QwenPaw: Advanced features

This is page 7 of 8. It covers six power features for after the playbook feels routine, each with the documented way to turn it on and what it trades away.

Everything here matches the QwenPaw docs and the v2.3.0 code as checked on 14 November 2026. Turn on one feature at a time, and keep STRICT on while you try it.

Run QwenPaw in a Docker container

What it is for: running QwenPaw inside a container, so the agent sees only the storage you give it instead of every file your account can read.

How to turn it on: install Docker first, which this guide does not cover. Then paste the one-line command below from the QwenPaw security docs. It works in PowerShell and in a Mac Terminal.

docker run -p 127.0.0.1:8088:8088 -v qwenpaw-data:/app/working -v qwenpaw-secrets:/app/working.secret -v qwenpaw-backups:/app/working.backups agentscope/qwenpaw:latest

Then open http://127.0.0.1:8088/. The README says settings, memory, and skills live in the qwenpaw-data volume, your keys in qwenpaw-secrets, and backups in qwenpaw-backups. To reach Ollama on your own computer, the README says to add --add-host=host.docker.internal:host-gateway to the command. Then set the Base URL in Settings → Models to http://host.docker.internal:11434, or to http://host.docker.internal:1234/v1 for LM Studio.

• You gain: the container replaces the "whole disk is readable" gap with a wall, because the agent can only see its own volumes, not your Documents or your home folder.
• You risk: the security docs say QwenPaw's own sandbox falls back to mode=none inside a container, so commands run freely inside it, and the network is still open. The docs also say the Chrome extension and Computer Use do not work in Docker.
• Makes sense when: you plan to turn the command tool back on for real jobs and want a wall that does not depend on administrator rights on Windows.

Connect tools with MCP

What it is for: adding outside tools, such as a file server limited to one folder, through MCP. For how skills and MCP compare across agents, and how to choose safe ones, see Skills and MCP.

How to turn it on: go to Workspace → MCP, which some docs pages call Agent → MCP. Click + Create, paste the JSON settings for the server, and click Create. Local servers need Node.js 18 or newer. Below is the docs' recommended format for a file server. Change the folder path to one you choose.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/folder"]
    }
  }
}

Each client card has an access policy, where you can set tools to ask, allow, or deny. The docs say new mail cards start on ask. This guide could not confirm the starting policy for a client you create yourself, so set it to ask before the first use.

• You gain: the agent can use tools QwenPaw does not ship with, and a file server can be held to one folder you pick.
• You risk: a local MCP server runs as a separate program with your account's rights, outside QwenPaw's sandbox. Also, npx -y downloads and runs the package without asking. This guide could not confirm that Tool Guard checks MCP tool calls the same way it checks built-in tools.
• Makes sense when: a job needs a tool that QwenPaw lacks, the server comes from a source you trust, and its card is set to ask.

Add skills from the market or a link

What it is for: giving the agent ready-made instructions for a kind of job, beyond the built-in skills and the ones you make with /make-skill.

How to turn it on: go to Workspace → Skills and open the Add Skill menu. Choose Browse Market to search the QwenPaw, ClawHub, and ModelScope markets, then click Save on a card. The same menu has Upload via URL for a link from a supported hub or GitHub, and Upload via Zip for a skill folder. The docs say skills added this way are "enabled by default." To check one before you rely on it, the CLI offers qwenpaw skills test my_skill --agent-id default. Put your skill's name in place of my_skill.

• You gain: proven steps for jobs like slides, spreadsheets, or research, without writing them yourself.
• You risk: a skill is instructions the agent follows and can include scripts, so a bad one can steer the agent toward harm. The Skill Scanner starts on Warn, which lets a risky skill through with only a warning.
• Makes sense when: the Skill Scanner is on Block under Settings → Security, and you have read the skill's files before its first job.

Tune Ollama or LM Studio for agent work

What it is for: running a local model through Ollama or LM Studio, which the docs suggest when QwenPaw Local gives you trouble.

How to turn it on: for Ollama, the docs say to install the latest version, download a model, and set the context length to at least 32k in Ollama's settings. For LM Studio, start the server under Developer → Local Server. Set Settings → Model Defaults → Default Context Length to at least 32768. Then enter the address with /v1 on the end, such as http://localhost:1234/v1, on the LM Studio provider page in QwenPaw. In either case, click Discover Models and then Test Connection on the provider page. To use a QwenPaw-Flash model in Ollama, the docs suggest a Q4_K_M or Q8_0 file. You import it with ollama create qwenpaw-flash -f qwenpaw-flash.txt.

• You gain: no per-use cost, nothing sent to a cloud company, and often better graphics chip support than QwenPaw Local.
• You risk: a 32K context uses much more memory, so a model that fit before may slow down or fail. Small models also stay weak at multi-step work.
• Makes sense when: your computer has about 24 GB of memory or more and the job holds private material you do not want to send to a provider.

Edit the config file and run checks

What it is for: changing settings the Console does not show, and checking your setup when something feels off.

How to turn it on: the main settings live in ~/.qwenpaw/config.json, and each agent's settings, including approval_level, live in agent.json in its workspace. The docs say QwenPaw checks for changes every 2 seconds and reloads them without a restart. With the script install, qwenpaw doctor checks your setup without changing anything. After that, qwenpaw doctor fix --dry-run lists the repairs it would make before you allow any.

• You gain: settings such as denied_tools and the seven shell evasion checks under security.tool_guard in one place, plus a quick health check.
• You risk: a typo can break QwenPaw or quietly undo a safety setting, and the file reloads while the agent runs.
• Makes sense when: you have made a backup first and change one setting at a time, then check it on the Console's Settings → Security page.

Back up before risky changes

What it is for: saving a copy of your agents, settings, and skills before an update or a big change, so you can roll back.

How to turn it on: go to Settings → Backup and click Create Backup. The dialog starts on Full backup, which also packs your keys and shows a red warning. Partial backup lets you pick what to include and leaves the keys unchecked by default. The docs say backups are stored in ~/.qwenpaw.backups/, and a restore can make a backup of the current state first.

• You gain: a way back after a bad update, a broken skill, or an agent that changed files you cared about.
• You risk: a Full backup is a zip file holding your model keys, so anyone who gets the file gets the keys.
• Makes sense when: you are about to update QwenPaw, edit the config file, or add a skill, and a Partial backup without keys covers what you need.

This page leaves out a few features that reach further than a beginner needs. The Chrome extension lets the agent act in your signed-in Chrome, and Computer Use lets it control other apps on the desktop. Both are Beta, and so is the mail feature. Opening the Console to other devices with --host is left out too, because the docs say web login starts off.

Shared advanced topics

• Local models: QwenPaw runs local models through QwenPaw Local, Ollama, or LM Studio, so this explains how big a model your memory can run.
• Mixing models: QwenPaw lets each agent, and each chat, use its own model.
• Host access and unattended runs: QwenPaw runs on your real computer, and its scheduled tasks run with nobody watching.
• An always-on machine: schedules and chat apps only work while QwenPaw is open and the computer stays on.
• Relays: QwenPaw's model list includes OpenRouter, which passes your requests on to other companies, and Add Provider accepts the Base URL of any compatible relay.

Sources

Checked 14 November 2026.

• QwenPaw security, for Docker one-line command, mode=none inside containers, Skill Scanner modes, security.tool_guard settings, web login off by default.
• QwenPaw README, for Docker volumes, reaching Ollama and LM Studio from Docker.
• QwenPaw Chrome extension and Computer Use, for Beta, not in Docker.
• QwenPaw MCP and built-in tools, for + Create, JSON format, Node.js 18+, access policy, mail cards on ask.
• QwenPaw skills, for Add Skill, Browse Market, Upload via URL, Upload via Zip, "enabled by default".
• QwenPaw CLI, for qwenpaw skills test, qwenpaw doctor, qwenpaw doctor fix --dry-run.
• QwenPaw models, for Ollama 32k context, LM Studio settings, Discover Models, Test Connection, QwenPaw-Flash import, OpenRouter, Add Provider, choosing a model in chat.
• QwenPaw config and working folder, for config.json, agent.json, reload on change.
• QwenPaw backup, for Create Backup, Full backup, Partial backup, keys unchecked by default.
• QwenPaw multi-agent, for a model per agent.

Next

Next: Persona and rules.