{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "nanoclaw", "name": "NanoClaw", "vendor": "NanoCo, Inc.", "vendorUrl": "https://nanoclaw.dev", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.", "url": "https://www.anchorterminal.com/tools/nanoclaw", "markdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanoclaw.json", "repo": "https://github.com/nanocoai/nanoclaw", "license": "MIT", "transports": [], "packages": [], "auth": "none", "authNotes": "No account is needed to run it. Owners and admins are rows in a local `user_roles` table, and strangers are handled by each chat's `unknown_sender_policy` (https://docs.nanoclaw.dev/concepts/security). Model and service credentials are registered with a credential gateway on the host, OneCLI Agent Vault by default, which adds them to outbound HTTPS requests. Containers receive placeholders such as `onecli-managed` (https://docs.nanoclaw.dev/operate/credentials). Channel tokens stay in the host's `.env`. An optional free NanoClaw account, used for a prebuilt agent image and a managed Slack app, keeps its token in `~/.config/nanoclaw/account.json` with mode 0600 (https://github.com/nanocoai/nanoclaw/blob/main/README.md).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing on sale. The optional NanoClaw account, the Echo image and the managed Slack app are free of charge per the terms of 31 July 2026 (https://nanoclaw.dev/terms). The owner pays the model provider through a Claude subscription, an API key or another provider, and any service a channel or tool uses, such as Dial. Since 2.4.0 Claude groups default to Opus 5.5 (checked 2026-10-12).", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 30929, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.nanoclaw.dev", "llmsTxt": "https://docs.nanoclaw.dev/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "tags": [ "open-source", "local", "free", "no-card", "docker", "llms-txt" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 68.3, "grade": "B", "agentReady": false, "rank": 229, "ranked": true, "rankOf": 986, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 65 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 78, "points": 15.6, "reason": "Read as software the owner runs. Installed by `git clone` and `bash nanoclaw.sh`, with no registry package. macOS, Linux and WSL2 with Docker are stated, but the home page says Node.js 20 or later and the README and `package.json` say 22 or later (13). The CI workflow runs formatting, type checks and host and container tests on Node 22 and 24, and the 14 completed runs on main from 5 to 11 October 2026 all passed (25). 294 open issues and 750 open pull requests on 12 October 2026, and 10 of the 12 newest open issues had no reply, among them a report that updates do not rebuild per-group images (12). The changelog marks breaking changes and opens each release with steps to take before updating, and versions moved from 2.4.0 to calendar numbering on 9 October 2026 (13). Version 2 since 22 April 2026, with stable, beta and edge update channels (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Harness reading, as for the agent programs we list. No HTTP API and no OpenAPI file. The docs carry references for the nine built-in MCP tools, the `ncl` CLI, the database schema, container configuration and the template format, and the tools declare JSON Schema inputs in the source (17). llms.txt at docs.nanoclaw.dev with a Markdown twin of every page (10). The security page says what each layer stops and lists four things it does not, and the hardening page gives the default of each setting (17). Tool parameters are tabled with types and required flags, and sender policies are a fixed set of four values, though message content is free text (11). Step-by-step guides and a troubleshooting page, with no error reference found (12). A dated CHANGELOG.md, mirrored on the docs site, and a written release process (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "Harness reading, scored on what an owner or pipeline driving it has to supply. The built-in MCP server has nine tools beside 16 allowed Claude Code tools, and the two memory files loaded into each new context are capped at 16,000 characters each (21). A 2,048 process limit is on by default, CPU and memory limits are unset, and no spending or turn cap was found (11). The `ncl` CLI and a local CLI channel work over a Unix socket, with no HTTP interface (12). Sessions, approvals and delivery retries persist in SQLite across host restarts, and the updater takes a snapshot and rolls back on failure (18). One script installs it, but it needs Docker, Node and a Claude or Codex credential, channel skills need Claude Code, and changing behaviour means editing a fork. No SDK (8)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 74, "points": 12.95, "reason": "Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Setup events go to PostHog under a random install id unless `NANOCLAW_NO_DIAGNOSTICS=1` is set, which the README discloses, and no runtime telemetry was found in the host or container source. Message content goes to the model provider chosen (22). Sessions run in non-root containers with all capabilities dropped, extra mounts are denied without an allowlist, and API keys stay in a gateway on the host. Self-modification, new chats and `ncl` writes wait for an admin. But the Claude provider runs with permission prompts off, sending to wired chats needs no approval, per-request credential approval is opt-in and egress lockdown is off by default (15). The security page assumes injection succeeds and lists what a manipulated agent can still do. Sender policies and a command gate limit who can reach an agent, and no content screening was found (13). A dropped-messages log, an approvals list, task run logs and session history through `ncl`, and gateway activity in the OneCLI dashboard (11). SECURITY.md with private reporting, fixes credited to reporters in the changelog, signed image verification and pinned Actions in CI. The eight advisories the 9 October changelog links were not public on 12 October, and there is no security.txt and no bounty (13)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "No payment protocol (0). Free under the MIT licence with nothing to buy, so the self-hosted rule gives 20, 20 and 20 on the last three lines. The optional account is free. The owner still needs a model credential, or a local model through the Ollama provider skill." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "reason": "2026.10.0 on 9 October 2026 (30). Five stable releases in the 90 days to 12 October, from 2.1.54 to 2026.10.0, and two release candidates (20). Reported security flaws were fixed and credited, but 294 issues and 750 pull requests were open, and 10 of the 12 newest open issues had no reply (11). No registry package. Channels and providers ship from registry branches through skills, and a prebuilt agent image is pinned by digest and checked with cosign in CI (8). CI on Node 22 and 24 with frozen lockfiles, Actions pinned to commit hashes and a three-day release-age gate on dependencies, which the 2.4.0 notes say had been ignored until 23 September 2026 (9)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "note": "editorial 77, provenance 53", "reason": "MIT (30). The README has a section on what leaves the machine, and the privacy policy describes the optional account in detail, with IP addresses cut to a /24 network. The policy says it does not cover the software and says NanoClaw does not report back, without mentioning the setup events sent to PostHog, and gives no retention period for them (19). Breaking changes are marked with migration steps and a written release process, with no stated notice period (13). Setup diagnostics are disclosed in the README with an opt-out variable, and are on by default (15)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading, scored on what an owner or pipeline driving it has to supply. The built-in MCP server has nine tools beside 16 allowed Claude Code tools, and the two memory files loaded into each new context are capped at 16,000 characters each (21). A 2,048 process limit is on by default, CPU and memory limits are unset, and no spending or turn cap was found (11). The `ncl` CLI and a local CLI channel work over a Unix socket, with no HTTP interface (12). Sessions, approvals and delivery retries persist in SQLite across host restarts, and the updater takes a snapshot and rolls back on failure (18). One script installs it, but it needs Docker, Node and a Claude or Codex credential, channel skills need Claude Code, and changing behaviour means editing a fork. No SDK (8).", "maintenance": "2026.10.0 on 9 October 2026 (30). Five stable releases in the 90 days to 12 October, from 2.1.54 to 2026.10.0, and two release candidates (20). Reported security flaws were fixed and credited, but 294 issues and 750 pull requests were open, and 10 of the 12 newest open issues had no reply (11). No registry package. Channels and providers ship from registry branches through skills, and a prebuilt agent image is pinned by digest and checked with cosign in CI (8). CI on Node 22 and 24 with frozen lockfiles, Actions pinned to commit hashes and a three-day release-age gate on dependencies, which the 2.4.0 notes say had been ignored until 23 September 2026 (9).", "payments": "No payment protocol (0). Free under the MIT licence with nothing to buy, so the self-hosted rule gives 20, 20 and 20 on the last three lines. The optional account is free. The owner still needs a model credential, or a local model through the Ollama provider skill.", "reliability": "Read as software the owner runs. Installed by `git clone` and `bash nanoclaw.sh`, with no registry package. macOS, Linux and WSL2 with Docker are stated, but the home page says Node.js 20 or later and the README and `package.json` say 22 or later (13). The CI workflow runs formatting, type checks and host and container tests on Node 22 and 24, and the 14 completed runs on main from 5 to 11 October 2026 all passed (25). 294 open issues and 750 open pull requests on 12 October 2026, and 10 of the 12 newest open issues had no reply, among them a report that updates do not rebuild per-group images (12). The changelog marks breaking changes and opens each release with steps to take before updating, and versions moved from 2.4.0 to calendar numbering on 9 October 2026 (13). Version 2 since 22 April 2026, with stable, beta and edge update channels (15).", "schema": "Harness reading, as for the agent programs we list. No HTTP API and no OpenAPI file. The docs carry references for the nine built-in MCP tools, the `ncl` CLI, the database schema, container configuration and the template format, and the tools declare JSON Schema inputs in the source (17). llms.txt at docs.nanoclaw.dev with a Markdown twin of every page (10). The security page says what each layer stops and lists four things it does not, and the hardening page gives the default of each setting (17). Tool parameters are tabled with types and required flags, and sender policies are a fixed set of four values, though message content is free text (11). Step-by-step guides and a troubleshooting page, with no error reference found (12). A dated CHANGELOG.md, mirrored on the docs site, and a written release process (15).", "security": "Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Setup events go to PostHog under a random install id unless `NANOCLAW_NO_DIAGNOSTICS=1` is set, which the README discloses, and no runtime telemetry was found in the host or container source. Message content goes to the model provider chosen (22). Sessions run in non-root containers with all capabilities dropped, extra mounts are denied without an allowlist, and API keys stay in a gateway on the host. Self-modification, new chats and `ncl` writes wait for an admin. But the Claude provider runs with permission prompts off, sending to wired chats needs no approval, per-request credential approval is opt-in and egress lockdown is off by default (15). The security page assumes injection succeeds and lists what a manipulated agent can still do. Sender policies and a command gate limit who can reach an agent, and no content screening was found (13). A dropped-messages log, an approvals list, task run logs and session history through `ncl`, and gateway activity in the OneCLI dashboard (11). SECURITY.md with private reporting, fixes credited to reporters in the changelog, signed image verification and pinned Actions in CI. The eight advisories the 9 October changelog links were not public on 12 October, and there is no security.txt and no bounty (13).", "transparency": "MIT (30). The README has a section on what leaves the machine, and the privacy policy describes the optional account in detail, with IP addresses cut to a /24 network. The policy says it does not cover the software and says NanoClaw does not report back, without mentioning the setup events sent to PostHog, and gives no retention period for them (19). Breaking changes are marked with migration steps and a written release process, with no stated notice period (13). Setup diagnostics are disclosed in the README with an opt-out variable, and are on by default (15)." }, "sources": [ { "what": "repository README", "url": "https://github.com/nanocoai/nanoclaw/blob/main/README.md", "seen": "2026-10-12" }, { "what": "changelog", "url": "https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md", "seen": "2026-10-12" }, { "what": "security model (repository copy)", "url": "https://github.com/nanocoai/nanoclaw/blob/main/docs/SECURITY.md", "seen": "2026-10-12" }, { "what": "security policy", "url": "https://github.com/nanocoai/nanoclaw/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "Claude provider execution policy", "url": "https://github.com/nanocoai/nanoclaw/blob/main/container/agent-runner/src/providers/claude-config.ts", "seen": "2026-10-12" }, { "what": "built-in MCP tools (source)", "url": "https://github.com/nanocoai/nanoclaw/blob/main/container/agent-runner/src/mcp-tools/core.ts", "seen": "2026-10-12" }, { "what": "setup diagnostics emitter", "url": "https://github.com/nanocoai/nanoclaw/blob/main/setup/lib/diagnostics.ts", "seen": "2026-10-12" }, { "what": "memory docs (repository)", "url": "https://github.com/nanocoai/nanoclaw/blob/main/docs/memory.md", "seen": "2026-10-12" }, { "what": "scheduled tasks docs (repository)", "url": "https://github.com/nanocoai/nanoclaw/blob/main/docs/scheduled-tasks.md", "seen": "2026-10-12" }, { "what": "hardened image docs (repository)", "url": "https://github.com/nanocoai/nanoclaw/blob/main/docs/hardened-image.md", "seen": "2026-10-12" }, { "what": "CI workflow", "url": "https://github.com/nanocoai/nanoclaw/blob/main/.github/workflows/ci.yml", "seen": "2026-10-12" }, { "what": "release process", "url": "https://github.com/nanocoai/nanoclaw/blob/main/RELEASING.md", "seen": "2026-10-12" }, { "what": "pnpm supply-chain settings", "url": "https://github.com/nanocoai/nanoclaw/blob/main/pnpm-workspace.yaml", "seen": "2026-10-12" }, { "what": "published advisories page (none listed)", "url": "https://github.com/nanocoai/nanoclaw/security/advisories", "seen": "2026-10-12" }, { "what": "advisory linked from the changelog (404)", "url": "https://github.com/nanocoai/nanoclaw/security/advisories/GHSA-frvf-5rf5-89fq", "seen": "2026-10-12" }, { "what": "GitHub API, repository record (stars, licence, open count)", "url": "https://api.github.com/repos/nanocoai/nanoclaw", "seen": "2026-10-12" }, { "what": "GitHub API, repository advisories (empty list)", "url": "https://api.github.com/repos/nanocoai/nanoclaw/security-advisories", "seen": "2026-10-12" }, { "what": "GitHub API, newest open issues", "url": "https://api.github.com/repos/nanocoai/nanoclaw/issues?state=open\u0026per_page=50\u0026sort=created\u0026direction=desc", "seen": "2026-10-12" }, { "what": "GitHub API, CI runs on main", "url": "https://api.github.com/repos/nanocoai/nanoclaw/actions/workflows/ci.yml/runs?branch=main\u0026per_page=15", "seen": "2026-10-12" }, { "what": "GitHub API, releases", "url": "https://api.github.com/repos/nanocoai/nanoclaw/releases?per_page=20", "seen": "2026-10-12" }, { "what": "home page", "url": "https://nanoclaw.dev/", "seen": "2026-10-12" }, { "what": "terms of service, 31 July 2026", "url": "https://nanoclaw.dev/terms", "seen": "2026-10-12" }, { "what": "privacy policy, 31 July 2026", "url": "https://nanoclaw.dev/privacy", "seen": "2026-10-12" }, { "what": "security.txt (404)", "url": "https://nanoclaw.dev/.well-known/security.txt", "seen": "2026-10-12" }, { "what": "docs index for agents", "url": "https://docs.nanoclaw.dev/llms.txt", "seen": "2026-10-12" }, { "what": "docs, security model", "url": "https://docs.nanoclaw.dev/concepts/security", "seen": "2026-10-12" }, { "what": "docs, credentials", "url": "https://docs.nanoclaw.dev/operate/credentials", "seen": "2026-10-12" }, { "what": "docs, hardening", "url": "https://docs.nanoclaw.dev/operate/hardening", "seen": "2026-10-12" }, { "what": "docs, agent MCP tools", "url": "https://docs.nanoclaw.dev/reference/mcp-tools", "seen": "2026-10-12" }, { "what": "docs, tools and the Gmail note", "url": "https://docs.nanoclaw.dev/extend/tools", "seen": "2026-10-12" }, { "what": "docs, agent providers", "url": "https://docs.nanoclaw.dev/extend/providers", "seen": "2026-10-12" }, { "what": "docs, uninstall", "url": "https://docs.nanoclaw.dev/operate/uninstall", "seen": "2026-10-12" }, { "what": "docs, release history", "url": "https://docs.nanoclaw.dev/changelog/index", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is recorded as harness, the closest kind the briefs define for an agent program the owner runs. NanoClaw has no HTTP API and is not an MCP server", "`assistant.accounts` is claimed on the credential gateway, which holds API keys and OAuth connections per agent group. Trunk has no first-party mail or calendar integration, so a stricter reading would drop it", "Why the eight advisories linked from the 2026.10.0 changelog were not public three days after the release. They may be unpublished drafts", "Whether setup shows a consent prompt for diagnostics. We found only the `NANOCLAW_NO_DIAGNOSTICS` check in the setup scripts, and the README calls the diagnostics anonymous", "What the OneCLI gateway flaw fixed in 1.42.0 allowed. The changelog calls it a credential-injection bypass and we did not read OneCLI's own notes", "unchecked: how the OneCLI Agent Vault stores secrets at rest. We read NanoClaw's docs and not OneCLI's", "unchecked: portal.nanoclaw.dev, nanoco.ai, the blog and the registration date of nanoclaw.dev", "unchecked: what a month of use costs. No figure is published and no model provider's price page was read", "unchecked: reply times on issues beyond the 50 newest open items, and the state of the channels and providers branches", "The first-release date was not established. The repository was created on 31 January 2026 and the changelog's version 2.0.0 is dated 22 April 2026", "github.com's robots.txt closes tree, tags and commit pages to Anthropic agents, so the source was read from a shallow clone and blob pages, and release dates from the API. api.github.com answered 404 for robots.txt, read as no rules" ] }, "negative": -5, "negativeNotes": [ "2026-10-09. Release 2026.10.0 fixed four symlink flaws through which a manipulated agent could make the host read, write or delete files outside its folders, plus an admin-command bypass, a cross-group read through `ncl` and a command injection in Mattermost setup. Fixed and described in the changelog within the week, but the advisories it links (GHSA-frvf-5rf5-89fq and seven others) were not public on 12 October 2026. -5. https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md" ], "verdict": "Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.", "bestFor": "A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.", "strengths": [ "Each session runs in a non-root Docker container with all capabilities dropped, and the project root and `.env` are never mounted", "API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders", "Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial", "Memory is plain Markdown under `groups/\u003cfolder\u003e/memory/`, which the owner can read, edit or delete on the host", "The security page states what the design does not stop, including messages to wired chats and spending through granted credentials" ], "weaknesses": [ "The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt", "Egress lockdown is off by default, so a container can reach the internet directly unless `NANOCLAW_EGRESS_LOCKDOWN=true` is set", "The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404", "Setup sends events to PostHog unless `NANOCLAW_NO_DIAGNOSTICS=1` is set, and the privacy policy does not mention them", "The docs say trunk has no Gmail or Google Calendar integration, while the GitHub repository description still names Gmail", "294 open issues and 750 open pull requests on 12 October 2026, and 10 of the 12 newest open issues had no reply" ], "agentNotes": [ "Install with `git clone` and `bash nanoclaw.sh`. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential", "Set `NANOCLAW_EGRESS_LOCKDOWN=true` before giving an agent credentials or an audience of strangers. The default leaves egress open", "Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree", "Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured", "On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.3 } ], "editorialScores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 77 }, "provenanceScore": 53 }, "connect": { "install": "git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2 \u0026\u0026 cd nanoclaw-v2 \u0026\u0026 bash nanoclaw.sh" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanoclaw" }, "notable": [ "The Claude provider sets `permissionMode: 'bypassPermissions'` and `allowDangerouslySkipPermissions: true`, with a source comment that container isolation and the gateway allowlist are the boundary, not the SDK's prompts (https://github.com/nanocoai/nanoclaw/blob/main/container/agent-runner/src/providers/claude-config.ts)", "The security page assumes prompt injection succeeds and lists what a manipulated agent can still do. It can message anyone in its destinations, read and destroy its group workspace, spend through granted credentials and write to its own memory (https://docs.nanoclaw.dev/concepts/security)", "Egress lockdown is off by default. With `NANOCLAW_EGRESS_LOCKDOWN=true` containers join an internal Docker network where the gateway is the only reachable hop (https://github.com/nanocoai/nanoclaw/blob/main/docs/SECURITY.md)", "Release 2026.10.0 of 9 October 2026 fixed four symlink flaws that let a manipulated agent make the host read, write or delete files outside its folders, an admin-command bypass, a cross-group read through `ncl`, a command injection in Mattermost setup and an installer fetched without HTTPS (https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md)", "That changelog links eight advisories under nanocoai/nanoclaw. On 12 October 2026 the repository's advisories page read that there are no published security advisories, GitHub's API listed none, and GHSA-frvf-5rf5-89fq returned 404 (https://github.com/nanocoai/nanoclaw/security/advisories)", "The same release tells OneCLI installs to move the gateway to 1.42.0, which the changelog says closes a credential-injection bypass. `/update-nanoclaw` does not upgrade a running gateway (https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md)", "Setup posts events such as `setup_start`, `channel_chosen` and `agent_provider_chosen` to us.i.posthog.com under a random install id unless `NANOCLAW_NO_DIAGNOSTICS=1` is set. No PostHog call was found in `src/` or `container/` (https://github.com/nanocoai/nanoclaw/blob/main/setup/lib/diagnostics.ts)", "The README says agents, messages, files and keys never leave the machine and names setup diagnostics as the only thing reported. It ends with a tracking pixel from static.scarf.sh (https://github.com/nanocoai/nanoclaw/blob/main/README.md)", "The terms of 31 July 2026 say they govern the website and the optional account, not the software, and the privacy policy says it does not cover the software. Neither mentions setup diagnostics (https://nanoclaw.dev/terms; https://nanoclaw.dev/privacy)", "The docs say trunk has no Gmail or Google Calendar integration, after `/add-gmail-tool` and `/add-gcal-tool` were removed. The GitHub repository description still lists Gmail (https://docs.nanoclaw.dev/extend/tools)", "A free NanoClaw account is optional. It is used to fetch a prebuilt agent image built by Echo and to have NanoCo create a Slack app per agent, and NanoCo then stores the Slack workspace authorisation, encrypted (https://nanoclaw.dev/privacy)", "Since 2.4.0 of 23 September 2026, Claude groups with no model set run on Opus 5.5, which the changelog says changes cost and usage-limit burn (https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md)", "The 2.4.0 notes say pnpm's three-day `minimumReleaseAge` gate had been silently ignored because of where the setting sat, and takes effect from that release (https://github.com/nanocoai/nanoclaw/blob/main/pnpm-workspace.yaml)", "The home page banner says NanoCo raised $12M. The site states Node.js 20 or later, while the README and `package.json` state Node 22 or later (https://nanoclaw.dev/)" ], "area": "frameworks", "details": [ { "label": "Runs on", "value": "The owner's macOS or Linux machine, or Windows through WSL2. One Node host process and one Docker container per active session. Installed by `git clone` and `bash nanoclaw.sh`" }, { "label": "Acts without asking", "value": "Inside its container the agent runs shell, file, web and browser tools with permission prompts off. It can send messages and files to any chat or agent its group is wired to, and call any API its group was granted a credential for, unless that secret is set to need approval" }, { "label": "Needs approval", "value": "Installing apt or npm packages, adding an MCP server, `ncl` writes from inside a container, creating an agent (unless the group has global CLI scope), admitting a new chat or unknown sender, and credential use where the secret is set to manual approval. No reachable approver means denial" }, { "label": "Accounts and credentials", "value": "No first-party Gmail or Google Calendar integration on trunk. API keys and OAuth connections are stored in a credential gateway on the host (OneCLI Agent Vault by default, Iron Proxy as the alternative) and granted per agent group. Channel tokens such as `TELEGRAM_BOT_TOKEN` stay in the host's `.env`" }, { "label": "Memory", "value": "Markdown files in `groups/\u003cfolder\u003e/memory/`, shared by every session of an agent group. Two files, each capped at 16,000 characters, are loaded into every new context window. Session history is in SQLite under `data/v2-sessions/`" }, { "label": "Deletion", "value": "Edit or delete memory files on the host. `bash nanoclaw.sh --uninstall` removes the service, data and agents' files in three groups, each asked separately with No as the default, and leaves the shared gateway and its credentials in place" }, { "label": "Models", "value": "Claude through the Claude Agent SDK by default, with a subscription token or an API key. Codex, OpenCode (OpenRouter, OpenAI, Google, DeepSeek and others) and Ollama through skills, set per agent group. Message content goes to the provider chosen" }, { "label": "Channels", "value": "A local CLI channel on trunk. WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Microsoft Teams, Mattermost, Matrix, Google Chat, Webex, WeChat, Linear, GitHub, Delta Chat, email through Resend, and SMS and voice through Dial, each installed by an `/add-\u003cchannel\u003e` skill" }, { "label": "Scheduled tasks", "value": "`ncl tasks create` with a cron expression or a one-time timestamp. A task runs an agent prompt in its own session, and a script gate can skip a run with nothing to do" }, { "label": "MCP client", "value": "stdio and remote Streamable HTTP servers per agent group, added by `ncl groups config add-mcp-server` or by the agent's `add_mcp_server` request, which needs approval. The built-in `nanoclaw` server has nine tools" }, { "label": "Sandbox", "value": "Non-root container, `--cap-drop=ALL`, `no-new-privileges`, a 2,048 process limit, and extra mounts refused unless listed in `~/.config/nanoclaw/mount-allowlist.json`. CPU and memory limits are unset by default" }, { "label": "Telemetry", "value": "Setup events go to PostHog under a random install id. `NANOCLAW_NO_DIAGNOSTICS=1` turns them off. No runtime telemetry was found in the host or container source" }, { "label": "Releases in 90 days", "value": "5 stable (2.1.54 on 1 August to 2026.10.0 on 9 October 2026) and 2 release candidates" }, { "label": "Cost", "value": "Free under the MIT licence. The owner pays the model provider, and any third-party service a channel or tool uses. No monthly figure is published" } ], "provenance": { "legalEntity": "NanoCo, Inc.", "domain": "nanoclaw.dev", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The terms and privacy policy at nanoclaw.dev name NanoCo, Inc. and Delaware law. Both say they cover the website and the optional account, not the software, so neither is linked and the MIT licence stands in.", "nanoclaw.dev/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md points to GitHub private vulnerability reporting.", "There is no hosted endpoint. The assistant runs on the owner's machine, and the optional account service is at portal.nanoclaw.dev, which we did not open.", "The registration date of nanoclaw.dev was not checked." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "NanoCo, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "nanoclaw.dev, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanoclaw.json" } }