Raw research notes

Secondary open-source agents — raw research

Checked: 2026-11-14.

Scope: six named projects, then a short "also seen" list. Figures below are copied from pages opened on that date (GitHub API, raw READMEs, official docs, or a project's own site). Where two official pages disagree, both wordings are kept. Where a fact was not on a page that was opened, it is marked UNVERIFIED. No numbers were filled in from memory.

These are secondary candidates for a layman guide. This note does not rank them against a primary agent.

NanoClaw

What it is. A personal AI assistant that runs each agent in its own Linux container and talks to chat apps. The repo description (GitHub API, 2026-11-14) is: "A lightweight alternative to OpenClaw that runs in containers for security." The README calls it an assistant with memory, scheduled jobs, and web access, built around Anthropic's agent SDK, with other model providers added as skills.

License. MIT. GitHub API license.spdx_id: MIT. README ending: "MIT".

Latest version. GitHub latest-release API: tag v2026.10.0, name v2026.10.0, published_at 2026-10-09T11:26:13Z. The changelog page opened the same day says the stable channel stays on 2026.10.0 until 2026.11.0 is published, and describes 2026.11.0-beta.2 as an unreleased beta. Treat v2026.10.0 as the published release a normal update installs.

Stars. GitHub API stargazers_count: 31115 (updated_at 2026-11-14T13:57:23Z). The product site's "31.1k+" line is the rounded marketing figure, not this count. Repo created 2026-01-31T15:47:22Z.

Windows and macOS. There is no native Windows app and no Mac App Store build in the pages opened. Official install docs: macOS or Linux, with Windows only through WSL2. The installer detects WSL and treats it as Linux. Requirements also name Docker Desktop (macOS or Windows) or Docker Engine (Linux), Node.js 22+ (the installer can install it), and git (not auto-installed). Quick start says to plan 30–60 minutes, and longer if Windows setup or a messaging app needs workspace approval. The one-liner is bash nanoclaw.sh after a git clone. On macOS that can install Homebrew, Node, pnpm, and Docker Desktop. On WSL without systemd, setup writes a start script instead of a service until systemd is turned on.

Two official pages describe the agent image differently. The installation doc says setup pulls a prebuilt image after a NanoClaw account sign-in, and that building locally is the explicit "Build it here" choice. The README's accounts section says building locally needs no account and is the default, and that fetching the prebuilt image is an opt-in that shares your email and the time you asked for an image. Quick start says setup asks "Enable Echo’s hardened agent image?" and that pressing Enter accepts it.

Shell sandbox and approval. Shell commands run inside the Docker container, not on the host. The security doc says every spawn drops all capabilities, sets no-new-privileges, and does not mount the host home, .ssh, or the Docker socket. The container is the default runtime (NANOCLAW_RUNTIME_DRIVER defaults to docker).

That is not a prompt before every command. The security doc's human-approval list is: new chats (approve/deny before an unknown chat reaches an agent), an agent installing packages or adding an MCP server into its own container, optional per-request approval for vault credentials, and optional gating of agent-to-agent messages. With no agent-to-agent policy, those messages flow freely. Egress lockdown (no direct internet from the container) is off by default, because it breaks tools that do not use the credential proxy.

Models. Claude is the default: a Claude subscription, an OAuth token, or an Anthropic API key, stored in the OneCLI vault rather than in the container. Setup can also install Codex (ChatGPT subscription or OpenAI API key) or OpenCode. OpenCode accepts ChatGPT sign-in, a local OpenAI-compatible endpoint, or an API key for OpenRouter, DeepSeek, OpenAI, Google, or Anthropic. Skills add Cursor and an Ollama provider. The providers doc says /add-ollama-provider still targets an older config path and is not a supported drop-in on current main; using Ollama as a tool (/add-ollama-tool) keeps Claude (or another provider) as the brain and calls a local model. A Claude-compatible custom endpoint is ANTHROPIC_BASE_URL in .env.

Phone, messaging, schedule. Built for chat apps, plus a local CLI. README channel list: WhatsApp, Telegram, Discord, Slack, Microsoft Teams, iMessage, Matrix, Google Chat, Webex, Linear, GitHub, WeChat, and email via Resend, installed with /add- skills. Scheduled tasks are a documented feature. The host is meant to keep running (launchd on macOS, systemd on Linux).

Why a non-coder might pick it. You message it from an app you already have, it can send a weekday briefing, and the work happens in a container instead of a single process with your whole computer. Main catch. Getting there is a terminal install with Docker, and on Windows a Linux layer first. Inside the container, ordinary commands do not wait for a yes, and the network lock is off until you turn it on. The project's own way to change behavior is to have Claude Code edit the code.

Atomic Agent (atomicagent.io)

What it is. The local-first agent at https://atomicagent.io and https://github.com/AtomicBot-ai/atomic-agent. GitHub API description: "Atomic Agent is a local-first AI agent. Runs open-weight models on your own machine via llama.cpp." The README says the control loop and state stay on your machine: browser, files, approved shell commands, documents, memory, schedules, and MCP. This note is only that project. A different library that uses a similar name was not opened; UNVERIFIED whether a reader might land on it by search.

Latest version. GitHub latest-release API: tag v0.7.0, published_at 2026-11-09T22:21:09Z. The install doc calls the current release a Developer Preview (v0.7.0) and says commands and config still move between releases. Release assets opened: atomic-agent-darwin-arm64.tar.gz, Linux x64 and arm64 archives, atomic-agent-win32-x64.zip, plus .deb and .rpm. No Intel Mac archive was in that asset list.

Stars. GitHub API stargazers_count: 3669 (updated_at 2026-11-14T14:21:07Z). Repo created 2026-04-21T21:34:51Z.

Windows and macOS. A released build is a program you install, not a Docker requirement. macOS/Linux: curl -fsSL https://atomicagent.io/install | sh. Windows PowerShell: irm https://atomicagent.io/install.ps1 | iex. The README says current builds are macOS (Apple Silicon), Linux x64/arm64, and Windows x64, and that Intel Macs are not supported yet. Windows on ARM runs the x64 build under emulation. The same README says the prebuilt binary embeds Node, so a released build does not need a separate Node install. The install doc says a source build needs Node.js 25.7.0 or newer and is the fallback when there is no prebuilt, "notably Intel Macs." Those two pages disagree on whether an Intel Mac source build is supported.

A desktop app lives in the same repo (atomic-agent-desktop) and has its own desktop-vX.Y.Z releases. The README lists desktop install channels as dmg, exe, AppImage, and deb. The CLI and the desktop app can sit side by side and share ~/.atomic-agent.

Shell sandbox and approval. The docs say the approval gate is a policy mechanism, and that shell commands and skill scripts run with the same permissions as the agent process. There is no default OS sandbox in the pages opened.

Default agent.approvalLevel is 1 ("paranoid"): every gated action asks. Level 1 is the documented default in both the tools page and the configuration page. A short safe list runs without a prompt (pwd, date, whoami, --version, and some read-only gh, gog, and icalBuddy calls). Everything else asks unless the level is 4 or higher. Commands classed shell_dangerous (rm -rf, sudo, chmod 777, force-push, bash -c, eval, and similar) keep asking until level 5. Hardline catastrophic commands (rm -rf /, mkfs, dd to a block device, fork bombs, shutdown) are refused at every level. A yes can come from the terminal UI, a y/n prompt, an HTTP webhook, or a Telegram or Discord button. Read-only tools inside the working directory do not prompt. Browser and HTTP tools reach the internet on purpose and run without a prompt by default, unless you change http.approvalMode.

Models. Local llama-server (llama.cpp) is the default, with no API key. The README says a first run can start on a small starter model while a better fit downloads. Cloud providers are off until you add llm.providers[]. Documented options include OpenAI-compatible endpoints (a baseUrl in config), OpenRouter, Gemini, and presets for Anthropic, Groq, DeepSeek, Mistral, xAI, Together, Ollama, LM Studio, and Atomic Chat. An external llama-server URL can be saved in config or in the TUI. Claude Code and ChatGPT/Codex subscriptions can be used through their own signed-in CLIs. Fusion mode (one model plans, workers execute) is opt-in.

Phone, messaging, schedule. The everyday surfaces are the terminal UI, the CLI, a local HTTP API, and the desktop app. Telegram and Discord are documented and start off: Telegram does nothing unless telegram.enabled is true and a token is set, and it binds to one owner. Approval buttons work on those chats. An unanswered Telegram approval auto-denies after 8 minutes. Tasks include cron, intervals, webhooks, and reminders. atomic-agent overnight runs unattended and denies any action that still needs approval, unless you pass --no-approval.

The README also reports a GAIA validation Level 1 result: 37/53 = 69.8% on qwen-3.6-35b-a3b (UD-Q4_K_XL) versus 31/53 = 58.5% for Hermes on the same split, model, step budget, and timeout, with the write-up in GAIA-L1-EXPERIMENT.md and artifacts in a gaia-l1-eval-2026-06-11 release. That is the project's own comparison, copied here, not an independent re-run.

Why a non-coder might pick it. It can run a small model on the computer you already own, with no API bill, and it stops for a yes before most risky actions. There is a desktop app as well as a terminal. Main catch. A yes is permission on your real user account. The docs say the gate is not a sandbox. It is still a developer preview, and an Intel Mac has no prebuilt binary.

QwenPaw

What it is. A personal assistant from the AgentScope project (Alibaba's AgentScope org on GitHub, agentscope-ai/QwenPaw). GitHub API description: "Your Personal AI Assistant; easy to install, deploy on your own machine or on the cloud; supports multiple chat apps with easily extensible capabilities." The README news section says CoPaw rebranded to QwenPaw on 2026-04-12. It is a local or cloud assistant with skills, several agents, memory, a browser console, a terminal UI, and chat channels.

License. Apache-2.0. GitHub API license.spdx_id: Apache-2.0. README: "QwenPaw is released under the Apache License 2.0."

Latest version. GitHub latest-release API: tag v2.3.0, published_at 2026-11-11T12:41:27Z. The README news line for that date matches v2.3.0. Release assets in that API response: QwenPaw-Tauri-2.3.0-macOS.zip and QwenPaw-Tauri-2.3.0-Windows-setup.exe. No Linux desktop file was in the asset names returned.

Stars. GitHub API stargazers_count: 37740 (updated_at 2026-11-14T14:42:09Z). Repo created 2026-02-24T03:42:56Z.

Windows and macOS. Several real install paths, all documented in the README:

pip, if you already have Python >= 3.11 and < 3.14: pip install qwenpaw, then qwenpaw init --defaults and qwenpaw app. Console at http://127.0.0.1:8088/.
A script that installs uv and the app: bash on macOS/Linux, install.bat or PowerShell on Windows. The README warns that Windows enterprise LTSC / Constrained Language Mode can stop the script from updating PATH.
Docker image agentscope/qwenpaw (tag latest for stable).
A desktop app the README marks Beta, for Windows 10+ and macOS 14+ (Apple Silicon recommended). First launch can take 10–60 seconds. The macOS build is not notarized; Gatekeeper will warn, and the README tells you to right-click Open. Linux desktop app: not in the v2.3.0 asset list opened. Linux is covered by pip, the shell script, and Docker.

Shell sandbox and approval. The security doc (website/public/docs/security.en.md on main) says shell commands go through a kernel sandbox when a backend exists: Seatbelt on macOS, Bubblewrap then Landlock on Linux, and on Windows either AppContainer or a restricted token. If none is available, mode is none (no isolation). Older Windows than Windows 10 build 10240 falls back to mode=none. Correction (checked 2026-11-14 in src/qwenpaw/config/config.py at tag v2.3.0): security.sandbox_enabled defaults to False, and its description says that when it is off, shell calls with no matching rule "run directly without the sandbox (no prompt)." The Console labels it Enable Sandbox Execution, and on Windows it warns "The sandbox will be inactive for this session" when QwenPaw is not running as administrator.

The default filesystem posture is allow_read_all: true: the whole filesystem is readable, and writes are limited to declared mounts (usually the workspace). network_allow defaults to ["*"] (all network). Sensitive paths such as ~/.ssh are on the default deny list. The README's shorter line "restricted filesystem view" is looser than this table.

Tool Guard approval default is AUTO: only tool calls the guard flags need approval. STRICT asks for every tool call. SMART auto-allows low-risk calls. OFF disables the guard. In the Console and other interactive sessions, CRITICAL or HIGH findings wait for approve or reject. In a non-interactive context with no session, the same doc says findings are logged and execution may still proceed. Shell-evasion checks (command substitution, obfuscated flags, and the rest of that list) default to off until you turn each one on.

Models. Local, no key: built-in QwenPaw Local (llama.cpp) with QwenPaw-Flash sizes 2B / 4B / 9B / 35B-A3B / 27B, plus Ollama and LM Studio. Cloud needs an API key. The README names DashScope/Qwen, OpenAI, Anthropic, Google Gemini, DeepSeek, Kimi, OpenRouter, "and more," and the feature table says "14+ cloud providers." Settings → Models has a Base URL field; the Docker section shows setting it to http://host.docker.internal:11434 for Ollama on the host, or http://host.docker.internal:1234/v1 for LM Studio.

Phone, messaging, schedule. README and intro: DingTalk, Lark/Feishu, WeChat, Discord, Telegram, iMessage, QQ, plus the browser console, the terminal UI, and the desktop app. Heartbeat and cron/scheduled tasks are documented sections.

Why a non-coder might pick it. You can use a local Qwen model, talk to it from phone chat apps that are common in and outside China, and there is a double-click desktop build if the terminal is unwelcome. Main catch. The default guard only stops commands it flags, the sandbox switch starts off and can still read the disk when on, and the network is open. The desktop app is beta, and on a Mac it is unsigned. A scheduled or other non-interactive run may log a dangerous finding and continue.

OpenManus

What it is. An open Python agent from the MetaGPT contributors, published as a way to run a Manus-style agent without an invite code. GitHub API description: "No fortress, purely open ground. OpenManus is Coming." The README title line is the same invite-code claim. You type a task in the terminal (python main.py). A browser is wired in through Browser Use. There is also run_mcp.py and an "unstable" multi-agent entry run_flow.py.

Latest version. GitHub latest-release API: tag v0.3.0, published_at 2025-04-10T02:47:41Z, empty release body, no assets. That is the newest published release. The repo is not abandoned: API pushed_at is 2026-11-02T08:38:21Z. The code on main can be newer than the April 2025 tag. What changed since the tag was not diffed for this note.

Stars. GitHub API stargazers_count: 58967 (updated_at 2026-11-14T14:49:01Z). Repo created 2025-03-06T14:08:14Z.

Windows and macOS. No desktop app and no Docker requirement in the README. You clone the repo and install Python dependencies with conda (Python 3.12) or uv. The uv steps include a Windows activate line: .venv\Scripts\activate. The uv installer shown is the Unix curl | sh script; a Windows-native install of uv itself is UNVERIFIED on the README. Browser Use starts as a default MCP server (uvx browser-use --cli-mcp) and attaches to local Chrome or Chromium with no API key. A cloud browser is optional via BROWSER_USE_API_KEY.

Shell sandbox and approval. The README does not describe a shell sandbox or an approval prompt. UNVERIFIED beyond that: the source was not read for a hidden confirm step. What the README does say is that the agent runs from your terminal and that local browser mode attaches to your Chrome.

Models. config/config.toml, copied from config/config.example.toml. The example is:

model = "gpt-4o"
base_url = "https://api.openai.com/v1"
api_key = "sk-..."

A second [llm.vision] block uses the same shape. A custom base URL is the documented way to point at another endpoint. A local model runtime (Ollama, llama.cpp, or similar) is not named in the README. Whether a local OpenAI-compatible server works if you put its URL in base_url was not tested: UNVERIFIED.

Phone, messaging, schedule. Terminal only, in the README. The Feishu link is a community group for developers, not a channel the agent answers. No scheduled-task section was in the README opened.

Why a non-coder might pick it. It is a free, widely starred way to type a goal and have an agent use a browser, without waiting for a commercial invite. Main catch. You install it like a Python project, you bring an API key, the last release tag is 10 April 2025, and the README never describes a box around the shell or a yes/no before actions.

Eigent

What it is. A desktop "cowork" app: one agent or a workforce of agents, with browser and terminal tools, skills, MCP, and scheduled automations. GitHub API description: "Eigent: The Open Source Cowork Desktop - Local and Free Alternative to Claude Cowork and Codex." Built on CAMEL-AI. Site: https://www.eigent.ai. Repo: https://github.com/eigent-ai/eigent.

License. Apache-2.0. GitHub API license.spdx_id: Apache-2.0. README: "This repository is licensed under the Apache License 2.0."

Latest version. GitHub latest-release API: tag v1.0.7, published_at 2026-10-30T13:54:17Z. Assets include Eigent.Setup.1.0.7.exe, Eigent-1.0.7-arm64.dmg, Eigent-1.0.7.dmg (the non-arm64 Mac disk image), Mac zip archives, and Eigent-1.0.7.AppImage. The release notes say this version lets you show several sessions at once and that automations start on local time.

Stars. GitHub API stargazers_count: 15818 (updated_at 2026-11-14T10:14:57Z). Repo created 2025-07-29T15:56:02Z. pushed_at 2026-11-13T19:27:12Z.

Windows and macOS. Real desktop installers for Windows, macOS (Apple silicon and Intel disk images in the v1.0.7 assets), and Linux (AppImage). That is the download path. The README also documents a source quick start (npm install, npm run dev) that connects to Eigent cloud and needs an account, and points standalone use at a separate local-deployment guide (local backend, local models, "complete isolation from cloud services"). The product site repeats local execution or self-hosting, with bring-your-own keys.

Shell sandbox and approval. SECURITY.md on main (opened raw): the local permission policy, approval records, Git previews, and audit trail "are not an operating-system sandbox." If an agent can run an arbitrary shell as the same OS user as Eigent, that is full access to that user's files and processes. Dangerous or destructive Git operations require user review. The product site says approvals stay visible and waiting, including after an interruption, and that the agent browser is limited to targets you approve.

The exact default permission mode (the name of the starting profile) was not on an official page opened for this note. UNVERIFIED. A third-party safety write-up was not used as the source for that default.

Models. The README says model-agnostic: cloud APIs, enterprise gateways, or local inference. Docs pages opened (models overview, provider reference, local-model, self-hosting) list Ollama (http://localhost:11434/v1), vLLM (http://localhost:8000/v1), SGLang (http://localhost:30000/v1), LM Studio (http://localhost:1234/v1), and llama.cpp (http://localhost:8080/v1), plus bring-your-own-key with an API key, endpoint, and model name. At least one valid model is required before a task starts. The cloud quick start is a different path and uses Eigent's service.

Phone, messaging, schedule. The app is a desktop program. The product site's remote-control line says you can check progress and respond from the browser or from channels such as WhatsApp. How you connect WhatsApp was not on a setup page opened here: the channel is named on the marketing site, and the setup steps are UNVERIFIED. Automations run on a schedule, event, or condition. v1.0.7 notes also mention a Remote Control page.

Why a non-coder might pick it. It is a downloadable desktop app for Windows and Mac, with a workspace, a schedule, and your own model key or a local model, rather than a repo you compile. Main catch. The one-command source preview uses Eigent's cloud and an account. The project's security policy says approvals do not put the shell in an OS sandbox. The starting approval mode was not confirmed from an official page.

Everfern

What it is. A desktop agent that the README says drives your computer (clicks, typing, apps) and can also use a built-in browser agent called Navis. Repo: https://github.com/Everfern-AI/Everfern. Site: https://everfern.app. GitHub API description matches the README: a free open-source agent that runs on your machine and handles general tasks. It is a real repository (created 2026-04-11T08:20:45Z, pushed_at 2026-11-09T13:12:38Z). It is a small project next to the others in this note.

Latest version. GitHub latest-release API: tag v1.3.0, name "Everfern Desktop 1.3.0", published_at 2026-09-22T12:18:23Z. Assets include EverFern.Setup.1.3.0.exe, EverFern-1.3.0-arm64.dmg, EverFern-1.3.0-x64.dmg, EverFern-1.3.0.AppImage, a .deb, and an .rpm.

Stars. GitHub API stargazers_count: 101 (updated_at 2026-11-13T13:45:34Z). forks_count 12. open_issues_count 2.

Windows and macOS. Desktop installers exist for Windows, macOS (Apple silicon and Intel dmgs in v1.3.0), and Linux. The README also says you can clone and run npm install then npm run dev with Node.js 18+ on macOS, Windows 10/11, or Linux. An older DEV Community post (author dated May, year not on the excerpt) said the macOS installer was not ready. That post is older than the 22 September 2026 release, which includes Mac disk images. The release assets are the later source.

Shell sandbox and approval. The README states three related things: every shell command runs in an isolated Linux VM; the app pauses for confirmation before anything destructive; newly written tools wait for a human-approval step before they activate. Computer use is described as seeing the screen and driving real apps, which is the actual desktop, not the VM. The source tree was not audited to confirm the VM is what ships. Treat the sandbox sentence as a README claim.

Models. README: fully offline with Ollama or LM Studio, or connect to OpenAI, Anthropic, DeepSeek, Gemini, OpenRouter, Nvidia NIM, Mistral, Groq, "and more." A custom base URL field was not in the README opened. UNVERIFIED.

Phone, messaging, schedule. Desktop app (Electron, in the README architecture diagram). No phone or chat-app channel was in the README. The README does say you can chain actions and schedule them.

Why a non-coder might pick it. A free desktop download that claims to click your apps for you and to keep shell commands in a Linux VM, with a local model if you have Ollama or LM Studio. Main catch. The community is tiny (101 stars on the day checked), the latest desktop release is 22 September 2026, and the safety claims are the project's README, not something verified in the code for this note. Clicking your real apps is still clicking your real apps.

Also seen

These four names showed up in 2026 roundup pages opened while searching. One sentence each, from a page opened on 2026-11-14. They are not scored below.

ZeroClaw (https://github.com/zeroclaw-labs/zeroclaw, raw README on master): ZeroClaw is a single Rust binary you configure and run; it talks to Anthropic, OpenAI, Ollama, and about twenty other providers, reaches you through 30+ channels, and its default autonomy is supervised (medium-risk actions need approval, high-risk actions are blocked). The same README says the license is MIT or Apache-2.0, your choice, and warns that other "ZeroClaw" repos and domains are not this project.
Moltis (https://docs.moltis.org/, opened 2026-11-14): Moltis is a Rust personal-agent server shipped as one binary, with commands run in Docker or Apple Container sandboxes, and with a web UI, Telegram, and Discord. The docs call it alpha and say the license is MIT.
Nanobot (https://github.com/HKUDS/nanobot, raw README on main): Nanobot is an ultra-lightweight open-source personal AI agent framework in Python that you use in a browser, a terminal, or a chat app, with files, memory, and scheduled tasks, and with a model provider or a local model server. The README's "latest release" line on that fetch said v0.4.0. A roundup page quoted v0.4.1; that second version was not confirmed on the README, so it stays UNVERIFIED.
OpenHands (https://github.com/OpenHands/OpenHands, raw README on main): OpenHands Agent Canvas is a self-hosted control center for coding agents and automations; it runs on your machine by default and can also use Docker, a VM, or a cloud backend, including third-party agents such as Claude Code and Codex. The same README's first install option is explicitly unsandboxed and warns that the agent then has full access to the filesystem; Docker is a separate option. The Docker example on that page is pinned to image tag 1.40.0.

Scorecard facts

Facts only, for the two projects the guide asked to score. No points were assigned.

NanoClaw

Capability. A personal agent you message: memory per group, web access, scheduled jobs, and tools inside a container. Channels are skills you add. It is not a double-click desktop coworker that drives the apps on your screen.
Install friction. High for someone who does not use a terminal. macOS and Linux need git plus a script that installs Node and Docker. Windows needs WSL2 first, then the same script inside Linux. Quick start says to plan 30–60 minutes. Official pages disagree on whether the prebuilt container image (and a free NanoClaw account) is the default or an opt-in.
Safety default. The shell is in Docker by default, with a tight mount list and no raw API keys in the container. Ordinary commands inside that container do not each wait for approval. Egress lockdown is off by default. New chats, and an agent widening its own container, do wait for a person.
Model flexibility. Claude is the path setup is built around (subscription or API key). Codex, OpenCode (including a local OpenAI-compatible endpoint and several API keys), and Cursor are add-ons. A custom Anthropic-compatible base URL is a documented .env setting. The skill that makes Ollama the agent's brain is documented as out of date on current main.
Phone and schedule continuity. This is the center of the product. Many chat apps, a local CLI, and scheduled tasks, with a login service on macOS and a user service on Linux so it keeps running.

Atomic Agent

Capability. A general agent on the machine you are sitting at: browser, files, shell, documents, memory, MCP, and schedules, from a terminal UI, a CLI, a local HTTP API, or a desktop app. The project's own GAIA Level 1 write-up is 37/53 on one local model; that number is theirs.
Install friction. Lower than a from-source agent. One shell command on macOS, Linux, or Windows, with prebuilt archives, plus a separate desktop app. Still a developer preview (v0.7.0, 9 November 2026). No Intel Mac prebuilt; the README says Intel Macs are not supported yet, while the install doc mentions a source build as the Intel fallback.
Safety default. Asks first. Approval level 1 is the default, so gated actions wait for a yes, with a short list of harmless commands that skip the prompt and a hard block on a few catastrophic ones. The docs say this is not a sandbox: the command runs as you. Web and HTTP tools are allowed out without a prompt unless you change that setting.
Model flexibility. Wide, and local is the default. llama.cpp on the machine, no key. Optional cloud providers, Ollama, LM Studio, Claude Code or Codex subscriptions, and a custom base URL or external llama-server URL.
Phone and schedule continuity. Schedules, reminders, and an overnight run are built in. Overnight denies anything that still needs a yes, unless you turn approval off for that run. Telegram and Discord can drive it from a phone, including approval buttons, but both start off and Telegram is one owner only. An ignored Telegram approval becomes a no after 8 minutes.

Sources

Opened 2026-11-14 unless noted. GitHub API responses are the star counts and release timestamps above.

NanoClaw

https://api.github.com/repos/nanocoai/nanoclaw
https://api.github.com/repos/nanocoai/nanoclaw/releases/latest
https://raw.githubusercontent.com/nanocoai/nanoclaw/main/README.md
https://docs.nanoclaw.dev/installation
https://docs.nanoclaw.dev/quickstart
https://docs.nanoclaw.dev/concepts/security
https://docs.nanoclaw.dev/extend/providers
https://github.com/nanocoai/nanoclaw/blob/HEAD/CHANGELOG.md (changelog text; stable 2026.10.0 vs beta 2026.11.0-beta.2)
https://nanoclaw.dev/ (rounded star line only)

Atomic Agent

QwenPaw

OpenManus

Eigent

Everfern

https://api.github.com/repos/Everfern-AI/Everfern
https://api.github.com/repos/Everfern-AI/Everfern/releases/latest
https://raw.githubusercontent.com/Everfern-AI/Everfern/main/README.md
https://everfern.app/ (marketing page; not used for install facts where the release assets are clearer)

Also seen

Roundup pages were used only to notice the names, not for the sentences above: