mod.rs#L1-L2) | [Configurable; default NE](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-config/src/providers.rs#L145-L170) [2](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-config/src/providers.rs#L250-L270) | [SQLite/Markdown/etc.](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-memory/src/lib.rs#L154-L202) [2](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-memory/src/sqlite.rs#L50-L90) [3](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-memory/src/sqlite.rs#L1833-L1847) | [Dynamic Rust tools](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/src/tools/mod.rs#L1-L1) | [always_ask wins](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-runtime/src/approval/mod.rs#L235-L275) | [Observer default None](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-config/src/schema.rs#L13303-L13318) [2](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-config/src/schema.rs#L13442-L13457) | [NE](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-runtime/src/security/policy.rs#L1-L1) | [Full honors ask](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-runtime/src/approval/mod.rs#L245-L265) |
| Leon | [Fastify + workers](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/http-server/http-server.ts#L232-L250) [2](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/tool-manager/tool-worker-manager.ts#L92-L112) | [Configurable; null](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/config.ts#L70-L105) [2](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/config.ts#L306-L335) | [SQLite](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/memory-manager/memory-repository.ts#L87-L104) [2](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/memory-manager/memory-repository.ts#L260-L285) [3](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/memory-manager/memory-repository.ts#L340-L370) | [Toolkits/satellites](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/tool-manager/toolkit-registry.ts#L1-L35) [2](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/tool-manager/tool-executor.ts#L355-L380) | NE | [Telemetry on; call coverage NE](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/config.ts#L88-L88) [2](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L43-L43) [3](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L134-L183) | [Child processes; OS sandbox NE](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/tool-manager/tool-worker-manager.ts#L92-L112) | [Utterance payload path](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L156-L183) |
| MimiClaw | [FreeRTOS + timers](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi.c#L1-L8) [2](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi.c#L165-L185) [3](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi_config.h#L114-L118) | [Anthropic/Opus 4.5](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi_config.h#L86-L87) [2](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi_config.h#L151-L152) [3](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/llm/llm_proxy.c#L197-L199) | [SPIFFS files](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi_config.h#L102-L109) [2](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L87-L134) | [12 declared; GPIO; no shell](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L60-L178) [2](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L180-L215) | [Direct dispatch](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L228-L240) | [Models/channels; telemetry NE](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/llm/llm_proxy.c#L197-L199) [2](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/llm/llm_proxy.c#L197-L199) | NE | [Physical pins](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L180-L215) |
| MIRIX | [FastAPI + queue](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/server/rest_api.py#L180-L205) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/server/rest_api.py#L125-L137) | [GPT-4o-mini + Google](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L10-L16) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L64-L68) | [Postgres; Redis option](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/settings.py#L134-L153) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/settings.py#L249-L258) [3](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/functions/function_sets/memory_tools.py#L1090-L1135) | [Memory/MCP tools](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/functions/function_sets/memory_tools.py#L30-L45) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_manager.py#L1-L35) [3](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/mcp_tool_registry.py#L1-L30) | NE | [Langfuse off](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L10-L16) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L64-L68) [3](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/settings.py#L234-L245) [4](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/observability/langfuse_client.py#L50-L65) | [Local/E2B option](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L84-L97) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L171-L189) [3](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L197-L225) | [Two model providers](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L10-L16) [2](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L64-L68) |
| [NanoClaw](https://personalagentbench.com/open-source-personal-agents/#nanoclaw) | [Host + sessions](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L1-L9) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L386-L430) | [Claude; model NE](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/providers/provider-name.ts#L1-L12) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103) | [SQLite + mounts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/db/connection.ts#L1-L18) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L1069-L1101) | [Provider-dependent](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L63-L83) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude.ts#L285-L305) | [SDK bypass](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude.ts#L290-L300) | [Dynamic hosts; telemetry NE](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L49-L57) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L845-L855) | [Container drivers](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L63-L63) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L1069-L1101) [3](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103) | [Isolation differs from prompts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L1069-L1101) [2](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103) |
| nanobot | [Python agent/service](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/apps/cli/service.py#L1-L35) [2](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/loop.py#L1-L30) | [Opus 4.5 config](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L160-L175) | [Markdown/JSONL](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/memory.py#L59-L83) | [Dynamic tools](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/__init__.py#L1-L15) [2](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L163-L192) | [Global gates NE](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L439-L447) [2](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L163-L192) | [Dynamic hosts; telemetry NE](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L160-L175) | [Host subprocess; workspace limit off](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L447-L447) [2](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L424-L451) [3](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L615-L636) | [Readable is not confined](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/memory.py#L73-L83) [2](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L447-L447) |
| LobsterAI | [Electron + engines](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/package.json#L1-L30) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L110-L128) | [Provider catalogue](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/shared/providers/constants.ts#L205-L280) | [MEMORY.md](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/openclawMemoryFile.ts#L47-L67) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/openclawMemoryFile.ts#L521-L543) | [Engine-dependent](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/agentEngine/openclawApprovalController.ts#L94-L120) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/browserCredentials/browserCredentialApprovalService.ts#L1-L30) | [UI + auto-allow](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/agentEngine/openclawApprovalController.ts#L94-L120) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/agentEngine/openclawApprovalController.ts#L145-L172) | [App analytics on](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/shared/analytics/constants.ts#L1-L3) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/mainLogReporter.ts#L176-L187) [3](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L120-L126) | [Renderer sandbox; shell NE](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/main.ts#L14248-L14257) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/preload.ts#L144-L155) | [DSH telemetry separate](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L120-L126) [2](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/mainLogReporter.ts#L176-L187) |
| nanoMuse | [Electron/mobile/relay](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/AGENTS.md#L3-L19) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/api.py#L1-L25) [3](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/harness/desktop/src/main.ts#L1701-L1718) | [DeepSeek flash (Python)](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L68-L99) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L127-L145) | [SQLite + cloud sync](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L100-L108) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L196-L211) [3](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657) [4](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657) [5](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398) [6](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/sync.py#L218-L240) | [Device/MCP; shell conditional](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/shell.py#L218-L251) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/email_tool.py#L1-L25) [3](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/calendar_tool.py#L1-L25) | [Sentinel policy](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/sentinel/policy.py#L77-L150) | [Sync on; training opt-in (source)](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/service.py#L768-L780) [3](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/config.py#L533-L533) | [Renderer sandbox; shell confinement NE](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/harness/desktop/src/main.ts#L1701-L1718) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/harness/desktop/src/preload.ts#L15-L44) | [Relay config is not live setting](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/config.py#L533-L533) [2](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/service.py#L768-L780) [3](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398) |
| [Hermes Agent](https://personalagentbench.com/hermes-agent/) | [Python + Electron](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/cli.py#L1-L30) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/gateway/run.py#L1-L30) [3](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/main.ts#L15020-L15052) | [Opus 4.6 example](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/cli-config.yaml.example#L72-L90) | [MEMORY.md/USER.md](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/memory_tool.py#L1-L45) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/memory_tool.py#L448-L457) | [Dynamic registry](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/registry.py#L1-L35) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L1630-L1638) [3](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/memory_tool.py#L448-L457) [4](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/preload.ts#L28-L59) | [Configurable/yolo](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/approval.py#L268-L285) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/approval.py#L481-L505) | [Dynamic hosts; telemetry NE](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L425-L438) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/cli-config.yaml.example#L72-L90) | [Local terminal; renderer sandbox](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L1-L12) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L425-L438) [3](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L710-L719) [4](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/session-windows.ts#L49-L56) | [Backend choice matters](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L425-L438) [2](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L710-L719) |

Read tool availability as the set of operations exposed to the agent, approval as the decision to permit an operation, and isolation as the process or container boundary around execution. A disabled shell belongs in the tools column. Renderer sandboxing concerns desktop page code; host subprocesses and terminal backends need their own boundary checks. **NE means the review did not establish that property**, not that a feature is absent.

## Open source personal agent options, one by one

Use each profile to identify a concrete setting or source path to inspect. The comparison table carries the broader runtime, model and storage inventory.

### OpenMuse

Check OpenMuse’s model configuration and Google action-review path first. It offers a server/worker architecture, and its reviewed model configuration is unset unless configured, with sample mode as the default. That is a code-resolution finding, distinct from a README's suggested model. Sources: [apps/server/src/config.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L105-L145), [apps/server/src/engine/tanstack-agent.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/tanstack-agent.ts#L23-L63), [apps/server/src/engine/model.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/engine/model.ts#L20-L27). Its Google proposal review binds decisions to context, while computer commands follow a separate path. A review screen should not be generalized to every action. Sources: [apps/server/src/actions.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/actions.ts#L59-L148), [apps/server/src/computer.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer.ts#L416-L488). The [OpenMuse page](https://personalagentbench.com/openmuse/) supplies the project's broader public-record context.

### OpenPoke

Check the Gmail send path and the process hosting scheduled work. OpenPoke's FastAPI server starts a trigger scheduler and an important-email watcher. Those schedules depend on the process remaining alive. Sources: [server/app.py](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/app.py#L68-L83), [server/services/trigger_scheduler.py](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/services/trigger_scheduler.py#L37-L44). The inspected Gmail draft-send handler checks for a connected identity and calls Composio's send-draft operation without a per-send confirmation in that handler. Global gating is not established. A visible draft is therefore insufficient evidence of an enforced send gate. Sources: [server/agents/execution_agent/tools/gmail.py](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/server/agents/execution_agent/tools/gmail.py#L374-L383).

### OpenInstinct

Check scheduled and interactive tools separately in OpenInstinct. Its controls vary by action and execution mode. Link spending forces approval, while the scheduled Gmail surface exposes only reading and searching. The interactive send handler is a separate path, and framework-wide confirmation there is not established. Sources: [agent/tools/link__create_spend_request.ts](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/link__create_spend_request.ts#L1-L20), [agent/tools/gmail.ts](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/gmail.ts#L52-L80). That distinction matters more than a single “has approvals” checkbox: removing a capability during scheduled work and asking before spending solve different control problems.

### OpenClaw

Use OpenClaw as the baseline and inspect its resolved sandbox and exec settings. Its reviewed sandbox mode falls back to off, and exec fallback constants are full/off with ask-fallback deny and configurable overrides. Sources: [src/infra/exec-approvals-config.ts](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/infra/exec-approvals-config.ts#L95-L97), [src/infra/exec-approvals-resolver.ts](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/infra/exec-approvals-resolver.ts#L30-L45). Sources: [src/agents/sandbox/config.ts](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/sandbox/config.ts#L90-L103), [src/agents/sandbox/config.ts](https://github.com/openclaw/openclaw/blob/e46cb104f29782ab08caee36607946074f91056f/src/agents/sandbox/config.ts#L215-L231). The [OpenClaw security review](https://personalagentbench.com/openclaw-security/) explains the nine-file REA scope, gateway, plugins and opt-in OTel exporter in more detail.

### CowAgent

Check CowAgent’s configuration template against the selected permission policy. The project includes a Python application and an Electron wrapper. Sources: [app.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/app.py#L1-L35), [agent/tools/scheduler/scheduler_service.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/tools/scheduler/scheduler_service.py#L1-L45), [desktop/src/main/index.ts](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/desktop/src/main/index.ts#L328-L349). The shipped configuration template and policy fallback select full-access. The review follows those settings rather than a conflicting comment describing stricter fresh-install behavior. Optional policies constrain tool arguments, but universal interactive approval is not established. Sources: [config-template.json](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L42-L42), [agent/permission/policy.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L39-L49), [agent/permission/policy.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L115-L138). Sources: [agent/permission/policy.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L45-L47), [config-template.json](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L42-L42). This is why source reading needs to resolve configuration rather than repeat nearby explanatory prose.

### QwenPaw

Check QwenPaw’s guards and sandbox as separate settings. Its tool/file guards default on while its governance sandbox defaults off. Those simultaneous defaults make it a useful example of why a guard should not be treated as an execution boundary. Sources: [src/qwenpaw/config/config.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L2953-L2962), [src/qwenpaw/config/config.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/config/config.py#L3028-L3043). Its startup telemetry is opt-out in the reviewed implementation. Sources: [src/qwenpaw/utils/telemetry.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L20-L28), [src/qwenpaw/utils/telemetry.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L223-L245), [src/qwenpaw/app/_app.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/app/_app.py#L243-L252).

### ZeroClaw

Check explicit `always_ask` rules before selecting an autonomy mode. The inspected approval manager evaluates those rules before Full autonomy and `auto_approve`, so an explicit ask rule retains precedence. [crates/zeroclaw-runtime/src/approval/mod.rs](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-runtime/src/approval/mod.rs#L235-L275). Next choose the memory backend: the Rust implementation supports SQLite, Markdown and other stores, with SQLite files under the workspace memory directory. [crates/zeroclaw-memory/src/sqlite.rs](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-memory/src/sqlite.rs#L50-L90). For built-in observability, the sink defaults to `None` and OTLP requires the `otel` backend. [crates/zeroclaw-config/src/schema.rs](https://github.com/zeroclaw-labs/zeroclaw/blob/6c0b1f9eeace7b40b410c0be95b96f8a09faf1ee/crates/zeroclaw-config/src/schema.rs#L13303-L13318). Effective OS isolation remains NE; these Rust behavior findings come from manual reading. REA's retained JS/TS scan parsed 172 files with five parse failures, recorded in the [reproduction record](https://personalagentbench.com/rea/pass2-reproduction.json).

### Leon

Review Leon’s telemetry settings and utterance handler before using it with conversation data. Leon runs a Fastify server and local child-process workers; always-on scheduling is not established. Sources: [server/src/core/http-server/http-server.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/http-server/http-server.ts#L232-L250), [server/src/core/tool-manager/tool-worker-manager.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/core/tool-manager/tool-worker-manager.ts#L92-L112). Its telemetry defaults enabled, and the reviewed utterance handler contains a payload path beyond anonymous operational counters. Whether that handler is called in every current conversation remains unestablished. Sources: [server/src/config.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/config.ts#L88-L88), [server/src/telemetry.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L43-L43), [server/src/telemetry.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L134-L183). That uncertainty prevents us from turning a discovered payload path into a claim of observed collection from all users.

### MimiClaw

Check whether your task needs physical GPIO access: MimiClaw is microcontroller firmware built around ESP-IDF/FreeRTOS tasks and timers, rather than a conventional desktop/server shell runtime. Sources: [main/mimi.c](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi.c#L1-L8), [main/mimi.c](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi.c#L165-L185), [main/mimi_config.h](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/mimi_config.h#L114-L118). Registered GPIO tools can manipulate physical pins. Sources: [main/tools/tool_registry.c](https://github.com/memovai/mimiclaw/blob/dcc1c8c7bcccfc60bc336c76666b67d4bdb50648/main/tools/tool_registry.c#L180-L215). Its C-core findings come from manual reading. It belongs in the comparison because execution location and physical reach can differ substantially within this category.

### MIRIX

Check both chat and embedding providers when configuring MIRIX. It has a FastAPI memory server and a queue service. Sources: [mirix/server/rest_api.py](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/server/rest_api.py#L180-L205), [mirix/server/rest_api.py](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/server/rest_api.py#L125-L137). Its configured chat and embedding defaults span two provider families, so selecting the chat model does not fully describe memory-related provider exposure. Sources: [mirix/configs/mirix.yaml](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L10-L16), [mirix/configs/mirix.yaml](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/configs/mirix.yaml#L64-L68). The execution runner selects E2B when an E2B key is configured and otherwise uses a local directory execution path. A directory or virtual environment alone is not an OS sandbox. Sources: [mirix/services/tool_execution_sandbox.py](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L84-L97), [mirix/services/tool_execution_sandbox.py](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L171-L189), [mirix/services/tool_execution_sandbox.py](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/mirix/services/tool_execution_sandbox.py#L197-L225).

### NanoClaw

Check the selected session driver and read-only/writable mounts before deciding what the agent can reach. The host runner validates additional mounts and constructs the execution session. [src/container-runner.ts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/container-runner.ts#L1-L9). Separately, the inspected Claude provider config selects `bypassPermissions` and permits dangerous permission skipping: that bypasses SDK prompts, without establishing unrestricted host access or the behavior of every provider. [container/agent-runner/src/providers/claude-config.ts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103). SQLite and persistent workspace mounts identify storage that can outlive a session. [src/db/connection.ts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/src/db/connection.ts#L1-L18). Use the mount configuration and provider policy together; container execution alone supplies no network allowlist. REA's retained scan parsed 909 JS/TS files with no parse failures; its partial-analysis status is recorded below.

### nanobot

Inspect nanobot’s workspace restriction alongside its memory files. It stores memory and history in ordinary host-readable Markdown and JSONL files. Sources: [nanobot/agent/memory.py](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/memory.py#L59-L83). Its workspace restriction defaults false, while shell execution uses subprocesses and configurable policy checks. Sources: [nanobot/config/schema.py](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/config/schema.py#L447-L447), [nanobot/agent/tools/shell.py](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L424-L451), [nanobot/agent/tools/shell.py](https://github.com/HKUDS/nanobot/blob/23941355a8932609d7fc7ba2820f162d1ea7bea5/nanobot/agent/tools/shell.py#L615-L636). Readable memory and confinement are separate properties; the first should not be used to imply the second.

### LobsterAI

Check the selected engine and each telemetry component in LobsterAI. It wraps agent engines in Electron, with the tool surface delegated to the chosen engine. Sources: [package.json](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/package.json#L1-L30), [src/main/libs/dshRuntime.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L110-L128). Sources: [src/main/libs/agentEngine/openclawApprovalController.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/agentEngine/openclawApprovalController.ts#L94-L120), [src/main/browserCredentials/browserCredentialApprovalService.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/browserCredentials/browserCredentialApprovalService.ts#L1-L30). Its application analytics default on, while DSH runtime telemetry is disabled separately in the spawned environment. Sources: [src/shared/analytics/constants.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/shared/analytics/constants.ts#L1-L3), [src/main/libs/mainLogReporter.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/mainLogReporter.ts#L176-L187), [src/main/libs/dshRuntime.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L120-L126). Turning off one component's telemetry therefore does not describe the other component's setting. Effective common shell isolation across engine modes remains unestablished. Sources: [src/main/main.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/main.ts#L14248-L14257), [src/main/preload.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/preload.ts#L144-L155).

### nanoMuse

Check nanoMuse’s conversation-sync setting separately from its local memory store. Its inspected Python memory uses SQLite, while cloud conversation synchronization defaults on separately. Sources: [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L100-L108), [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L196-L211), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [cloud/nanomuse_cloud/db.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398), [cloud/nanomuse_cloud/sync.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/sync.py#L218-L240). The source relay configuration defaults training contribution off unless a deployment switch enables it for new accounts. That does not establish the live community relay setting. Sources: [cloud/nanomuse_cloud/db.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398), [cloud/nanomuse_cloud/service.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/service.py#L768-L780), [cloud/nanomuse_cloud/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/config.py#L533-L533). The [nanoMuse public-record page](https://personalagentbench.com/nanomuse/) discusses the project's published service claims; source defaults and service statements must retain their separate scope.

### Hermes Agent

Check Hermes Agent’s terminal backend, approval mode and memory files using the [setup guide](https://personalagentbench.com/hermes-agent/). It combines a Python CLI/gateway with an Electron desktop surface. Sources: [cli.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/cli.py#L1-L30), [gateway/run.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/gateway/run.py#L1-L30), [apps/desktop/electron/main.ts](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/main.ts#L15020-L15052). Its curated memory uses `MEMORY.md` and `USER.md`, while terminal execution falls back to local and approval modes include explicit bypasses. Sources: [tools/memory_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/memory_tool.py#L1-L45), [tools/memory_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/memory_tool.py#L448-L457). Sources: [tools/approval.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/approval.py#L268-L285), [tools/approval.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/approval.py#L481-L505). Sources: [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L1-L12), [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L425-L438), [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L710-L719), [apps/desktop/electron/session-windows.ts](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/session-windows.ts#L49-L56). The [Hermes Agent review](https://personalagentbench.com/hermes-agent/) explains why the desktop renderer's sandbox settings do not establish a sandbox for terminal work.

## OpenClaw alternatives finding 1: renderer and execution differ

Identify which process a sandbox claim concerns. Hermes, nanoMuse and LobsterAI have reviewed Electron windows with context isolation and renderer sandboxing enabled and Node integration disabled. CowAgent also has a renderer boundary, but an explicit sandbox setting was absent in its inspected options, leaving the effective default unestablished. Sources: [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L1-L12), [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L425-L438), [tools/terminal_tool.py](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/tools/terminal_tool.py#L710-L719), [apps/desktop/electron/session-windows.ts](https://github.com/NousResearch/hermes-agent/blob/0b89435e7e4f7fab88a34eb69f13bf339eb2fd00/apps/desktop/electron/session-windows.ts#L49-L56). Sources: [nanomuse/tools/shell.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/shell.py#L31-L53), [nanomuse/tools/shell.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/shell.py#L218-L251), [nanomuse/tools/shell.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/tools/shell.py#L399-L421), [harness/desktop/src/main.ts](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/harness/desktop/src/main.ts#L1701-L1718), [harness/desktop/src/preload.ts](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/harness/desktop/src/preload.ts#L15-L44). Sources: [src/main/main.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/main.ts#L14248-L14257), [src/main/preload.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/preload.ts#L144-L155). Sources: [agent/permission/policy.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L21-L26), [agent/permission/policy.py](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/agent/permission/policy.py#L39-L47), [config-template.json](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/config-template.json#L42-L42), [desktop/src/main/index.ts](https://github.com/zhayujie/CowAgent/blob/aa5f4c92cc3143841edeabaf1c834ee151228d6f/desktop/src/main/index.ts#L343-L349).

A sandboxed renderer cannot by itself establish isolation for host-side shell work. Preload/IPC surfaces also require their own review; we did not establish that every handler validates its sender. REA helped map available desktop syntax, while source reading confirmed the settings.

## OpenClaw alternatives finding 2: approvals belong to paths

Trace the action handler and its selected approval branch. OpenMuse's Google proposal review, OpenInstinct's forced Link approval and NanoClaw's SDK bypass demonstrate distinct control decisions. They do not justify assigning each project a universal yes/no approval label. Sources: [apps/server/src/actions.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/actions.ts#L59-L148), [apps/server/src/computer.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/computer.ts#L416-L488). Sources: [agent/tools/link__create_spend_request.ts](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/link__create_spend_request.ts#L1-L20), [agent/tools/gmail.ts](https://github.com/Merit-Systems/OpenInstinct/blob/0c2a7c6e842fa7105cee004b2d6ac1d5f1c7c1e8/agent/tools/gmail.ts#L52-L80). Sources: [container/agent-runner/src/providers/claude-config.ts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude-config.ts#L94-L103), [container/agent-runner/src/providers/claude.ts](https://github.com/nanocoai/nanoclaw/blob/ab09973a8037a2bff568bc169128bfc2104c51ad/container/agent-runner/src/providers/claude.ts#L290-L300).

The useful unit of review is an action path in a specified mode. Ask where the check happens, what request it covers and which branch configuration selects. A draft presentation is not the same as a send gate; a tool removed from scheduled work is not the same as a runtime confirmation. “Full approval coverage” remains not established unless every relevant path has actually been traced.

## Open source AI agent finding 3: self-hosting and telemetry differ

Inspect each telemetry component’s configuration. OpenMuse's sampling configuration defaults to 1. Leon's telemetry is enabled, QwenPaw's startup telemetry is opt-out, and LobsterAI's application analytics are controlled separately from DSH telemetry. Sources: [apps/server/src/config.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L26-L28), [apps/server/src/config.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L145-L159), [apps/server/src/agent.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/agent.ts#L55-L68). Sources: [server/src/config.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/config.ts#L88-L88), [server/src/telemetry.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L43-L43), [server/src/telemetry.ts](https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/telemetry.ts#L134-L183). Sources: [src/qwenpaw/utils/telemetry.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L20-L28), [src/qwenpaw/utils/telemetry.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/utils/telemetry.py#L223-L245), [src/qwenpaw/app/_app.py](https://github.com/agentscope-ai/QwenPaw/blob/02b6a6d088e37192934645cbc0876114bb9e98ae/src/qwenpaw/app/_app.py#L243-L252). Sources: [src/shared/analytics/constants.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/shared/analytics/constants.ts#L1-L3), [src/main/libs/mainLogReporter.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/mainLogReporter.ts#L176-L187), [src/main/libs/dshRuntime.ts](https://github.com/netease-youdao/LobsterAI/blob/e8f80e566bb4c415fb337e7f5485e25ce80f12ea/src/main/libs/dshRuntime.ts#L120-L126).

A hosted dependency, model request and diagnostics exporter have different purposes and controls. Running application code yourself does not settle any of them. Conversely, an enabled default does not prove a particular installation retained that setting or successfully transmitted an event.

## Open source AI agent finding 4: references are not traffic

Follow request call sites when reviewing connections. REA associated OpenMuse's OAuth host literal with fetch syntax in [the Google authentication implementation](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/google-auth.ts#L154-L172). This improves on a text-only host inventory because it connects a literal to a request expression. It still does not show a request happening.

Many other request paths are relative or built dynamically, and dependencies can add destinations outside the visible literals. Our record therefore separates a hostname mentioned in text, a call site in source and actual egress. Only the first two were available in this static review. No comparison cell should be used as an exhaustive runtime allowlist.

## Open source personal agent finding 5: memory has multiple copies

Inventory application state alongside the backend memory store. OpenPoke's settings UI and MIRIX's authentication context provide examples of [browser/application storage](https://github.com/shlokkhemani/openpoke/blob/5b5f635935a64ab37884c025d70abb0ed731c094/web/components/SettingsModal.tsx#L164-L164) and [authentication state](https://github.com/Mirix-AI/MIRIX/blob/8cb06a62bbb7c478beb33dd4f2815696a72df482/dashboard/src/contexts/AuthContext.tsx#L36-L67). Those REA anchors supplement manually reviewed backend stores; they do not define learned memory by themselves.

nanoMuse adds a different distinction: SQLite memory and synchronized conversation copies need separate accounting. Sources: [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L100-L108), [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L196-L211), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [cloud/nanomuse_cloud/db.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398), [cloud/nanomuse_cloud/sync.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/sync.py#L218-L240). Local readability does not establish that all copies are local, and deleting one record does not establish erasure from provider history, replicas or backups. Complete deletion across those stores remains not established.

## Why Aiden and Inbox Zero are excluded

Check the pinned licence before treating a project as eligible for this open-source-only comparison. The recorded eligibility screen excluded Aiden because its top-level licence limits its AGPL option to non-commercial use, with a separate commercial licence option. [Pinned Aiden licence](https://github.com/AidenAI-IO/aiden-firmware/blob/a07262f1e4bd6afdc3f8be3274c2146771a5a179/LICENSE#L1-L15). Inbox Zero's recorded licence is AGPL-labelled with commercial monetization and enterprise restrictions; the screen did not establish an OSI licence. [Pinned Inbox Zero licence](https://github.com/elie222/inbox-zero/blob/41179be9fde75bfc8614488d2a7a6ba5c5ae4ce7/LICENSE#L1-L15).

These are the evidence packet's eligibility decisions for this open-source-only review, not a fresh legal opinion about either project. Neither repository received REA implementation analysis in this pass. Their eight behavioral answers remain not established because they were skipped. We do not put them in the table with guessed runtime, memory or approval properties, and exclusion is not a product-quality judgment.

## Reproduce this

Use the pinned revisions and recorded commands to check the evidence behind a row.

We read these with REA (morluto/rea, MIT, v6.4.0), an open-source reverse-engineering tool for agents, plus manual source reading. [REA](https://github.com/morluto/rea) mapped the supported JavaScript/TypeScript application graph: imports, storage, request call sites and Electron windows/preload/IPC. Behavioral conclusions about approvals, defaults and telemetry were confirmed by manual source reading. We are not affiliated with any reviewed project or REA.

The [reproduction record](https://personalagentbench.com/rea/pass2-reproduction.json) contains all 17 pinned repository SHAs, licence-screen status, portable equivalents of every pass-2 command, output hashes, Evidence IDs, parse counts and the OpenClaw slice's file hashes. This is a compact provenance record, not raw source, prompts or credentials. Reproduce against those revisions rather than moving branch heads.

For example, OpenMuse was pinned to `1ac68f3909f2478ab6280883f1ab5ea65eb5719d`. The exact recorded command is:

`npx rea-agents@6.4.0 analyze-javascript-application repos/openmuse --format json --analysis-timeout-ms 120000 > rea-out/openmuse.json 2> rea-out/openmuse.stderr`

Run from a working directory with the pinned checkout under `repos/openmuse` and an empty `rea-out/`. Executable and workspace paths are normalised to `npx rea-agents@6.4.0` and relative paths; some original runs also set a writable compiler-cache directory through `ADDITIONAL_SWIFT_DRIVER_FLAGS`. The Hermes Agent and OpenClaw security pages print their own commands and SHAs. The NanoClaw and ZeroClaw sections above link their pinned findings; the downloadable record preserves the complete command set for all applicable repositories.

REA was applicable to JS/TS surfaces in 14 of the 15 eligible agents. It did not analyze Python, Rust or C core behavior. Mimiclaw's C firmware remained a manual review. Retained analyses were partial: a writable compiler cache resolved the initial parsing issue, but restricted process inspection caused cleanup errors and the runner stopped lingering CLIs after complete output. Resource limits and parse failures remain limitations.

OpenClaw's full-tree retry timed out at the runner's 600-second cap without a complete result. Its retained analysis covers a nine-file source slice, not the complete repository. CowAgent and LobsterAI received targeted desktop/main-process scans whose counts can overlap earlier scans. A successful OpenPoke evidence-view command authenticated and summarized partial evidence; it did not make the underlying coverage complete. No agent, firmware, paid API or live-service workflow was executed.

## FAQ

**What are the open-source alternatives to OpenClaw?** The table names 14 eligible alternatives alongside OpenClaw as a baseline. Hermes Agent and OpenClaw have dedicated reviews; NanoClaw, ZeroClaw and the remaining alternatives have source-linked sections here. Choose which boundary to examine first rather than interpreting row order as a recommendation.

**Which OpenClaw alternative is safest?** This review cannot establish that ranking. It identifies source defaults and action paths, with explicit unknowns. Equivalent runtime testing and a specified deployment would be needed to compare broader security properties.

**Does open source mean everything stays on my machine?** No such guarantee follows from this evidence. For example, OpenMuse requires a hosted Intelligence key, while nanoMuse's conversation synchronization is separate from local memory. Sources: [apps/server/src/config.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L26-L28), [apps/server/src/config.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/config.ts#L145-L159), [apps/server/src/agent.ts](https://github.com/CopilotKit/openmuse/blob/1ac68f3909f2478ab6280883f1ab5ea65eb5719d/apps/server/src/agent.ts#L55-L68). Sources: [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L100-L108), [nanomuse/memory/store.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/memory/store.py#L196-L211), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [nanomuse/config.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/nanomuse/config.py#L655-L657), [cloud/nanomuse_cloud/db.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/db.py#L398-L398), [cloud/nanomuse_cloud/sync.py](https://github.com/nano-muse/nanoMuse/blob/7b49c824e21225a72705ff2096d2a015ddeeb232/cloud/nanomuse_cloud/sync.py#L218-L240).

**Did REA discover all the behavior in this comparison?** No. REA mapped supported source surfaces and supplied navigation anchors. Manual reading established the behavioral findings, particularly for non-JavaScript cores. Partial analysis, missing observations and static host references are not runtime measurements.

**Why are Aiden and Inbox Zero missing from the table?** The recorded licence screen excluded them, so their implementations were not analyzed in this pass. Their absence is an eligibility decision, not a low score or a claim that their features do not exist.

---

Published by Personal Agent Bench (https://personalagentbench.com), run by the Zentor team. Zentor builds agent software of its own, so its products are not on the scorecard and will not be added.