{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "nanobot", "name": "nanobot", "vendor": "HKUDS", "vendorUrl": "https://nanobot.wiki", "kind": "harness", "category": "personal-assistants", "summary": "nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.", "url": "https://www.anchorterminal.com/tools/nanobot", "markdownUrl": "https://www.anchorterminal.com/tools/nanobot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanobot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanobot.json", "repo": "https://github.com/HKUDS/nanobot", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "nanobot-ai" } ], "auth": "none", "authNotes": "No account with the project. The owner supplies model provider keys or an OAuth sign-in, and bot tokens or mailbox passwords for each channel, in `~/.nanobot/config.json`. The WebUI on localhost needs no password, and binding to all interfaces requires a token.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays the model provider, or nothing with a local model. The optional Render deployment needs a paid Render service.", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 49000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://nanobot.wiki/docs/latest/getting-started/nanobot-overview", "llmsTxt": "https://nanobot.wiki/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "mit", "llms-txt", "docker", "alpha" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 446, "ranked": true, "rankOf": 986, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 48 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the local-software lines, as for goose and Khoj. `nanobot-ai` installs from PyPI with pip, uv or pipx for Python 3.11 or newer, with platform wheels for macOS 13+, glibc 2.17+ Linux and Windows x64 (20). The Test Suite workflow runs on pushes to main, the repository holds 381 test files, and the three most recent runs on main shown on 12 October 2026 passed (25). 214 open issues and 614 open pull requests. Recent reports mostly carry replies or labels, but a P1 report that the agent loops on sudo (#5924, 26 September) and a compaction deadlock (#5849, 21 September) are open (15 of 25). The v0.3.5 and v0.3.0 release notes carry upgrade notes, and v0.3.5 names a required email setting change, but the project is on 0.x with post-releases and one advisory names a patched version, 0.1.5.post4, that has no tag (10 of 15). Version 0.3.5 with the classifier Development Status 3, Alpha (0)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "Harness reading of the framework line, as for goose. Configuration is documented in tables with defaults, tools take JSON Schema parameters in the source and the Python SDK and the three OpenAI-compatible routes are documented, but no OpenAPI file was found (15 of 25). llms.txt at nanobot.wiki (10). The security and configuration pages say what each setting guards and what it does not, such as that neither sandbox restricts the network (15 of 20). Pydantic settings and typed tool schemas (11 of 15). Per-channel guides, a provider cookbook and a troubleshooting page with symptom and fix tables (13 of 15). Dated release notes with upgrade notes on GitHub, a release archive and versioned docs, with no changelog file (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "Harness reading, scored on what an agent or script driving it has to supply. About 25 built-in tools, an `enabledTools` filter per MCP server, skills loaded on demand and automatic context compaction (19 of 25). A 60-second default shell timeout, truncated tool output, a 30-second MCP call timeout and a cap of 6 sends a minute per session (15 of 20). `nanobot -m` for one request, an OpenAI-compatible API with streaming and a Python SDK, with errors covered by a troubleshooting page and no documented exit codes or JSON output mode (15 of 20). Sessions resume, interrupted work recovers and model fallbacks are configurable (15 of 20). One command starts it and setup continues in the browser, a model provider must be configured first, and the SDK is Python only (10 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 63, "points": 11.03, "reason": "Harness reading used for goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.3.5, the WebUI binds to localhost, the API refuses to bind to all interfaces without a key and channels deny unknown senders, but keys sit in clear text in `config.json` unless written as `${VAR}`, and the docs carry no statement that nothing is collected (24). No per-action approval step was found. The shell tool is on, `restrictToWorkspace` is false and the sandbox is empty by default, the `bwrap` and `seatbelt` backends limit files and not the network, and Windows has none (9). Web content is labelled as data in tool results and in the system prompt, email needs SPF and DKIM results from a named receiver, and an SSRF guard covers web fetch and HTTP MCP. The email and SSRF guards each followed a published advisory (10). Gateway logs, a WebUI activity timeline with diffs, Git-versioned memory and trigger run records, while SECURITY.md lists limited security event logging as a known limitation (8). SECURITY.md with private reporting and a 48-hour target and five advisories published with fixes, four with a CVE. No bounty, and no security.txt on nanobot.wiki (12)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama, vLLM or LM Studio and needs no sign-up. The Render blueprint is a third party's paid hosting and is not scored." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 82, "points": 7.18, "reason": "v0.3.5 was released on 15 September 2026, 27 days before this check (30). Two tagged releases in the last 90 days, v0.3.0 on 25 July and v0.3.5 on 15 September. The README's Recent Updates list has five dated entries in September, which we counted as dated changelog entries, a judgement call (20). The last commit on main is from 12 October 2026 and recent issues draw replies, against 214 open issues and 614 open pull requests (14 of 25). A Python SDK, platform wheels and a Dockerfile ship from the same repository. Not an MCP server, so the registry line does not apply (11 of 15). Dependencies carry version bounds and CI passes on main. No Dependabot configuration was found (7 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 48, "points": 4.2, "note": "editorial 69, provenance 27", "reason": "MIT (30). There is no privacy policy and none is needed for a hosted service, since there is none. SECURITY.md says model providers see prompts, chat history is stored locally and keys are in plain text, and the docs name where sessions, memory and OAuth tokens are stored. Nothing states what the skills marketplace sends to skills.sh and skillhub.cn (16 of 30). Deprecated flags and fields are marked in the docs and release notes carry migration steps. No deprecation policy (9 of 20). No telemetry was found in the source and Langfuse tracing is off until configured, but the docs do not state that nothing is collected (14 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading, scored on what an agent or script driving it has to supply. About 25 built-in tools, an `enabledTools` filter per MCP server, skills loaded on demand and automatic context compaction (19 of 25). A 60-second default shell timeout, truncated tool output, a 30-second MCP call timeout and a cap of 6 sends a minute per session (15 of 20). `nanobot -m` for one request, an OpenAI-compatible API with streaming and a Python SDK, with errors covered by a troubleshooting page and no documented exit codes or JSON output mode (15 of 20). Sessions resume, interrupted work recovers and model fallbacks are configurable (15 of 20). One command starts it and setup continues in the browser, a model provider must be configured first, and the SDK is Python only (10 of 15).", "maintenance": "v0.3.5 was released on 15 September 2026, 27 days before this check (30). Two tagged releases in the last 90 days, v0.3.0 on 25 July and v0.3.5 on 15 September. The README's Recent Updates list has five dated entries in September, which we counted as dated changelog entries, a judgement call (20). The last commit on main is from 12 October 2026 and recent issues draw replies, against 214 open issues and 614 open pull requests (14 of 25). A Python SDK, platform wheels and a Dockerfile ship from the same repository. Not an MCP server, so the registry line does not apply (11 of 15). Dependencies carry version bounds and CI passes on main. No Dependabot configuration was found (7 of 10).", "payments": "Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama, vLLM or LM Studio and needs no sign-up. The Render blueprint is a third party's paid hosting and is not scored.", "reliability": "Read with the local-software lines, as for goose and Khoj. `nanobot-ai` installs from PyPI with pip, uv or pipx for Python 3.11 or newer, with platform wheels for macOS 13+, glibc 2.17+ Linux and Windows x64 (20). The Test Suite workflow runs on pushes to main, the repository holds 381 test files, and the three most recent runs on main shown on 12 October 2026 passed (25). 214 open issues and 614 open pull requests. Recent reports mostly carry replies or labels, but a P1 report that the agent loops on sudo (#5924, 26 September) and a compaction deadlock (#5849, 21 September) are open (15 of 25). The v0.3.5 and v0.3.0 release notes carry upgrade notes, and v0.3.5 names a required email setting change, but the project is on 0.x with post-releases and one advisory names a patched version, 0.1.5.post4, that has no tag (10 of 15). Version 0.3.5 with the classifier Development Status 3, Alpha (0).", "schema": "Harness reading of the framework line, as for goose. Configuration is documented in tables with defaults, tools take JSON Schema parameters in the source and the Python SDK and the three OpenAI-compatible routes are documented, but no OpenAPI file was found (15 of 25). llms.txt at nanobot.wiki (10). The security and configuration pages say what each setting guards and what it does not, such as that neither sandbox restricts the network (15 of 20). Pydantic settings and typed tool schemas (11 of 15). Per-channel guides, a provider cookbook and a troubleshooting page with symptom and fix tables (13 of 15). Dated release notes with upgrade notes on GitHub, a release archive and versioned docs, with no changelog file (13 of 15).", "security": "Harness reading used for goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.3.5, the WebUI binds to localhost, the API refuses to bind to all interfaces without a key and channels deny unknown senders, but keys sit in clear text in `config.json` unless written as `${VAR}`, and the docs carry no statement that nothing is collected (24). No per-action approval step was found. The shell tool is on, `restrictToWorkspace` is false and the sandbox is empty by default, the `bwrap` and `seatbelt` backends limit files and not the network, and Windows has none (9). Web content is labelled as data in tool results and in the system prompt, email needs SPF and DKIM results from a named receiver, and an SSRF guard covers web fetch and HTTP MCP. The email and SSRF guards each followed a published advisory (10). Gateway logs, a WebUI activity timeline with diffs, Git-versioned memory and trigger run records, while SECURITY.md lists limited security event logging as a known limitation (8). SECURITY.md with private reporting and a 48-hour target and five advisories published with fixes, four with a CVE. No bounty, and no security.txt on nanobot.wiki (12).", "transparency": "MIT (30). There is no privacy policy and none is needed for a hosted service, since there is none. SECURITY.md says model providers see prompts, chat history is stored locally and keys are in plain text, and the docs name where sessions, memory and OAuth tokens are stored. Nothing states what the skills marketplace sends to skills.sh and skillhub.cn (16 of 30). Deprecated flags and fields are marked in the docs and release notes carry migration steps. No deprecation policy (9 of 20). No telemetry was found in the source and Langfuse tracing is off until configured, but the docs do not state that nothing is collected (14 of 20)." }, "sources": [ { "what": "repository page, stars, open issues and pull requests", "url": "https://github.com/HKUDS/nanobot", "seen": "2026-10-12" }, { "what": "README, pyproject.toml, SECURITY.md and docs/ read from a shallow clone at commit 105b772 of 12 October 2026, and checked against the v0.3.5 tag", "url": "https://github.com/HKUDS/nanobot", "seen": "2026-10-12" }, { "what": "security policy and known limitations", "url": "https://github.com/HKUDS/nanobot/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "published security advisories", "url": "https://github.com/HKUDS/nanobot/security/advisories", "seen": "2026-10-12" }, { "what": "SSRF advisory", "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m", "seen": "2026-10-12" }, { "what": "email prompt-injection advisory", "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "seen": "2026-10-12" }, { "what": "allowlist bypass advisory", "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-g6cf-xjwr-pm77", "seen": "2026-10-12" }, { "what": "WhatsApp bridge advisories", "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-v5j3-4q66-58cf", "seen": "2026-10-12" }, { "what": "WhatsApp file name advisory", "url": "https://github.com/HKUDS/nanobot/security/advisories/GHSA-3f63-vcp3-hvqr", "seen": "2026-10-12" }, { "what": "releases and upgrade notes", "url": "https://github.com/HKUDS/nanobot/releases", "seen": "2026-10-12" }, { "what": "open issues", "url": "https://github.com/HKUDS/nanobot/issues", "seen": "2026-10-12" }, { "what": "CI runs", "url": "https://github.com/HKUDS/nanobot/actions/workflows/ci.yml", "seen": "2026-10-12" }, { "what": "configuration, security defaults, MCP, pairing and heartbeat", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/configuration.md", "seen": "2026-10-12" }, { "what": "memory design and commands", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/memory.md", "seen": "2026-10-12" }, { "what": "automations", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/automations.md", "seen": "2026-10-12" }, { "what": "channels", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/chat-apps.md", "seen": "2026-10-12" }, { "what": "email channel guide", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/guides/email-ai-agent.md", "seen": "2026-10-12" }, { "what": "WebUI, access modes and Apps", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/webui.md", "seen": "2026-10-12" }, { "what": "OpenAI-compatible API", "url": "https://github.com/HKUDS/nanobot/blob/main/docs/openai-api.md", "seen": "2026-10-12" }, { "what": "project site home page", "url": "https://nanobot.wiki/", "seen": "2026-10-12" }, { "what": "llms.txt", "url": "https://nanobot.wiki/llms.txt", "seen": "2026-10-12" }, { "what": "robots.txt, which allows every path", "url": "https://nanobot.wiki/robots.txt", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is `harness`. nanobot is a self-hosted agent program the owner runs, which is closest to the harnesses the briefs define, and it was graded with the local-software Reliability lines, the harness reading of Schema, Ergonomics and Security, and the self-hosted Payments rule.", "No per-action approval step was found in the docs or by searching the source for approval and confirmation hooks. It was not run, so this rests on reading.", "The repository docs describe main, which is ahead of v0.3.5. The settings the scores rest on (sandbox backends, `trustedAuthservIds`, `maxSessionMessagesPerMinute`, heartbeat, `auth/mcp.json`) were confirmed in the docs at the v0.3.5 tag.", "The three-releases line was awarded on five dated entries in the README's Recent Updates list. Counting tagged releases only (two) would lower Maintenance by 20.", "GHSA-3f63-vcp3-hvqr names 0.1.5.post4 as the patched version, and the repository has no tag of that name. Which release carries the fix was not established.", "No statement on telemetry was found in the docs. None was found in the source, which is a reading of the code and not a network trace.", "No legal entity was established. The lead's vendor, HKUDS, is a GitHub organisation.", "unchecked: PyPI release dates and download counts, because PyPI's robots.txt disallows `/pypi/`. The release date is from the GitHub release.", "unchecked: the registration date of nanobot.wiki.", "unchecked: the exact star count. The repository page showed 49k on 12 October 2026, which agrees with the lead's 48,968.", "unchecked: the stable docs pages on nanobot.wiki, which were not read. The repository's docs/ were read in their place.", "unchecked: what the WebUI skills marketplace sends to skills.sh and skillhub.cn." ] }, "negative": -6, "negativeNotes": [ "2026-09-02. GHSA-vc5v-6vwm-wf9m (critical, 9.3, no CVE). Web fetch did not block internal addresses, so cloud metadata and internal services could be read without authentication in versions before 0.3.0. Fixed in 0.3.0 of 25 July and published, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m", "2026-03-27. GHSA-4gmr-2vc8-7qh3 (CVE-2026-33654, high). A spoofed email could inject instructions through email polling with no user action, up to command execution, in 0.1.4.post5 and earlier. Fixed in 0.1.4.post6 and published, more than six months ago, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "2026-03-11. GHSA-g6cf-xjwr-pm77 (CVE-2026-31977, critical, 9.0). A sender ID containing `|` passed the `allowFrom` check in versions before 0.1.4.post4. Fixed and published, more than six months ago, -1. https://github.com/HKUDS/nanobot/security/advisories/GHSA-g6cf-xjwr-pm77", "2026-04-14 and 2026-05-24. GHSA-v5j3-4q66-58cf (CVE-2026-35589, high, 8.0), cross-site WebSocket hijacking of the WhatsApp bridge, fixed in 0.1.5, and GHSA-3f63-vcp3-hvqr (CVE-2026-48716, high, 8.7), file write through a WhatsApp document name. Both fixed and published, -1 together. https://github.com/HKUDS/nanobot/security/advisories" ], "verdict": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5", "Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back", "Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves", "Email requires SPF and DKIM results from a named receiving service since v0.3.5, and mailbox access stays off until `consentGranted` is set", "Optional `bwrap` (Linux) and `seatbelt` (macOS) sandboxes for shell commands, and an SSRF guard on web fetches and HTTP MCP connections" ], "weaknesses": [ "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none", "Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch", "SECURITY.md lists plain-text API keys in `config.json`, no rate limiting and limited security event logging as known limitations", "Version 0.3.5 with an Alpha classifier, 214 open issues and 614 open pull requests on 12 October 2026" ], "agentNotes": [ "Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default", "Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)", "Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing", "Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text", "Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 69 }, "provenanceScore": 27 }, "connect": { "install": "python -m pip install nanobot-ai # or: uv tool install nanobot-ai # then: nanobot webui", "headless": { "command": "nanobot -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanobot" }, "notable": [ "Five published security advisories, 11 March to 2 September 2026, two critical and three high, each with a patched version (https://github.com/HKUDS/nanobot/security/advisories)", "GHSA-vc5v-6vwm-wf9m, published 2 September 2026, critical 9.3. Web fetch could reach internal addresses and cloud metadata without authentication in versions before 0.3.0 (https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m)", "GHSA-4gmr-2vc8-7qh3 (CVE-2026-33654), published 27 March 2026. A spoofed email could inject instructions through email polling in 0.1.4.post5 and earlier (https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3)", "SECURITY.md lists known limitations, among them plain-text keys in `config.json`, no rate limiting and limited security event logging (https://github.com/HKUDS/nanobot/blob/main/SECURITY.md)", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty, and neither sandbox backend restricts network access (https://github.com/HKUDS/nanobot/blob/main/docs/configuration.md)", "A heartbeat job runs every 1800 seconds by default under `nanobot gateway` and acts on tasks in `HEARTBEAT.md` (https://github.com/HKUDS/nanobot/blob/main/docs/configuration.md)", "The README carries affiliate links to two model vendors under Open Source Partners (https://github.com/HKUDS/nanobot)" ], "area": "frameworks", "details": [ { "label": "Where it runs", "value": "The owner's machine or server. PyPI package `nanobot-ai` for Python 3.11 or newer, a Docker image built from the repository, and a Render blueprint. No hosted service from the project was found" }, { "label": "Acts without asking", "value": "No per-action approval step found in the docs or source at v0.3.5. Shell (`exec`), file edits, `message` sends, web fetch and MCP tools run when the model calls them. A deny list blocks patterns such as `rm -rf` and `mkfs`" }, { "label": "Controls", "value": "`tools.exec.enable` false removes the shell tool. `tools.restrictToWorkspace` (default false). `tools.exec.sandbox` `bwrap` or `seatbelt` (default empty, filesystem only, no network limit). Restricted or Full Access per WebUI chat. `tools.maxSessionMessagesPerMinute` 6" }, { "label": "Proactive work", "value": "Scheduled automations from the `cron` tool, local triggers (`nanobot trigger`), and a heartbeat that reads `HEARTBEAT.md` every 1800 seconds by default and reports only useful results" }, { "label": "Channels", "value": "WebUI, terminal, Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Microsoft Teams (DM only), Mattermost, Email (IMAP and SMTP), Linear, Feishu, DingTalk, WeChat, WeCom, QQ, Napcat and Mochat" }, { "label": "Who can message it", "value": "Per-channel `allowFrom`. Empty denies everyone since v0.1.4.post4, and unknown senders get a pairing code the owner approves with `/pairing approve`. Slack and Mattermost DMs are open by default" }, { "label": "Accounts and credentials", "value": "Bot tokens and IMAP and SMTP passwords in `~/.nanobot/config.json`, in clear text unless written as `${VAR}`. MCP OAuth tokens in `auth/mcp.json` in the data directory, removed when the server is removed. WhatsApp session in `~/.nanobot/whatsapp-auth`" }, { "label": "Memory", "value": "`USER.md`, `SOUL.md` and `memory/MEMORY.md` in the workspace (default `~/.nanobot/workspace/`), rewritten by the Dream job every 2 hours by default and versioned with Git. Summaries in `memory/history.jsonl`, sessions in `~/.nanobot/sessions/\u003cworkspace-id\u003e/`" }, { "label": "Deleting memory", "value": "Files on the owner's disk, edited or removed by the owner. `/dream-restore \u003csha\u003e` rolls memory back. The WebUI deletes topics. `history.jsonl` is append-only and earlier versions stay in the workspace Git history. No one-step erase command was found" }, { "label": "Model providers", "value": "The owner's choice. Anthropic, OpenAI, OpenRouter, AWS Bedrock, OAuth sign-ins for OpenAI Codex, xAI Grok and GitHub Copilot, any OpenAI-compatible endpoint, or local models through Ollama, vLLM or LM Studio. Prompts go to the chosen provider" }, { "label": "Other outbound traffic", "value": "Web search uses DuckDuckGo by default with no key. The WebUI skills marketplace queries skills.sh and skillhub.cn. Langfuse tracing only when its environment variables are set" }, { "label": "MCP client", "value": "stdio, streamable HTTP and SSE, static headers or OAuth, `enabledTools` filter per server, presets such as Notion, Linear and Xmind" }, { "label": "Interfaces for other programs", "value": "`nanobot -m` one-shot, a Python SDK, and an OpenAI-compatible API (`/v1/chat/completions`, `/v1/models`, `/health`) on 127.0.0.1:8900, which needs `api.apiKey` when bound to all interfaces" }, { "label": "Cost", "value": "Free. The owner pays the model provider, or nothing with a local model. The Render blueprint needs a paid Render service for its persistent disk" }, { "label": "Releases", "value": "v0.3.5 on 15 September 2026 and v0.3.0 on 25 July 2026. Last commit on main 12 October 2026" } ], "provenance": { "legalEntity": "", "domain": "nanobot.wiki", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/HKUDS/nanobot/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No legal entity is named. The repository belongs to the GitHub organisation HKUDS, which a published advisory title calls the Hong Kong University Data Intelligence Lab. pyproject.toml names Xubin Ren and the nanobot contributors as authors.", "nanobot.wiki has no terms or privacy page linked from its home page or llms.txt, and `/.well-known/security.txt` answered with the site's not-found page on 12 October 2026.", "SECURITY.md in the repository asks for reports through a private GitHub advisory or by email and aims to respond within 48 hours.", "There is no hosted endpoint. A gateway answers on its owner's own host." ], "score": 27, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "nanobot.wiki, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanobot.json" } }