{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "picoclaw", "name": "PicoClaw", "vendor": "Sipeed", "vendorUrl": "https://picoclaw.io", "kind": "harness", "category": "personal-assistants", "summary": "PicoClaw is an open-source personal AI assistant from Sipeed, a single Go binary for small Linux boards, desktops and Android, reached through chat apps. Its last commit on the main branch was on 19 August 2026.", "url": "https://www.anchorterminal.com/tools/picoclaw", "markdownUrl": "https://www.anchorterminal.com/tools/picoclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/picoclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/picoclaw.json", "repo": "https://github.com/sipeed/picoclaw", "license": "MIT", "transports": [], "packages": [ { "registry": "oci", "name": "docker.io/sipeed/picoclaw" }, { "registry": "oci", "name": "ghcr.io/sipeed/picoclaw" } ], "auth": "none", "authNotes": "No account with Sipeed. The owner supplies model provider keys, chat bot tokens and search keys, kept in `~/.picoclaw/.security.yml`. The web launcher asks for a password set on first run, stored as a bcrypt hash. Each channel's `allow_from` list decides who may talk to the assistant, and an empty list admits everyone.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays their model provider by usage, or nothing with a local model through Ollama or vLLM. Search keys are optional, and DuckDuckGo search needs none.", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, docs or source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 30000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.picoclaw.io", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "go", "docker", "pre-1.0" ], "lastRelease": "2026-07-03", "graded": true, "anchor": { "graded": true, "score": 46.1, "grade": "D", "agentReady": false, "rank": 879, "ranked": true, "rankOf": 986, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 22, "payments": 60, "reliability": 54, "schema": 51, "security": 51, "transparency": 56 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 54, "points": 10.8, "reason": "Read with the local-software lines, as software the owner runs. Release binaries on GitHub and picoclaw.io for the stated architectures, Docker images on Docker Hub and GHCR, and Go 1.25 or later for source builds, but no package-manager install (18 of 20). The build workflow runs Docker-backed integration tests and a full build on every push to main, and the ten most recent runs passed. Lint, tests and govulncheck run on pull requests. Nothing has run on main since 19 August 2026 (22 of 25). 32 open issues on 12 October 2026, a count the stale bot keeps low by closing reports after 14 days without activity. Reports of 11 October that a Telegram channel stops receiving for good (#3422) and that failed cron jobs report ok (#3423) have no maintainer reply (8 of 25). Release notes on GitHub for each version and a documented config-version migration, with no breaking-change sections, and the site changelog stops at v0.2.9 (6 of 15). Version 0.3.1, and the README says not to deploy to production before v1.0 (0 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 51, "points": 8.29, "reason": "Harness reading of the framework line, scored on docs a model can follow. No machine-readable contract for the gateway or launcher API. The config file is documented field by field with types and defaults, config versions are documented, and the hook protocol (JSON-RPC over stdio) has its own reference (12 of 25). No llms.txt. docs.picoclaw.io/llms.txt answered 404 and picoclaw.io/llms.txt 403 (0 of 10). The exec, cron and sandbox pages say what each switch is for, give recommended settings by scenario and state known limits, such as the exec guard not inspecting child processes (12 of 20). Config tables carry types, defaults and allowed values, and the cron tool's actions and fields are listed (9 of 15). Many config examples, sample error lines and a troubleshooting page (10 of 15). Release notes per version on GitHub, but the site changelog stops at v0.2.9, and two docs pages disagree on a security default and on the passphrase variable's name (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "Harness reading, scored on what the owner or a driving agent has to supply. 22 built-in tools by our count of the source, several off by default, with search-based discovery for MCP tools, a per-agent tool allowlist and a per-request `turn_profile` that can trim tools, skills and history (20 of 25). `read_file` caps at 65,536 bytes, MCP text results above a set length are saved as files, exec times out at 60 seconds, and a per-model `rpm` limit throttles calls. No spending cap or turn limit was found in the docs read (14 of 20). `picoclaw agent -m` runs one prompt from the command line. No structured output mode is documented (10 of 20). Sessions persist and resume, a fallback chain moves to another model after a 429, and several keys per model rotate on failure (14 of 20). One binary and a web launcher for setup, no SDK, and the shipped defaults let remote chats run shell commands (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 51, "points": 8.93, "reason": "Harness reading of the framework checklist, as the Goose and OpenHands dossiers use. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. We found no telemetry or analytics code in the source. Content goes to the model provider the owner configures, DuckDuckGo search and the ClawHub skill registry are on by default, and no page states a no-telemetry policy (26). File tools are held to the workspace by default and cron command jobs from remote chats need an allowlist entry. There is no human approval step, `tools.exec.allow_remote` ships as `true`, an empty `allow_from` admits anyone, child-process isolation is off by default, and the exec deny list does not see child processes (8). Credentials are filtered from tool output and web tools have an SSRF guard, but the roadmap lists prompt-injection defence as future work and no guidance was found (5). Gateway logs, session history files, runtime events and observer hooks, with no audit trail designed for review (9). No SECURITY.md, private vulnerability reporting is off and a request of 28 September 2026 to enable it has only a stale-bot reply, no security.txt, no bounty, and no advisory published by the project while 15 CVEs are listed against it. govulncheck runs on pull requests and Dependabot is configured (3)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama or vLLM and DuckDuckGo search with no sign-up. Model usage is billed by whichever provider the owner picks." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 22, "points": 1.93, "reason": "v0.3.1 was published on 3 July 2026, 101 days before this check (10 of 30). No release in the last 90 days (0 of 20). The last commit on main is of 19 August 2026, after 32 commits in July and 268 in June. Issues and pull requests opened since late September carry only stale-bot replies, 17 pull requests are open, and an issue of 6 October 2026 calling the repository unmaintained has no answer (3 of 25). Not an MCP server and no SDK. Binaries, Docker images and an Android APK ship from the release workflow (4 of 15). Dependabot is configured and a 23 July commit updated Go for govulncheck, CI passed on its last run, and nothing has been merged since 19 August (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "note": "editorial 58, provenance 53", "reason": "MIT, with the full source public (30). No privacy policy or terms on picoclaw.io, the docs site or the repository. The site says conversation history and configuration stay on the device and that model providers receive what is sent to them, and the docs name the files where sessions, memory and jobs are kept. No retention or deletion statement beyond that (10 of 30). Undated deprecation notes in the docs (the legacy `tools.skills.github` block, the terminal launcher) and a config migration guide, with no policy and no statement on the project's status since August (6 of 20). We found no telemetry in the source, which is the best case for local software, but no page says so and the README's update and skill-registry calls are not described as network activity (12 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading, scored on what the owner or a driving agent has to supply. 22 built-in tools by our count of the source, several off by default, with search-based discovery for MCP tools, a per-agent tool allowlist and a per-request `turn_profile` that can trim tools, skills and history (20 of 25). `read_file` caps at 65,536 bytes, MCP text results above a set length are saved as files, exec times out at 60 seconds, and a per-model `rpm` limit throttles calls. No spending cap or turn limit was found in the docs read (14 of 20). `picoclaw agent -m` runs one prompt from the command line. No structured output mode is documented (10 of 20). Sessions persist and resume, a fallback chain moves to another model after a 429, and several keys per model rotate on failure (14 of 20). One binary and a web launcher for setup, no SDK, and the shipped defaults let remote chats run shell commands (8 of 15).", "maintenance": "v0.3.1 was published on 3 July 2026, 101 days before this check (10 of 30). No release in the last 90 days (0 of 20). The last commit on main is of 19 August 2026, after 32 commits in July and 268 in June. Issues and pull requests opened since late September carry only stale-bot replies, 17 pull requests are open, and an issue of 6 October 2026 calling the repository unmaintained has no answer (3 of 25). Not an MCP server and no SDK. Binaries, Docker images and an Android APK ship from the release workflow (4 of 15). Dependabot is configured and a 23 July commit updated Go for govulncheck, CI passed on its last run, and nothing has been merged since 19 August (5 of 10).", "payments": "Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama or vLLM and DuckDuckGo search with no sign-up. Model usage is billed by whichever provider the owner picks.", "reliability": "Read with the local-software lines, as software the owner runs. Release binaries on GitHub and picoclaw.io for the stated architectures, Docker images on Docker Hub and GHCR, and Go 1.25 or later for source builds, but no package-manager install (18 of 20). The build workflow runs Docker-backed integration tests and a full build on every push to main, and the ten most recent runs passed. Lint, tests and govulncheck run on pull requests. Nothing has run on main since 19 August 2026 (22 of 25). 32 open issues on 12 October 2026, a count the stale bot keeps low by closing reports after 14 days without activity. Reports of 11 October that a Telegram channel stops receiving for good (#3422) and that failed cron jobs report ok (#3423) have no maintainer reply (8 of 25). Release notes on GitHub for each version and a documented config-version migration, with no breaking-change sections, and the site changelog stops at v0.2.9 (6 of 15). Version 0.3.1, and the README says not to deploy to production before v1.0 (0 of 15).", "schema": "Harness reading of the framework line, scored on docs a model can follow. No machine-readable contract for the gateway or launcher API. The config file is documented field by field with types and defaults, config versions are documented, and the hook protocol (JSON-RPC over stdio) has its own reference (12 of 25). No llms.txt. docs.picoclaw.io/llms.txt answered 404 and picoclaw.io/llms.txt 403 (0 of 10). The exec, cron and sandbox pages say what each switch is for, give recommended settings by scenario and state known limits, such as the exec guard not inspecting child processes (12 of 20). Config tables carry types, defaults and allowed values, and the cron tool's actions and fields are listed (9 of 15). Many config examples, sample error lines and a troubleshooting page (10 of 15). Release notes per version on GitHub, but the site changelog stops at v0.2.9, and two docs pages disagree on a security default and on the passphrase variable's name (8 of 15).", "security": "Harness reading of the framework checklist, as the Goose and OpenHands dossiers use. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. We found no telemetry or analytics code in the source. Content goes to the model provider the owner configures, DuckDuckGo search and the ClawHub skill registry are on by default, and no page states a no-telemetry policy (26). File tools are held to the workspace by default and cron command jobs from remote chats need an allowlist entry. There is no human approval step, `tools.exec.allow_remote` ships as `true`, an empty `allow_from` admits anyone, child-process isolation is off by default, and the exec deny list does not see child processes (8). Credentials are filtered from tool output and web tools have an SSRF guard, but the roadmap lists prompt-injection defence as future work and no guidance was found (5). Gateway logs, session history files, runtime events and observer hooks, with no audit trail designed for review (9). No SECURITY.md, private vulnerability reporting is off and a request of 28 September 2026 to enable it has only a stale-bot reply, no security.txt, no bounty, and no advisory published by the project while 15 CVEs are listed against it. govulncheck runs on pull requests and Dependabot is configured (3).", "transparency": "MIT, with the full source public (30). No privacy policy or terms on picoclaw.io, the docs site or the repository. The site says conversation history and configuration stay on the device and that model providers receive what is sent to them, and the docs name the files where sessions, memory and jobs are kept. No retention or deletion statement beyond that (10 of 30). Undated deprecation notes in the docs (the legacy `tools.skills.github` block, the terminal launcher) and a config migration guide, with no policy and no statement on the project's status since August (6 of 20). We found no telemetry in the source, which is the best case for local software, but no page says so and the README's update and skill-registry calls are not described as network activity (12 of 20)." }, "sources": [ { "what": "repository page and README", "url": "https://github.com/sipeed/picoclaw", "seen": "2026-10-12" }, { "what": "git history, tags, source and docs, shallow clone", "url": "https://github.com/sipeed/picoclaw", "seen": "2026-10-12" }, { "what": "releases", "url": "https://github.com/sipeed/picoclaw/releases", "seen": "2026-10-12" }, { "what": "repository security advisories (none published)", "url": "https://github.com/sipeed/picoclaw/security/advisories", "seen": "2026-10-12" }, { "what": "security policy page (none set up)", "url": "https://github.com/sipeed/picoclaw/security/policy", "seen": "2026-10-12" }, { "what": "GitHub Advisory Database search for picoclaw", "url": "https://github.com/advisories?query=picoclaw", "seen": "2026-10-12" }, { "what": "CVE-2026-36045", "url": "https://github.com/advisories/GHSA-cv2p-68f4-f4pw", "seen": "2026-10-12" }, { "what": "CVE-2026-6987", "url": "https://github.com/advisories/GHSA-6r3x-h84w-fhxx", "seen": "2026-10-12" }, { "what": "CVE-2026-16083", "url": "https://github.com/advisories/GHSA-mhxf-xvw6-4qw2", "seen": "2026-10-12" }, { "what": "CVE-2026-15319", "url": "https://github.com/advisories/GHSA-f9rq-5867-x4mq", "seen": "2026-10-12" }, { "what": "open issues", "url": "https://github.com/sipeed/picoclaw/issues", "seen": "2026-10-12" }, { "what": "issue #3417, fork and maintenance notice", "url": "https://github.com/sipeed/picoclaw/issues/3417", "seen": "2026-10-12" }, { "what": "issue #3405, private vulnerability reporting request", "url": "https://github.com/sipeed/picoclaw/issues/3405", "seen": "2026-10-12" }, { "what": "open pull requests", "url": "https://github.com/sipeed/picoclaw/pulls", "seen": "2026-10-12" }, { "what": "build workflow runs", "url": "https://github.com/sipeed/picoclaw/actions/workflows/build.yml", "seen": "2026-10-12" }, { "what": "configuration guide (workspace, sandbox, exec, heartbeat)", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/guides/configuration.md", "seen": "2026-10-12" }, { "what": "tools configuration reference", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/reference/tools_configuration.md", "seen": "2026-10-12" }, { "what": "cron reference", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/reference/cron.md", "seen": "2026-10-12" }, { "what": "security configuration (.security.yml)", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/security/security_configuration.md", "seen": "2026-10-12" }, { "what": "credential encryption", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/security/credential_encryption.md", "seen": "2026-10-12" }, { "what": "sensitive data filtering", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/security/sensitive_data_filtering.md", "seen": "2026-10-12" }, { "what": "hooks guide", "url": "https://github.com/sipeed/picoclaw/blob/main/docs/architecture/hooks/README.md", "seen": "2026-10-12" }, { "what": "isolation package README", "url": "https://github.com/sipeed/picoclaw/blob/main/pkg/isolation/README.md", "seen": "2026-10-12" }, { "what": "default config values", "url": "https://github.com/sipeed/picoclaw/blob/main/pkg/config/defaults.go", "seen": "2026-10-12" }, { "what": "exec tool remote gate", "url": "https://github.com/sipeed/picoclaw/blob/main/pkg/tools/shell.go", "seen": "2026-10-12" }, { "what": "channel allowlist check", "url": "https://github.com/sipeed/picoclaw/blob/main/pkg/channels/base.go", "seen": "2026-10-12" }, { "what": "stale workflow", "url": "https://github.com/sipeed/picoclaw/blob/main/.github/workflows/stale.yml", "seen": "2026-10-12" }, { "what": "site home page", "url": "https://picoclaw.io/", "seen": "2026-10-12" }, { "what": "site changelog", "url": "https://picoclaw.io/changelog/", "seen": "2026-10-12" }, { "what": "download page", "url": "https://picoclaw.io/download/", "seen": "2026-10-12" }, { "what": "docs, security sandbox", "url": "https://docs.picoclaw.io/docs/configuration/security-sandbox/", "seen": "2026-10-12" }, { "what": "docs, command execution settings", "url": "https://docs.picoclaw.io/docs/configuration/exec/", "seen": "2026-10-12" }, { "what": "docs, getting started", "url": "https://docs.picoclaw.io/docs/getting-started/", "seen": "2026-10-12" } ], "openQuestions": [ "Kind. Recorded as `harness`, the closest kind the briefs define for a self-hosted agent program. The category is personal-assistants and the product calls itself a personal AI assistant", "Capabilities. `assistant.accounts` is not claimed. PicoClaw has no built-in connector for mail, calendar or file storage, and reaches them only through MCP servers the owner adds", "Whether Sipeed still maintains PicoClaw. No statement either way was found, only the gap since 19 August 2026, the reverted PicoPaw README banners (added 16 June, reverted 22 July) and the unanswered fork notice", "Unchecked: 11 of the 15 advisories in the GitHub Advisory Database were read only as list entries, and which of them are fixed in v0.3.1 was not established. nvd.nist.gov answered 403 to the robots.txt request, so NVD was not read", "Unchecked: GHSA-pv8c-p6jf-3fpp, an advisory id named in a source comment in pkg/tools/shell.go, is not on the repository's public advisories page", "Unchecked: the star count is the rounded figure on the repository page (30k). The GitHub API was not called", "Unchecked: the v0.3.1 release page answered 504, so its asset list and notes were read only from the releases index", "Unchecked: the legal entity behind Sipeed and the registration date of picoclaw.io. sipeed.com was not read", "Unchecked: whether any telemetry exists outside the Go source we searched, such as in the Android APK, which is not in this repository", "The lead was right on vendor, licence and that it is a self-hosted assistant. It did not mention that development has stopped since August or the 15 listed CVEs", "robots.txt answers. github.com 200 (repository pages allowed, tree, commits and tags paths read from a clone instead), picoclaw.io 200 allow all, docs.picoclaw.io 404 read as no rules, nvd.nist.gov 403 from a bot check and left unread" ] }, "negative": -7, "negativeNotes": [ "2026-04-25 to 2026-07-19. 15 advisories are listed for PicoClaw in the GitHub Advisory Database. Two are reviewed, CVE-2026-36045 (high, 7.3, command injection past the exec deny list, 0.1.2 and earlier) and CVE-2026-6987 (moderate, injection through the launcher's `/api/gateway/restart`, 0.2.4 and earlier), and 13 unreviewed entries of 10 to 19 July name versions up to 0.2.9. None lists a patched version, the project has published no advisory of its own, and it has no security policy. We read four of the fifteen. Several concern old versions and some fixes are in the git history, so -5. https://github.com/advisories?query=picoclaw", "Current behaviour, checked 2026-10-12. The repository's configuration guide says `tools.exec.allow_remote` defaults to `false`. The source at v0.3.1 and on main sets it to `true`, and the docs site calls fully open the default, so a remote chat can run shell commands on a default install. A misleading claim on a security default, the minimum, -2. https://github.com/sipeed/picoclaw/blob/main/docs/guides/configuration.md; https://github.com/sipeed/picoclaw/blob/main/pkg/config/defaults.go" ], "verdict": "Self-hosted under the MIT licence, with 19 documented chat channels, scheduled and heartbeat tasks, and local file memory. The repository has had no commit since 19 August 2026 and no release since 3 July, and 15 CVEs are listed against it with no advisory or security policy from the project.", "bestFor": "A person who wants a chat-app assistant on a cheap Linux board, an old Android phone or a home server, with reminders, web search and file memory, and who accepts running software its maker calls pre-production.", "strengths": [ "MIT licence, one Go binary for x86-64, ARM, RISC-V, MIPS and LoongArch, with Docker images and an Android APK", "Conversations, memory, scheduled jobs and credentials stay in files under `~/.picoclaw` on the owner's device", "File tools are limited to the workspace by default, and command jobs scheduled from remote chats are refused unless the chat is listed", "MCP client over stdio, SSE and HTTP, with optional search-based tool discovery to keep definitions out of context", "Credentials sit in a separate `.security.yml` with optional AES-256-GCM encryption, and are filtered from tool output before the model sees it" ], "weaknesses": [ "No commit on main since 19 August 2026 and no release since v0.3.1 on 3 July 2026. An issue of 6 October calls the repository unmaintained, with no reply", "15 CVEs are listed in the GitHub Advisory Database (25 April to 19 July 2026). The project has published no advisory and has no SECURITY.md", "No human approval step. The agent sends messages, writes files and runs shell commands without asking, and the hooks guide says waiting for a human reply is not supported", "Shell execution from remote chats is on by default in the source and on the docs site, while the repository's configuration guide says the default is off", "An empty `allow_from` list lets anyone who can message the bot use it, with only a warning in the log" ], "agentNotes": [ "Set `allow_from` to the owner's user ID on every channel before starting the gateway. An empty list accepts messages from anyone", "Set `tools.exec.allow_remote` to `false` unless chats must run shell commands. The shipped default is `true`, whatever docs/guides/configuration.md says", "Set `isolation.enabled` to `true` on Linux (needs `bwrap`) or run in a container. The deny patterns do not inspect child processes", "Use `PICOCLAW_KEY_PASSPHRASE` for credential encryption. One docs page names `PICOCLAW_CREDENTIAL_PASSPHRASE`, which the source does not read", "Treat the README's ClawdChat line (read a remote skill file and follow it) as untrusted third-party instructions" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.1 } ], "editorialScores": { "ergonomics": 66, "maintenance": 22, "payments": 60, "reliability": 54, "schema": 51, "security": 51, "transparency": 58 }, "provenanceScore": 53 }, "connect": { "install": "git clone https://github.com/sipeed/picoclaw.git \u0026\u0026 cd picoclaw \u0026\u0026 docker compose -f docker/docker-compose.yml --profile launcher up # or download a binary from https://picoclaw.io/download/ and run: picoclaw onboard", "headless": { "command": "picoclaw agent -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/picoclaw" }, "notable": [ "Self-described as an ultra-lightweight personal AI assistant written in Go, started by Sipeed and released on 9 February 2026 (https://github.com/sipeed/picoclaw)", "The README says PicoClaw is in early development, may have unresolved security issues, and should not be deployed to production before v1.0 (https://github.com/sipeed/picoclaw)", "Last commit on main is of 19 August 2026 (#3200). Monthly commits fell from 268 in June to 32 in July and 1 in August (git history of https://github.com/sipeed/picoclaw, cloned 12 October 2026)", "Latest release is v0.3.1, published 3 July 2026. The site changelog at picoclaw.io stops at v0.2.9 (https://github.com/sipeed/picoclaw/releases; https://picoclaw.io/changelog/)", "Issue #3417 of 6 October 2026, from an outside user, says the repository appears unmaintained and announces a fork. No reply from a maintainer (https://github.com/sipeed/picoclaw/issues/3417)", "15 advisories are listed for PicoClaw in the GitHub Advisory Database, dated 25 April to 19 July 2026, two reviewed and 13 unreviewed. The repository's own advisories page shows none (https://github.com/advisories?query=picoclaw; https://github.com/sipeed/picoclaw/security/advisories)", "CVE-2026-36045 (GHSA-cv2p-68f4-f4pw, high, 7.3, 27 May 2026) is command injection past the exec tool's deny list in 0.1.2 and earlier, with no patched version listed (https://github.com/advisories/GHSA-cv2p-68f4-f4pw)", "CVE-2026-6987 (GHSA-6r3x-h84w-fhxx, moderate, 25 April 2026) is injection through `/api/gateway/restart` in the web launcher, 0.2.4 and earlier, with no patched version listed (https://github.com/advisories/GHSA-6r3x-h84w-fhxx)", "CVE-2026-16083 (GHSA-mhxf-xvw6-4qw2, moderate, 18 July 2026) is a capture-replay bypass in the LINE webhook up to 0.2.9. The advisory says the project's issue was closed automatically as not planned (https://github.com/advisories/GHSA-mhxf-xvw6-4qw2)", "Issue #3405 of 28 September 2026 asks the project to enable private vulnerability reporting. The only answer is the stale bot's (https://github.com/sipeed/picoclaw/issues/3405)", "`tools.exec.allow_remote` defaults to `true` in the source and on the docs site, and to `false` in the repository's configuration guide (https://github.com/sipeed/picoclaw/blob/main/pkg/config/defaults.go; https://docs.picoclaw.io/docs/configuration/exec/; https://github.com/sipeed/picoclaw/blob/main/docs/guides/configuration.md)", "An empty `allow_from` accepts messages from everyone and logs a warning (https://docs.picoclaw.io/docs/configuration/security-sandbox/)", "A heartbeat reads `HEARTBEAT.md` every 30 minutes by default and runs the tasks in it with the agent's tools (https://github.com/sipeed/picoclaw/blob/main/docs/guides/configuration.md)", "The hooks guide says the hook system is not yet suited to suspending a turn and waiting for human approval replies (https://github.com/sipeed/picoclaw/blob/main/docs/architecture/hooks/README.md)", "The README tells users to have the agent read `https://clawdchat.ai/skill.md` and follow its instructions to join a third-party agent network. We did not read or act on it (https://github.com/sipeed/picoclaw)", "The README warns that PicoClaw has issued no token or cryptocurrency and that picoclaw.io is the only official site (https://github.com/sipeed/picoclaw)", "A stale workflow marks issues and pull requests after 7 days without activity and closes them 7 days later (https://github.com/sipeed/picoclaw/blob/main/.github/workflows/stale.yml)" ], "area": "frameworks", "details": [ { "label": "Runs on", "value": "The owner's device. One Go binary for Linux, macOS, Windows and Android, on x86-64, ARM64, ARMv7, ARMv6, RISC-V, MIPS and LoongArch. Docker images `docker.io/sipeed/picoclaw` and `ghcr.io/sipeed/picoclaw`. Sipeed says it runs in under 10 MB of RAM, and the README says recent builds may use 10 to 20 MB" }, { "label": "Channels", "value": "19 in the README. Telegram, Discord, WhatsApp, Weixin, QQ, Slack, Matrix, Delta Chat, DingTalk, Feishu or Lark, LINE, WeCom, VK, IRC, OneBot, MQTT, MaixCam, and the built-in Pico and Pico Client. Also a web console on port 18800 and a CLI" }, { "label": "Acts without asking", "value": "Sends messages, reads and writes workspace files, fetches web pages, runs shell commands and creates scheduled jobs with no approval prompt. A heartbeat runs the tasks in `HEARTBEAT.md` every 30 minutes by default. No payment tool" }, { "label": "Approval controls", "value": "No human approval step. Per-tool enable switches, a per-agent tool allowlist, `allow_from` sender lists, an exec deny list, and an `approve_tool` hook that code can answer. The hooks guide says waiting for a human reply is not supported" }, { "label": "Sandbox", "value": "File tools and exec paths limited to the workspace by default (`restrict_to_workspace`). Child-process isolation with `bwrap` on Linux or a restricted token on Windows is off by default. The exec guard does not inspect child processes" }, { "label": "Accounts and credentials", "value": "No built-in mail, calendar or file-storage connector. Holds chat bot tokens and sessions, model keys, search keys and any MCP server credentials. Stored in `~/.picoclaw/.security.yml` at mode 0600, in plain text unless `PICOCLAW_KEY_PASSPHRASE` turns on AES-256-GCM" }, { "label": "Memory", "value": "Local files in the workspace. `memory/MEMORY.md` for long-term notes, `sessions/` for history, `sessions/seahorse.db` (SQLite full-text) for short-term retrieval, `USER.md` for preferences. `/clear` clears a chat's history. Deleting the files deletes the memory. No retention setting found" }, { "label": "Who sees the content", "value": "The model provider the owner configures (more than 30 are documented, or a local model through Ollama or vLLM), plus any search engine, MCP server and chat platform in use. No telemetry found in the source" }, { "label": "Proactive", "value": "Heartbeat every 30 minutes (minimum 5) and a cron tool with one-off, interval and cron-expression jobs, stored in `\u003cworkspace\u003e/cron/jobs.json`" }, { "label": "MCP client", "value": "stdio, SSE and streamable HTTP, with optional BM25 or regex tool discovery. Off until `tools.mcp.enabled` is set" }, { "label": "Monthly cost", "value": "Free software. The owner pays the model provider by usage, or nothing with a local model. Sipeed sells boards it says start at $9.90" }, { "label": "Activity", "value": "v0.3.1 on 3 July 2026. Last commit 19 August 2026. 32 open issues and 17 open pull requests on 12 October 2026" } ], "provenance": { "legalEntity": "Sipeed", "domain": "picoclaw.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/sipeed/picoclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The docs footer reads Copyright 2026 Sipeed and the site says PicoClaw is open-source software by Sipeed. The `LICENSE` file names PicoClaw contributors. No registered company name or address was on the pages read.", "No terms of service or privacy policy is linked from picoclaw.io, docs.picoclaw.io or the repository, so both fields are left out and the MIT licence stands in.", "picoclaw.io/.well-known/security.txt and picoclaw.io/llms.txt answered 403 with a storage Access Denied body, read as absent. docs.picoclaw.io/llms.txt answered 404.", "The repository has no SECURITY.md, and GitHub's policy page says none is set up.", "Self-hosted software with no hosted endpoint. The registration date of picoclaw.io was not looked up." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "Sipeed", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "picoclaw.io, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/picoclaw.json" } }