Open-source agents: landscape audit

Checked 2026-11-14. This chapter is the audit a later writer can use to choose one agent for a non-technical person on Windows 11 or a Mac. Every figure comes from the five raw notes listed under Sources. Those notes copied official pages and GitHub API responses opened that day. Where two official pages disagree, both wordings stay. Where a note says UNVERIFIED, that label stays. This file does not add numbers, quotas, or test results that the notes do not contain.

Six agents are scored, after the table and the profiles: Hermes Agent, OpenClaw, Goose, Agent Zero, NanoClaw, and Atomic Agent. The crown is the highest total in that scoring section. It is not named above the arithmetic.

Star counts are the GitHub API stargazers_count values in the notes. They move. Third-party trackers and rounded marketing lines are not used.

Comparison

The four names at the bottom of the secondary notes (ZeroClaw, Moltis, Nanobot, OpenHands) are not in this table and are not scored. One sentence on each is at the end of the profiles.

Profiles

OpenClaw

OpenClaw is a self-hosted Gateway: one process on the person's computer connects chat apps, a browser dashboard, and companion apps to an agent with tools, sessions, and Markdown memory. The project says it is developed by the OpenClaw Foundation, described as an independent 501(c)(3). The legal filing itself is UNVERIFIED. The license on the GitHub API is MIT. The docs homepage says there is no paid tier. Prompts go to the model provider and the chat platforms the person configures. A daily version check can be turned off. Anonymous feature statistics are described as opt-in.

On Windows the recommended desktop path is Windows Hub, which installs without administrator rights and, on "Set up locally," creates an app-owned WSL distro for the Gateway. The same app can attach to a Gateway elsewhere. The Tauri app is the documented backup and can start a local Gateway with bundled Bun. The PowerShell one-liner iwr -useb https://openclaw.ai/install.ps1 | iex is the native CLI path. The installer internals page says the full native Windows recovery path "remains unproven on native Windows." Node rules are strict: 24.16.0+ on the 24.x line, or 26.1.0+, with 24.22.1+ or 26.12.1+ called the security floor. On a Mac, OpenClaw.app requires macOS 26.2. The CLI follows Node's own Mac support. The app links printed on the docs page are pinned to 2026.10.3, while GitHub's latest stable release is 2026.11.3 and includes OpenClaw-2026.11.3-arm64.dmg. This pass did not confirm an Intel or universal disk image on that tag.

Sandboxing defaults to off. With it off, implicit host exec runs on the gateway machine. Host exec defaults to security full and ask off, so ordinary shell commands do not prompt and do not need an allowlist match. Direct messages default to pairing, and groups default to an allowlist. Secrets live under ~/.openclaw (on Windows, %USERPROFILE%\.openclaw). The Copilot page says that secret store is not encrypted at rest. The same install can add schedules and phone chat later. Schedules are built in. Phone chat is a messaging channel or the iOS or Android companion, and the computer must stay reachable. The iOS and Android docs say the Gateway host is macOS, Linux, or Windows via WSL2. The Windows page separately documents a native Windows Gateway. Quote the phone pages when the reader is pairing a phone.

Current documented model routes include a Google AI Studio API key, a Groq plugin, OpenRouter, local Ollama, llama.cpp and other OpenAI-compatible or Anthropic-compatible servers, GitHub Copilot device login, Claude CLI reuse, and OpenAI Codex or an OpenAI API key. Google's terms call OpenClaw-via-Antigravity-OAuth a breach. Anthropic's help page, as quoted in the notes, says a third-party billing change announced in April 2026 was paused on 15 June 2026, and that extra-usage bundles can still bill after included limits if usage credits are on. Any numeric free quota for the Google key is UNVERIFIED.

Hermes Agent

Hermes Agent is Nous Research's self-hosted agent: a terminal, a desktop app, and a messaging gateway. The README describes a learning loop that writes skills, searches past sessions, and keeps two small memory files. The GitHub API license is MIT. A default install on the day checked lands on stable v0.23.1, not the same-day canary. The API timestamp and the human-written "November 9, 2026" title disagree; the notes keep both. The software being free does not include model or cloud bills. Nous Portal prices published on the site are Free $0, Plus $20/month, Super $100/month, and Ultra $200/month.

The lower-friction desktop path is a DMG on Apple Silicon, or an .appinstaller / MSIX on Windows 11 22H2 or later, or the Microsoft Store. Intel Macs have no desktop bundle; the install guide says they can use the CLI and hermes desktop, which builds the app. Published OS floors disagree: the homepage says macOS 12+ and Windows 10/11, the v0.23.0 notes say macOS 13+ and 64-bit Windows, and the platform matrix says the MSIX needs Windows 11 22H2 or later. The CLI on Windows 10 is still listed as Tier 1 via install.ps1. The providers page still says Hermes requires Unix and that Windows users run it inside WSL2. That sentence contradicts the README and the installation guide, which document a native Windows install. Windows Defender may quarantine uv.exe. Whether the homepage .exe is a wrapper around the MSIX is UNVERIFIED.

The default terminal backend is local. Commands run on the machine with no isolation, and child processes keep the real account's home directory. approvals.mode defaults to smart: commands that miss the dangerous-pattern list are not described as prompting; commands that match are judged by an auxiliary model, which can auto-approve a low-risk match, auto-deny a dangerous one, or ask. Skill writes default to free, including a background review after a turn. Container backends exist and are off until configured. Docker, Modal, Daytona, and Vercel Sandbox then skip the dangerous-command checks. A per-bot Xfce screen exists only on a Linux gateway host, including WSL2. It is not offered on a macOS or Windows host. On those desktops the agent can still drive the real machine through the local terminal and the computer-use driver the installer adds by default.

The same home directory can later grow into phone chat and schedules. Phone access is a gateway platform, not a mobile install. Telegram has a Desktop "Create with QR" path. The gateway also runs cron, ticking every 60 seconds, and agent jobs are skipped while the gateway is down. Closing the laptop stops a local agent. Hermes Cloud is the documented always-on option and is a paid Portal feature. Custom OpenAI-compatible base URLs are supported, and that is how local Ollama and llama-server are wired. Hermes rejects a context window under 64,000 tokens. The native Anthropic OAuth path, as the provider page states it, requires Claude Max plus purchased extra-usage credits and does not consume the base Max allowance. Claude Pro cannot use that path. A consumer Gemini subscription is not a documented login.

Goose

Goose is the general-purpose desktop and CLI agent founded by Block and now stewarded by the Agentic AI Foundation, a Series of LF Projects, LLC. The GitHub API license is Apache-2.0. It edits files, runs a shell, calls MCP extensions, searches the web, schedules recipes, and can spawn subagents. Full browser control is a separate install (browser-use skill install). The built-in web-search skill is the one enabled with the Skills extension. The providers page says goose relies on tool calling, and that models without tool calling are chat-only once extensions are disabled. The Claude models page, checked 14 November 2026, says to start with Claude Opus 5.5 for most workloads. The API id is claude-opus-5-5, at $4 input and $20 output per million tokens.

The desktop install is the simple one. On Windows, run Goose-win32-x64-setup.exe. It installs for the current user and does not need administrator rights. On a Mac, unzip Goose.zip or Goose_intel_mac.zip and run the app. Homebrew casks exist and are still named block-goose and block-goose-cli. The practical snag on the day checked is version identity. v1.59.1 says macOS desktop builds are coming soon and its asset list did not include the Mac zips or the Windows setup exe. The doc buttons point at the stable tag, whose desktop files were updated 2026-11-10. The version string inside those files is UNVERIFIED. Windows CLI is the awkward path: Git Bash, MSYS2, or PowerShell, a possible PATH edit, and a keyring workaround. The PowerShell script rejects Windows ARM64. An Apple silicon M3 can open with no window until ~/.config is writable. Settings on Windows still live under %APPDATA%\Block\goose. Minimum OS versions are UNVERIFIED.

Autonomous mode is the documented default (GOOSE_MODE default auto), and the Developer extension is enabled by default. The extensions page says goose can execute commands and modify files without approval. Manual, smart, and chat-only modes exist and can be set as the default for new sessions. Prompt-injection detection ships off. The homepage names sandbox mode and an adversary reviewer. A page that says either is on for a normal Desktop session was not opened. UNVERIFIED. The only sandbox mapping opened in detail is for the deprecated Codex CLI provider, which is Codex's sandbox, not the ordinary goose session.

Background schedules are part of this install: the Desktop Scheduler and goose schedule. Phone chat is not. There is no current goose phone app in the install guide. The experimental Telegram gateway needs a BotFather token, a pairing code, and a computer that stays awake. The mobile-access page says tunneling "is no longer available in current goose Desktop builds." The goose Mobile page is archived. Ollama, LM Studio, and a custom OpenAI-compatible URL (OPENAI_HOST, or a custom provider) are documented. Local GGUF through llama.cpp is a harder path, and whether the ordinary stable desktop zip includes goose local-models is UNVERIFIED.

Agent Zero

Agent Zero is the open-source project at agent0ai/agent-zero. The README calls it an agent with its own Linux workspace that runs in a sandbox and can use a terminal, a browser, and desktop apps. The LICENSE file on main begins "MIT License." The GitHub API for the same repo returned SPDX NOASSERTION. Keep both. Latest tag is v2.15 (2026-11-01). The install pages opened on main already point at A0 Launcher v1.9, and main was pushed after that tag.

The launcher is a real Windows exe and Mac dmg for x64 and ARM on both platforms. It is not a native agent with no container. The installation guide says the framework runs in Docker. If Docker is missing, the Mac script can set up Colima, and the Windows script can guide an interactive setup of WSL2, Ubuntu, and Docker Engine. That Windows path may request UAC and a restart. The person then opens a Web UI, by default on port 5080 bound to 127.0.0.1 in the recommended docker run. The first chat waits until a Main model and a Utility model are connected. No Windows or Mac RAM or disk floor was in the desktop steps. The only requirements table opened is a Linux VPS page last updated 21 December 2025 (2 GB RAM minimum, 4+ GB recommended). Do not treat that table as a laptop spec. A desktop minimum is UNVERIFIED.

Inside the container the documented computer is an XFCE desktop, a file manager, a terminal, LibreOffice Writer, Calc, and Impress, a Markdown editor, and a Chromium browser that can click, type, and screenshot. The README's "open Blender" line is an example prompt. Whether the image ships Blender was not confirmed. UNVERIFIED as a preinstalled app. Memory, skills, plugins, subordinate agents, and scheduled tasks are in the same product. Host access, which lets the instance use files and commands on the computer running the launcher, starts off. The launcher guide says the folder control picks a starting directory and does not restrict commands to that folder. The opened docs show Pause and Stop during a run. They do not show a popup before each command inside the container. Tool permissions can be set per action, and the profile guide warns that a blocked editor write does not stop a terminal from writing files. The factory position of the Allow switch was not read from a bundled config. UNVERIFIED.

Telegram, WhatsApp, and email are plugins added after model setup. WhatsApp's documented enabled default is false. An empty Telegram allow-list means open to all once a bot is configured. If the installer is given a username and no password, the password defaults to 12345678. Local models work, and the docs require a Docker-reachable address (host.docker.internal), not localhost. The provider file includes an Other OpenAI compatible entry.

NanoClaw

NanoClaw's GitHub description is "A lightweight alternative to OpenClaw that runs in containers for security." The README describes an assistant with memory, scheduled jobs, and web access, built around Anthropic's agent SDK, with other providers added as skills. License MIT. The published release a normal update installs is v2026.10.0 (2026-10-09).

There is no native Windows or Mac app in the pages opened. Official install docs say macOS or Linux, and Windows only through WSL2. Requirements name Docker, Node.js 22 or newer, and git. The one-liner is bash nanoclaw.sh after a git clone. Quick start says to plan 30–60 minutes. On macOS the script can install Homebrew, Node, pnpm, and Docker Desktop. The installation doc says setup pulls a prebuilt image after a NanoClaw account sign-in, and that building locally is the explicit "Build it here" choice. The README's accounts section says building locally needs no account and is the default, and that fetching the prebuilt image is an opt-in. Both pages were treated as live. Keep the disagreement.

The container is the default runtime. The security doc says every spawn drops all capabilities, sets no-new-privileges, and does not mount the host home, .ssh, or the Docker socket. That is not a prompt before every command. New chats, and an agent installing packages or adding an MCP server into its own container, do wait for a person. With no agent-to-agent policy, those messages flow freely. Egress lockdown is off by default. Claude is the default brain (a subscription, an OAuth token, or an API key) and credentials stay in a vault outside the container. OpenCode can point at a local OpenAI-compatible endpoint or at API keys. The providers doc says the skill that installs Ollama as the agent's brain still targets an older config path and is not a supported drop-in on current main. Channels and scheduled tasks are the center of the product. The project's own way to change behavior is to have Claude Code edit the code.

Atomic Agent

Atomic Agent is the local-first project at atomicagent.io and AtomicBot-ai/atomic-agent. The README says the control loop and state stay on the machine: browser, files, approved shell commands, documents, memory, schedules, and MCP. A different library with a similar name was not opened. UNVERIFIED whether a search would land on that other project. License MIT. Latest release v0.7.0 (2026-11-09) is labeled a Developer Preview. Stars that day were 3,669.

Released builds are programs, not a Docker requirement. The documented install is curl -fsSL https://atomicagent.io/install | sh or the PowerShell equivalent, and the prebuilt binary embeds Node. A desktop app in the same repo has its own releases. The README says current builds are macOS Apple Silicon, Linux, and Windows x64, and that Intel Macs are not supported yet. The install doc says a source build needs Node.js 25.7.0 or newer and is the fallback when there is no prebuilt, "notably Intel Macs." Those two pages disagree. No Intel Mac archive was in the v0.7.0 asset list.

Approval level 1 ("paranoid") is the documented default. Gated actions ask. A short list (pwd, date, whoami, and some read-only calls) runs without a prompt. Commands classed shell_dangerous keep asking until level 5. A few catastrophic commands are refused at every level. The approval can be a terminal prompt or a Telegram or Discord button. The docs say the gate is a policy mechanism, not a default OS sandbox: shell commands run with the same permissions as the agent process. A yes is permission on the real user account. Browser and HTTP tools reach the internet without a prompt unless http.approvalMode is changed. Local llama-server is the default brain and needs no API key. A first run can start on a small starter model while a better fit downloads. Cloud providers, a custom baseUrl, Ollama, and LM Studio are optional. Telegram and Discord start off. Schedules, reminders, and an overnight run are built in. The README's GAIA Level 1 figures (37/53 for Atomic Agent and 31/53 for Hermes, same split and model) are the project's own write-up, not an independent re-run.

QwenPaw

QwenPaw is the personal assistant from Alibaba's AgentScope project (agentscope-ai/QwenPaw). The README says CoPaw rebranded to QwenPaw on 2026-04-12. License Apache-2.0. Latest release v2.3.0 was published 2026-11-11, with a Mac zip and a Windows setup exe and no Linux desktop asset in the list that was opened. Stars were 37,740. A person can pip install it, run an install script, use the Docker image, or try the desktop app, which the README marks Beta for Windows 10+ and macOS 14+ and which is not notarized on a Mac. Shell commands go through Seatbelt, Bubblewrap, Landlock, AppContainer, or a restricted token when one of those exists and the sandbox switch is on; otherwise mode is none. In v2.3.0 the switch (security.sandbox_enabled, Enable Sandbox Execution in the Console) defaults to off. The default filesystem posture can read the whole disk, limits writes to declared mounts, and allows all network. Tool Guard defaults to AUTO, so only flagged calls need approval, and a non-interactive run may log a finding and continue. Local Qwen models ship through llama.cpp, Ollama and LM Studio are documented, cloud providers need a key, and Settings has a Base URL field. Chat channels named in the README include DingTalk, Lark/Feishu, WeChat, Discord, Telegram, iMessage, and QQ. Heartbeat and cron are documented.

OpenManus

OpenManus is the Python agent from the MetaGPT contributors (FoundationAgents/OpenManus). The README presents it as a way to run a Manus-style agent without an invite code: type a task with python main.py, with Browser Use attached to local Chrome by default. License MIT. The latest GitHub release is v0.3.0, published 2025-04-10, with an empty body and no assets. The repo was pushed on 2026-11-02, so the code on main can be newer than the tag. What changed was not diffed. Stars were 58,967. Install is a clone plus conda or uv. There is no desktop app in the README. A Windows-native install of uv itself is UNVERIFIED there. The README does not describe a shell sandbox or an approval prompt. UNVERIFIED whether the source has a confirm step the README omits. Models are a config.toml with a model name, an API key, and a base_url. A local model runtime is not named, and a local URL in base_url was not tested. UNVERIFIED. The README's surface is the terminal. No scheduled-task section was in the file opened.

Eigent

Eigent is a desktop cowork app (eigent-ai/eigent, site eigent.ai) built on CAMEL-AI: one agent or a workforce, with browser and terminal tools, skills, MCP, and scheduled automations. License Apache-2.0. Latest release v1.0.7 was published 2026-10-30, with a Windows exe, Apple silicon and Intel disk images, and a Linux AppImage. Stars were 15,818. That download is the desktop path. The README also documents a source quick start that connects to Eigent cloud and needs an account, and points standalone use at a separate local-deployment guide. SECURITY.md says the local permission policy and audit trail are not an operating-system sandbox: a shell running as the same user as Eigent has that user's files and processes. Dangerous Git operations require review. No official docs page names the starting permission mode; the v1.0.7 app code sets it to Ask me first, one of four modes (Read only, Ask me first, Approve for me, Full access). Docs list Ollama, vLLM, SGLang, LM Studio, and llama.cpp, plus a bring-your-own key with an endpoint and model name. The product site names WhatsApp as a way to check progress. The setup steps for that channel were not on a page opened. UNVERIFIED. Automations run on a schedule, an event, or a condition.

Everfern

Everfern is a small desktop agent (Everfern-AI/Everfern, site everfern.app). The README says it drives the computer (clicks, typing, apps) and can use a built-in browser agent called Navis. License MIT. Latest release v1.3.0 was published 2026-09-22, with a Windows exe, Apple silicon and Intel dmgs, and Linux packages. Stars were 101, with 12 forks. The README also says it can be cloned and run with Node.js 18+. The README states that every shell command runs in an isolated Linux VM, that the app pauses before anything destructive, and that newly written tools wait for approval. The source tree was not audited, so the VM sentence stays a README claim. Computer use is the real desktop, not that VM. Models named are Ollama, LM Studio, and several cloud providers. A custom base URL field was not in the README opened. UNVERIFIED. No phone channel was in the README. The README does say actions can be chained and scheduled.

Named in the notes and not scored

These four were noticed in roundup pages and then checked on their own pages. They are not in the scores.

• ZeroClaw, in the raw README on master, is a single Rust binary, MIT or Apache-2.0 at the user's choice, with a default autonomy of supervised. The same README warns that other "ZeroClaw" repos and domains are not this project.
• Moltis, on docs.moltis.org that day, is a Rust personal-agent server in one binary, with commands in Docker or Apple Container sandboxes, a web UI, Telegram, and Discord. The docs call it alpha and MIT.
• Nanobot, in the raw README on main, is a lightweight Python agent for a browser, a terminal, or a chat app, with files, memory, and scheduled tasks. That README's latest-release line said v0.4.0. A roundup's v0.4.1 was not confirmed. UNVERIFIED.
• OpenHands, in the raw README on main, is a self-hosted control center for coding agents. The first install option is explicitly unsandboxed. Docker is a separate option. The Docker example on that page is pinned to image tag 1.40.0.

Scores

Only Hermes Agent, OpenClaw, Goose, Agent Zero, NanoClaw, and Atomic Agent are scored. Each criterion is an integer from 0 to 10. The weighted points are that integer times the weight divided by 10. Weights: general-purpose ceiling 30, Windows and Mac install simplicity 25, safe-by-default guardrails 20, universal brain support 15, and the same install growing from a desktop first win to phone chat and schedules 10. Universal brain support means a current documented path for an API key, a custom OpenAI-compatible URL, and a local model. A default that runs an unguarded shell on the user's real files does not get a high safety score. High here means 7 or above.

The raw notes record facts and do not assign these points. The sentences below are the judgment, and each one points at a fact those notes already contain.

Hermes Agent — 68.0

• Ceiling: 9 × (30/10) = 27. One install can chat, run a host shell, edit files, browse, keep memory, write skills, search past sessions, schedule jobs, and reach a long list of chat apps, and the Mac and Windows installer adds a computer-use driver for the real desktop.
• Install: 6 × (25/10) = 15. A matching Apple Silicon Mac or Windows 11 22H2 PC has a real desktop package, and the notes also record an unsupported Intel Mac bundle, disagreeing OS floors, a providers page that still requires WSL2, and a possible Defender quarantine of uv.exe.
• Safety: 3 × (20/10) = 6. The default terminal is the host with no isolation, commands that miss the dangerous-pattern list are not described as prompting, and smart mode can auto-approve a matching command with a second model call.
• Models: 8 × (15/10) = 12. API keys, a custom OpenAI-compatible base URL, and local Ollama, llama-server, and LM Studio are documented, and startup rejects a context window under 64,000 tokens, which the Ollama section says is often above Ollama's own default.
• Growth: 8 × (10/10) = 8. Desktop, CLI, and the messaging gateway share one home directory, cron is built in, and phone chat is a gateway bot that stops when the local process stops.
• Total: 27 + 15 + 6 + 12 + 8 = 68.0.

OpenClaw — 65.0

• Ceiling: 9 × (30/10) = 27. One Gateway covers chat, files, PDFs, an isolated browser, Markdown memory, schedules, skills, many channels, and computer control, with Mac computer control defaulting on once the app permissions exist and Windows computer control experimental and opt-in.
• Install: 5 × (25/10) = 12.5. Windows Hub is a signed installer whose local setup is a WSL gateway, the docs also offer a Tauri app and a PowerShell script, the Mac app requires macOS 26.2, and the doc app links are pinned to 2026.10.3 while the latest stable tag is 2026.11.3.
• Safety: 2 × (20/10) = 4. Sandbox mode defaults to off and host exec defaults to full with ask off, so the shell is unguarded on the real machine, while unknown direct messages still default to pairing and groups default to an allowlist.
• Models: 9 × (15/10) = 13.5. A new setup can use API keys, local Ollama, and OpenAI-compatible or Anthropic-compatible endpoints, and the notes separately close new Gemini CLI OAuth and Antigravity OAuth.
• Growth: 8 × (10/10) = 8. Schedules are built in, and the same install can add chat channels or the iOS and Android companions, which do not host the Gateway and which the phone pages limit, on Windows, to WSL2.
• Total: 27 + 12.5 + 4 + 13.5 + 8 = 65.0.

Goose — 63.5

• Ceiling: 8 × (30/10) = 24. The desktop app and CLI can edit files, run a shell, call MCP extensions, search the web, schedule recipes, and spawn subagents, and full browser control is an extra skill install.
• Install: 8 × (25/10) = 20. Windows has a per-user setup exe and the Mac has silicon and Intel zips, and the day-of-check snag is that v1.59.1 says Mac desktop builds are still coming while the doc buttons use stable files updated 2026-11-10 whose internal version is UNVERIFIED.
• Safety: 1 × (20/10) = 2. Autonomous mode and the Developer extension are both on by default, so goose can change files, delete files, and run commands on the real account without asking, and prompt-injection detection defaults to off.
• Models: 9 × (15/10) = 13.5. The providers table lists 47 named providers, custom OpenAI-compatible URLs are documented, and Ollama and LM Studio are local paths, while llama.cpp as the main chat model is the harder route and the default zip's local-inference build is UNVERIFIED.
• Growth: 4 × (10/10) = 4. The Desktop Scheduler is part of this install, and phone chat is only the experimental Telegram gateway after the mobile tunnel was removed and the mobile page was archived.
• Total: 24 + 20 + 2 + 13.5 + 4 = 63.5.

Agent Zero — 70.0

• Ceiling: 9 × (30/10) = 27. The same product documents an XFCE desktop, a browser, LibreOffice, a terminal, memory, skills, plugins, subordinate agents, and scheduled tasks, with host access as an optional escape and with Blender left unverified as a shipped app.
• Install: 4 × (25/10) = 10. Launcher builds exist for Windows x64 and ARM64 and for both Mac CPU families, and the local workspace still needs Docker, Colima, or WSL2, which on Windows can mean UAC and a restart, with no desktop RAM floor in the steps (UNVERIFIED).
• Safety: 7 × (20/10) = 14. The documented default workspace is the container, host access starts off, and the recommended port binds to localhost, while commands inside the container are not described as waiting for a yes and the factory tool-allow position is UNVERIFIED.
• Models: 8 × (15/10) = 12. API keys, account sign-in, Other OpenAI compatible, and local Ollama, LM Studio, and llama.cpp are in the current docs, and a server on the host must be reached as host.docker.internal because localhost means the container.
• Growth: 7 × (10/10) = 7. Tasks live in the same Web UI, and Telegram, WhatsApp, and email are plugins on that install, with WhatsApp off until QR pairing and with a WhatsApp ban rate left UNVERIFIED.
• Total: 27 + 10 + 14 + 12 + 7 = 70.0.

NanoClaw — 56.5

• Ceiling: 6 × (30/10) = 18. It is a personal agent with per-group memory, web access, scheduled jobs, and tools inside a container, and the notes say it is not a double-click desktop coworker that drives the apps on the user's screen.
• Install: 3 × (25/10) = 7.5. macOS and Linux need git plus a script that installs Node and Docker, Windows needs WSL2 first, quick start says to plan 30–60 minutes, and official pages disagree on whether the prebuilt image is the default.
• Safety: 8 × (20/10) = 16. The default shell is Docker with capabilities dropped and without the host home, .ssh, or the Docker socket, while ordinary commands inside that container do not each wait for approval and egress lockdown is off.
• Models: 6 × (15/10) = 9. Claude is the path setup is built around, OpenCode adds API keys and a local OpenAI-compatible endpoint, and the skill that makes Ollama the brain is not a supported drop-in on current main.
• Growth: 6 × (10/10) = 6. Chat channels and scheduled tasks are the center of the product and are meant to stay up under launchd or systemd, and there is no desktop app to be the first win on Windows or Mac.
• Total: 18 + 7.5 + 16 + 9 + 6 = 56.5.

Atomic Agent — 68.5

• Ceiling: 7 × (30/10) = 21. The README lists a browser, files, a shell, documents, memory, schedules, and MCP from a terminal, a CLI, a local API, or a desktop app, and the install doc calls v0.7.0 a developer preview whose commands and config still move.
• Install: 6 × (25/10) = 15. Prebuilt binaries and a desktop app exist for Apple Silicon, Linux, and Windows x64, the project is still a developer preview, and the README says Intel Macs are not supported yet while the install doc mentions a source-build fallback.
• Safety: 6 × (20/10) = 12. Approval level 1 asks before gated actions and refuses a short list of catastrophic commands, and the docs say the gate is not a sandbox, so a yes runs as the user, with browser and HTTP tools unprompted unless that setting is changed.
• Models: 9 × (15/10) = 13.5. Local llama.cpp is the default and needs no key, a custom OpenAI-compatible baseUrl is documented, and cloud providers including OpenRouter and Gemini are optional additions.
• Growth: 7 × (10/10) = 7. Schedules and an overnight run are built in, overnight denies anything that still needs a yes unless approval is turned off for that run, and Telegram and Discord can drive it from a phone but start off.
• Total: 21 + 15 + 12 + 13.5 + 7 = 68.5.

Totals

The gap from first to third is 2.0 points. A later writer who moves any one safety or install score by a single point should add the column again before treating the order as wide.

Crowned agent

Agent Zero, at 70.0.

It won because the default place the work happens is a Linux computer in Docker, with host access off, and that same install already includes a watchable desktop, a browser, office files, scheduled tasks, and optional phone plugins. The install weight punished the Docker step (10 of 25), and the safety and ceiling weights gave those points back. Atomic Agent is 1.5 points behind: it asks before most risky commands and is easier to put on a supported Windows or Apple Silicon machine, and a yes still runs on the user's real account inside a developer preview. Hermes Agent is 2.0 points behind: on a matching Mac or Windows 11 PC it is a broader desktop install with phone chat and schedules ready to add, and the default shell is that PC.

A reader who only wants a desktop program on the Windows or Mac files they already have, and who will not add phone chat, can stop at Goose, and should know the default can change those files without asking. A reader who wants the agent inside its own Linux computer is the reader this total already picks: Agent Zero's workspace is that container, and host access is the switch that opens the real computer.

Sources

This chapter uses only these notes, all checked 2026-11-14:

• research/raw/openclaw.md
• research/raw/hermes.md
• research/raw/goose.md
• research/raw/agent-zero.md
• research/raw/other-agents.md

The URLs below are the ones those notes cite for identity, install, safety, and models. The notes list more pages than this.

OpenClaw

• https://github.com/openclaw/openclaw
• https://api.github.com/repos/openclaw/openclaw
• https://api.github.com/repos/openclaw/openclaw/releases/latest
• https://docs.openclaw.ai/
• https://docs.openclaw.ai/install
• https://docs.openclaw.ai/platforms/windows
• https://docs.openclaw.ai/platforms/macos
• https://docs.openclaw.ai/gateway/sandboxing
• https://docs.openclaw.ai/tools/exec
• https://docs.openclaw.ai/providers/google
• https://antigravity.google/terms/
• https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan

Hermes Agent

• https://github.com/NousResearch/hermes-agent
• https://api.github.com/repos/NousResearch/hermes-agent
• https://hermes-agent.nousresearch.com/
• https://hermes-agent.nousresearch.com/docs/getting-started/installation
• https://hermes-agent.nousresearch.com/docs/getting-started/platform-support
• https://hermes-agent.nousresearch.com/docs/user-guide/security
• https://hermes-agent.nousresearch.com/docs/user-guide/configuration
• https://hermes-agent.nousresearch.com/docs/integrations/providers
• https://hermes-agent.nousresearch.com/docs/user-guide/messaging

Goose

• https://github.com/aaif-goose/goose
• https://api.github.com/repos/aaif-goose/goose
• https://api.github.com/repos/aaif-goose/goose/releases/latest
• https://goose-docs.ai/
• https://goose-docs.ai/docs/getting-started/installation
• https://goose-docs.ai/docs/getting-started/providers
• https://goose-docs.ai/docs/guides/managing-tools/goose-permissions
• https://goose-docs.ai/docs/getting-started/using-extensions
• https://goose-docs.ai/docs/experimental/remote-access/telegram-gateway
• https://goose-docs.ai/docs/experimental/remote-access/mobile-access

Agent Zero

• https://github.com/agent0ai/agent-zero
• https://api.github.com/repos/agent0ai/agent-zero
• https://api.github.com/repos/agent0ai/agent-zero/releases/latest
• https://agent-zero.ai
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/LICENSE
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/README.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/setup/installation.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/launcher.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/conf/model_providers.yaml

NanoClaw, Atomic Agent, and the shorter profiles

• https://github.com/nanocoai/nanoclaw
• https://docs.nanoclaw.dev/installation
• https://docs.nanoclaw.dev/concepts/security
• https://docs.nanoclaw.dev/extend/providers
• https://github.com/AtomicBot-ai/atomic-agent
• https://atomicagent.io/docs/getting-started/installation/
• https://atomicagent.io/docs/concepts/approvals/
• https://github.com/agentscope-ai/QwenPaw
• https://github.com/FoundationAgents/OpenManus
• https://github.com/eigent-ai/eigent
• https://raw.githubusercontent.com/eigent-ai/eigent/main/SECURITY.md
• https://github.com/Everfern-AI/Everfern