{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "qwenpaw", "name": "QwenPaw", "vendor": "AgentScope", "vendorUrl": "https://qwenpaw.agentscope.io", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files.", "url": "https://www.anchorterminal.com/tools/qwenpaw", "markdownUrl": "https://www.anchorterminal.com/tools/qwenpaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/qwenpaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/qwenpaw.json", "repo": "https://github.com/agentscope-ai/QwenPaw", "license": "Apache-2.0", "transports": [ "http", "stdio" ], "packages": [ { "registry": "pypi", "name": "qwenpaw" }, { "registry": "oci", "name": "agentscope/qwenpaw" } ], "auth": "none", "authNotes": "No account. The Console and API bind to 127.0.0.1:8088 with login off by default. `QWENPAW_AUTH_ENABLED=true` adds one admin account with a salted SHA-256 password hash and a signed token valid for seven days, and requests from localhost skip it. Each channel takes its own bot credentials, and the mailbox takes an IMAP and SMTP authorisation code or app password.", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with nothing to buy. Model usage is billed by whichever provider the owner configures, and local models through llama.cpp, Ollama or LM Studio need no key. The README describes a hosted deployment on AgentScope Platform as free. That platform's pages are script-drawn and its terms and limits were not read (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs source or the dependency list (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 35621, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://qwenpaw.agentscope.io/docs", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "docker", "desktop-app", "mcp", "telemetry-default-on" ], "lastRelease": "2026-09-11", "graded": true, "anchor": { "graded": true, "score": 62.2, "grade": "B", "agentReady": false, "rank": 454, "ranked": true, "rankOf": 986, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 73, "payments": 60, "reliability": 70, "schema": 68, "security": 60, "transparency": 56 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the local-software lines, as the Goose, OpenHands and Khoj dossiers are. `qwenpaw` is on PyPI for Python 3.11 to 3.13, with an install script, a Docker Hub image and a desktop app the README labels beta (20). The repository has 878 test files and Tests, E2E smoke, frontend, pre-commit and CodeQL workflows. On the head commit of 12 October the E2E smoke, frontend, pre-commit and CodeQL runs passed, but the 12 most recent Tests runs on main, back to 30 September, all showed `waiting` and none had completed (15 of 25). 671 open issues, 130 of them labelled bug, and 381 open pull requests on 12 October. New reports get a welcome-bot comment the same day, and we did not read maintainer replies (12 of 25). Dated release notes for every version under Added, Changed and Fixed, with no breaking-change section. The 2.0.0 notes list the removal of Plan Mode under Changed (8 of 15). 2.2.1 is a stable 2.x release (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "Harness reading, scored on what an owner or a pipeline has to read to drive it. `config.json`, `agent.json` and the MCP driver YAML have field tables with types and defaults, and the REST API has a tutorial page. We found no published OpenAPI file (14 of 25). No llms.txt (404). The docs are Markdown files in the repository, and the site draws them by script (3 of 10). The security pages say what each guard does and list what each sandbox backend does not enforce (16 of 20). Policies, approval levels and scanner modes are enumerated, with defaults stated (11 of 15). Worked examples for channels, cron, mail and the API, an FAQ and an API error section (11 of 15). Release notes for every version on the site and on GitHub releases (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "Harness reading of the framework line. 16 built-in tools that can be switched on or off one by one, per-tool enable lists on MCP clients, and skills loaded per agent (18 of 25). Every turn is persisted with older turns recalled on demand, and heartbeat and cron runs have timeouts. We did not find a turn or cost cap in the pages read (12 of 20). A REST API with streamed events, a CLI for cron, channels, chats and agents, and ACP for other runners (15 of 20). Sessions resume, workspaces have checkpoints, and cron keeps execution records (13 of 20). Three commands start it, but a model has to be configured first, there is no SDK, and the defaults leave approvals on AUTO and channels open (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 60, "points": 10.5, "reason": "Harness reading of the framework checklist, as for Goose and OpenHands. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is on by default. `qwenpaw init --defaults`, the documented quick start, sends it with no prompt, `qwenpaw app` sends it on first start, and the interactive prompt defaults to yes. The fields are system details and a random id. Conversation content goes only to the model provider the owner picks, and local models are supported (17). Four approval levels, File Guard, a kernel sandbox on three systems and per-tool MCP policies, with mail tools on `ask` by default. The default level AUTO asks only for flagged calls, `/proactive` skips prompts, channel policies default to `open`, Console login is off by default, and containers run with no isolation (13). SECURITY.md treats the model as untrusted, the mail docs treat message bodies as untrusted input, and a skill scanner runs in warn mode by default. All seven shell-evasion checks default to off (10). Approval cards, cron execution records, Inbox traces of automatic mail handling and a governance log (11). SECURITY.md with private reporting through the Alibaba Security Response Centre, a written trust model and a CodeQL workflow. No bounty, no security.txt, and no published advisory although security fixes ship in release notes (9)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol (0). Free under Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines. It installs from PyPI or Docker Hub with no account and can run on a local model with no key. The README describes a hosted deployment on AgentScope Platform as free. Its pages are script-drawn and were not read, so it is not scored." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "reason": "2.2.2-beta.4 was tagged and published as a GitHub pre-release on 30 September 2026, 12 days before this check. The last stable release, 2.2.1, is from 11 September, 31 days before. Recency is scored on the last stable release (20). Four stable releases in the 90 days to 12 October (2.0.1, 2.1.0, 2.2.0, 2.2.1) and more than 20 tagged pre-releases (20). Commits land on main daily and new issues get a bot reply the same day, against 671 open issues and 381 open pull requests. We did not sample maintainer reply times (14 of 25). PyPI, Docker Hub, an Alibaba Cloud registry image and desktop builds ship from the same tags (12 of 15). Dependencies carry version bounds with reasons in comments, and CodeQL, pre-commit and nightly test workflows exist, while the Tests workflow on main has not completed since 30 September (7 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "note": "editorial 58, provenance 53", "reason": "Apache-2.0 (30). The site publishes a Usage Policy of 26 August 2026 and no privacy policy or terms. The README says data stays on the owner's machine and lists the usage fields collected, with no retention period or recipient named. It says data is sent once a version during `qwenpaw init`, while the source also sends at `qwenpaw app` start and, on main since 17 September, once per active day (10 of 30). Release notes record removals such as Plan Mode in 2.0.0 and the mailbox docs name the `himalaya` skill as deprecated. No deprecation policy or dated notice period found (7 of 20). Usage data is disclosed in the README with its fields and an interactive opt-out. It is on by default, and `QWENPAW_TELEMETRY_DISABLED` appears only in the init prompt and the source, not in the README or docs (11 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading of the framework line. 16 built-in tools that can be switched on or off one by one, per-tool enable lists on MCP clients, and skills loaded per agent (18 of 25). Every turn is persisted with older turns recalled on demand, and heartbeat and cron runs have timeouts. We did not find a turn or cost cap in the pages read (12 of 20). A REST API with streamed events, a CLI for cron, channels, chats and agents, and ACP for other runners (15 of 20). Sessions resume, workspaces have checkpoints, and cron keeps execution records (13 of 20). Three commands start it, but a model has to be configured first, there is no SDK, and the defaults leave approvals on AUTO and channels open (9 of 15).", "maintenance": "2.2.2-beta.4 was tagged and published as a GitHub pre-release on 30 September 2026, 12 days before this check. The last stable release, 2.2.1, is from 11 September, 31 days before. Recency is scored on the last stable release (20). Four stable releases in the 90 days to 12 October (2.0.1, 2.1.0, 2.2.0, 2.2.1) and more than 20 tagged pre-releases (20). Commits land on main daily and new issues get a bot reply the same day, against 671 open issues and 381 open pull requests. We did not sample maintainer reply times (14 of 25). PyPI, Docker Hub, an Alibaba Cloud registry image and desktop builds ship from the same tags (12 of 15). Dependencies carry version bounds with reasons in comments, and CodeQL, pre-commit and nightly test workflows exist, while the Tests workflow on main has not completed since 30 September (7 of 10).", "payments": "Read with the self-hosted rule. No payment protocol (0). Free under Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines. It installs from PyPI or Docker Hub with no account and can run on a local model with no key. The README describes a hosted deployment on AgentScope Platform as free. Its pages are script-drawn and were not read, so it is not scored.", "reliability": "Read with the local-software lines, as the Goose, OpenHands and Khoj dossiers are. `qwenpaw` is on PyPI for Python 3.11 to 3.13, with an install script, a Docker Hub image and a desktop app the README labels beta (20). The repository has 878 test files and Tests, E2E smoke, frontend, pre-commit and CodeQL workflows. On the head commit of 12 October the E2E smoke, frontend, pre-commit and CodeQL runs passed, but the 12 most recent Tests runs on main, back to 30 September, all showed `waiting` and none had completed (15 of 25). 671 open issues, 130 of them labelled bug, and 381 open pull requests on 12 October. New reports get a welcome-bot comment the same day, and we did not read maintainer replies (12 of 25). Dated release notes for every version under Added, Changed and Fixed, with no breaking-change section. The 2.0.0 notes list the removal of Plan Mode under Changed (8 of 15). 2.2.1 is a stable 2.x release (15).", "schema": "Harness reading, scored on what an owner or a pipeline has to read to drive it. `config.json`, `agent.json` and the MCP driver YAML have field tables with types and defaults, and the REST API has a tutorial page. We found no published OpenAPI file (14 of 25). No llms.txt (404). The docs are Markdown files in the repository, and the site draws them by script (3 of 10). The security pages say what each guard does and list what each sandbox backend does not enforce (16 of 20). Policies, approval levels and scanner modes are enumerated, with defaults stated (11 of 15). Worked examples for channels, cron, mail and the API, an FAQ and an API error section (11 of 15). Release notes for every version on the site and on GitHub releases (13 of 15).", "security": "Harness reading of the framework checklist, as for Goose and OpenHands. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is on by default. `qwenpaw init --defaults`, the documented quick start, sends it with no prompt, `qwenpaw app` sends it on first start, and the interactive prompt defaults to yes. The fields are system details and a random id. Conversation content goes only to the model provider the owner picks, and local models are supported (17). Four approval levels, File Guard, a kernel sandbox on three systems and per-tool MCP policies, with mail tools on `ask` by default. The default level AUTO asks only for flagged calls, `/proactive` skips prompts, channel policies default to `open`, Console login is off by default, and containers run with no isolation (13). SECURITY.md treats the model as untrusted, the mail docs treat message bodies as untrusted input, and a skill scanner runs in warn mode by default. All seven shell-evasion checks default to off (10). Approval cards, cron execution records, Inbox traces of automatic mail handling and a governance log (11). SECURITY.md with private reporting through the Alibaba Security Response Centre, a written trust model and a CodeQL workflow. No bounty, no security.txt, and no published advisory although security fixes ship in release notes (9).", "transparency": "Apache-2.0 (30). The site publishes a Usage Policy of 26 August 2026 and no privacy policy or terms. The README says data stays on the owner's machine and lists the usage fields collected, with no retention period or recipient named. It says data is sent once a version during `qwenpaw init`, while the source also sends at `qwenpaw app` start and, on main since 17 September, once per active day (10 of 30). Release notes record removals such as Plan Mode in 2.0.0 and the mailbox docs name the `himalaya` skill as deprecated. No deprecation policy or dated notice period found (7 of 20). Usage data is disclosed in the README with its fields and an interactive opt-out. It is on by default, and `QWENPAW_TELEMETRY_DISABLED` appears only in the init prompt and the source, not in the README or docs (11 of 20)." }, "sources": [ { "what": "repository main branch at commit 02b6a6d (shallow clone)", "url": "https://github.com/agentscope-ai/QwenPaw", "seen": "2026-10-12" }, { "what": "README (install, channels, security layers, telemetry)", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/README.md", "seen": "2026-10-12" }, { "what": "security policy and trust model", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "security docs (Tool Guard, File Guard, sandbox limits, access policy, web login), read from the docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/security.en.md", "seen": "2026-10-12" }, { "what": "mailbox docs (providers, 22 tools, automation rules), docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/mailbox.en.md", "seen": "2026-10-12" }, { "what": "channels docs (channel list, `dm_policy` defaults), docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/channels.en.md", "seen": "2026-10-12" }, { "what": "memory docs (file layout, defaults, other backends), docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/memory.en.md", "seen": "2026-10-12" }, { "what": "memory evolution and `/proactive`, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/memory-evolving-and-proactive.en.md", "seen": "2026-10-12" }, { "what": "heartbeat docs, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/heartbeat.en.md", "seen": "2026-10-12" }, { "what": "cron docs, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/cron.en.md", "seen": "2026-10-12" }, { "what": "MCP and built-in tools, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/mcp.en.md", "seen": "2026-10-12" }, { "what": "models and providers, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/models.en.md", "seen": "2026-10-12" }, { "what": "config and working directory (secret files, keychain), docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/config.en.md", "seen": "2026-10-12" }, { "what": "REST API tutorial, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/api-tutorial.en.md", "seen": "2026-10-12" }, { "what": "CLI reference (delete and clean commands, bind host), docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/cli.en.md", "seen": "2026-10-12" }, { "what": "Hub docs, docs source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/hub.en.md", "seen": "2026-10-12" }, { "what": "telemetry source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/src/qwenpaw/utils/telemetry.py", "seen": "2026-10-12" }, { "what": "daily telemetry source (added 17 September 2026, #7802)", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/src/qwenpaw/utils/daily_telemetry.py", "seen": "2026-10-12" }, { "what": "init command (telemetry prompt, `--defaults` path)", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/src/qwenpaw/cli/init_cmd.py", "seen": "2026-10-12" }, { "what": "encrypted secret store source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/src/qwenpaw/security/secret_store.py", "seen": "2026-10-12" }, { "what": "release notes 2.2.1, 2.2.0, 2.1.0 and 2.0.0, site source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/release-notes/v2.2.1.md", "seen": "2026-10-12" }, { "what": "MCP tool allowlist fix", "url": "https://github.com/agentscope-ai/QwenPaw/pull/7504", "seen": "2026-10-12" }, { "what": "Usage Policy of 26 August 2026 and site footer, site source", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/website/src/pages/UsagePolicy/usage-policy.md", "seen": "2026-10-12" }, { "what": "package metadata and dependencies", "url": "https://github.com/agentscope-ai/QwenPaw/blob/main/pyproject.toml", "seen": "2026-10-12" }, { "what": "GitHub API, repository record (35,621 stars, created 24 February 2026)", "url": "https://api.github.com/repos/agentscope-ai/QwenPaw", "seen": "2026-10-12" }, { "what": "GitHub API, releases with dates", "url": "https://api.github.com/repos/agentscope-ai/QwenPaw/releases?per_page=30", "seen": "2026-10-12" }, { "what": "GitHub API, repository security advisories (none published)", "url": "https://api.github.com/repos/agentscope-ai/QwenPaw/security-advisories", "seen": "2026-10-12" }, { "what": "GitHub API, Tests workflow runs on main", "url": "https://api.github.com/repos/agentscope-ai/QwenPaw/actions/workflows/tests.yml/runs?branch=main", "seen": "2026-10-12" }, { "what": "GitHub API, open issue and pull request counts", "url": "https://api.github.com/search/issues?q=repo:agentscope-ai/QwenPaw+is:issue+is:open", "seen": "2026-10-12" }, { "what": "NVD keyword searches for QwenPaw and CoPaw (no results)", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=QwenPaw", "seen": "2026-10-12" }, { "what": "robots.txt (404), llms.txt (404) and security.txt (404)", "url": "https://qwenpaw.agentscope.io/robots.txt", "seen": "2026-10-12" }, { "what": "AgentScope Platform home page markup (script-drawn)", "url": "https://platform.agentscope.io/", "seen": "2026-10-12" } ], "openQuestions": [ "Kind. We used `harness`, the closest kind the briefs define for a self-hosted agent program, with `metrics.kind` local. Reliability is read with the local-software lines and Payments with the self-hosted rule", "Maintenance recency is scored on the tagged pre-release 2.2.2-beta.4 of 30 September 2026. A strict reading on the last stable release, 2.2.1 of 11 September, 31 days before the check, gives 20 on that line and 73 overall", "The lead names the vendor as AgentScope (Alibaba). First-hand we found the AgentScope team credited in the README, Qwenpaw PRIVATE LIMITED in the site footer and the Alibaba Security Response Centre in SECURITY.md, and no direct statement of ownership", "Unchecked: the rendered pages of qwenpaw.agentscope.io, which are script-drawn. Docs, release notes, the Usage Policy and the footer were read from the site's source in the repository", "Unchecked: AgentScope Platform's terms, privacy policy, limits and what its free hosted deployment stores (platform.agentscope.io is script-drawn)", "Unchecked: whether the Tests workflow passes on main. Its 12 most recent runs showed `waiting`", "Unchecked: maintainer reply times on issues and pull requests, PyPI download counts and the first release date", "Unchecked: whether channel bot tokens in `agent.json` are encrypted. The encrypted store covers model keys, environment variables, mail and MCP credentials in the source we read", "Unchecked: what the telemetry endpoint logs. The README says no IP addresses are collected, and the endpoint is an HTTPS function on Alibaba Cloud", "The daily usage event is on main and in the 2.2.2 pre-releases and is absent from the README's Telemetry section. It was not in the stable 2.2.1 release, so no deduction was taken", "No calendar connector was found in the docs or the built-in skills, though the default heartbeat checklist mentions checking a calendar", "No documented way to delete a single memory other than editing or removing its Markdown file, and nothing on whether index data in `mem_metadata/` is purged when a file is removed" ] }, "negative": -3, "negativeNotes": [ "2026-09-11. Version 2.2.1 began enforcing each MCP server's tool allowlist on the agent runtime path (commit f2a292d of 4 September, #7504). Before it, a tool the owner had disabled on an MCP client could still be invoked by the agent. Fixed and listed in the release notes, with no security advisory, -2. https://github.com/agentscope-ai/QwenPaw/pull/7504", "2026-09-03. Version 2.2.0 blocked shell line-continuation variants that bypassed sensitive-path protections (#7472). Fixed and listed in the release notes, with no security advisory, -1. https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/release-notes/v2.2.0.md" ], "verdict": "Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.", "bestFor": "One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice.", "strengths": [ "New mail driver cards default to the `ask` policy, and automatic mail handling may not call `delete_message` or write to unknown recipients", "Kernel sandbox on macOS, Linux and Windows, with a documented list of constraints each backend does not enforce", "Model keys, mail credentials and environment secrets are encrypted with a master key held in the OS keychain or a 0600 file", "Memory is plain Markdown in the agent workspace that the owner can read, edit and remove", "Four stable releases in the 90 days to 12 October 2026, each with dated release notes" ], "weaknesses": [ "Usage data is on by default, `qwenpaw init --defaults` accepts it without a prompt, and the opt-out variable is absent from the README and docs", "The default approval level AUTO asks only for tool calls a guard rule flags, and `/proactive` skips approval prompts entirely", "Channel direct-message and group policies default to `open`, and Console login is off by default", "No privacy policy, terms of service or security.txt on qwenpaw.agentscope.io, and no published GitHub security advisory", "Inside containers the sandbox falls back to `mode=none`, which the docs say enforces no isolation", "671 open issues and 381 open pull requests on 12 October 2026, and the Tests workflow on main had not completed a run since 30 September" ], "agentNotes": [ "Set `QWENPAW_TELEMETRY_DISABLED=true` before `qwenpaw init --defaults` or `qwenpaw app`. Both send usage data without asking", "Set `approval_level` to `STRICT` or `SMART` in `agent.json`. The default `AUTO` runs every tool call no guard rule flags", "Set `dm_policy` and `group_policy` to `allowlist` with `allow_from` on each channel. Both default to `open`", "Set `QWENPAW_AUTH_ENABLED=true` before binding beyond 127.0.0.1. Requests from localhost skip login even then", "Keep mail tools on `ask` for `send_message`, `delete_message` and `delete_thread`, and turn on Mail Access Control with automatic handling" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.2 } ], "editorialScores": { "ergonomics": 67, "maintenance": 73, "payments": 60, "reliability": 70, "schema": 68, "security": 60, "transparency": 58 }, "provenanceScore": 53 }, "connect": { "install": "pip install qwenpaw \u0026\u0026 qwenpaw init --defaults \u0026\u0026 qwenpaw app # Python 3.11 to 3.13; or: docker pull agentscope/qwenpaw:latest", "http": "curl -X POST http://localhost:8088/api/console/chat -H \"Content-Type: application/json\" -H \"X-Agent-Id: default\" -d '{\"input\": [...]}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/qwenpaw" }, "notable": [ "The security policy calls the model an untrusted principal and puts prompt-injection-only reports out of scope unless a policy, authentication or sandbox boundary is crossed (https://github.com/agentscope-ai/QwenPaw/blob/main/SECURITY.md)", "Enabling `/proactive` starts an assistant that reads the last seven days of chats, may capture the desktop on a multimodal model and runs with approval prompts skipped (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/memory-evolving-and-proactive.en.md)", "The sandbox docs state that `max_processes`, `max_memory_mb` and domain allowlists are not enforced by any backend and that Bubblewrap does not isolate the network (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/security.en.md)", "Version 2.2.1 of 11 September 2026 began enforcing each MCP server's tool allowlist on the agent runtime path (https://github.com/agentscope-ai/QwenPaw/pull/7504)", "The project was named CoPaw until version 1.1.0, and configuration and memory from CoPaw carry over (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/faq.en.md)", "QwenPaw Hub, added in 2.2.0, runs one QwenPaw per user on a shared server and is described as for teams whose members trust one another (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/hub.en.md)" ], "area": "frameworks", "details": [ { "label": "Interfaces", "value": "Web Console on 127.0.0.1:8088, terminal UI, desktop app (beta, Windows 10+ and macOS 14+), REST API at `POST /api/console/chat`, CLI, ACP (https://github.com/agentscope-ai/QwenPaw/blob/main/README.md)" }, { "label": "Channels", "value": "DingTalk, Feishu (Lark), iMessage (macOS), Discord, QQ, OneBot v11, WeCom, WeChat Personal, Telegram, Mattermost, MQTT, Matrix, Yuanbao, XiaoYi, Voice, SIP, Azure Bot, Slack (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/channels.en.md)" }, { "label": "Acts unasked", "value": "Heartbeat (off by default) and cron jobs run prompts on a schedule and post replies to a channel. `/proactive` checks every 30 seconds, acts after 30 idle minutes and runs web, browser, file and shell tools with approval prompts skipped. Mail automation wakes the agent for each new message" }, { "label": "Approvals", "value": "`approval_level` STRICT, SMART, AUTO (default) or OFF per agent. AUTO asks only for calls a Tool Guard rule flags. MCP clients carry an allow, deny or ask policy per tool and per source, with `deny` as the default effect when no rule matches" }, { "label": "Accounts", "value": "One mailbox per agent over IMAP and SMTP on nine consumer domains (163.com, 126.com, yeah.net, qq.com, foxmail.com, sina.com, sina.cn, aliyun.com, gmail.com), using an authorisation code or app password with full send and receive access. No enterprise, custom-domain or Microsoft mailboxes. No calendar connector found" }, { "label": "Mail tools", "value": "22 tools in the bundled qwenpawmail MCP server, 11 read-only, 9 write and 2 destructive. New driver cards use `ask`. Automatic handling may not call `delete_message` and may write only to the original sender or a contact in `CONTACTS.md`" }, { "label": "Credentials", "value": "Model keys in `~/.qwenpaw.secret/providers.json`, tool variables in `envs.json` and mail secrets in the workspace `credentials.yaml`, encrypted with Fernet. The master key sits in the OS keychain, or in `.master_key` with mode 0600" }, { "label": "Memory", "value": "Markdown files in the agent workspace (`MEMORY.md`, `memory/`, `digest/`, `mem_session/`), written by the default in-process ReMe backend every five user turns and consolidated nightly at 23:00. Deleted by removing files, `qwenpaw agents delete --remove-workspace` or `qwenpaw clean`. Optional ADBPG and PowerContext backends send memory to a remote service" }, { "label": "Models", "value": "Local through built-in llama.cpp, Ollama or LM Studio with no key. 21 cloud providers listed, among them DashScope, OpenAI, Azure OpenAI, Anthropic, Google Gemini, DeepSeek and OpenRouter. The chosen provider receives the conversation content" }, { "label": "Sandbox", "value": "Seatbelt on macOS, Bubblewrap or Landlock on Linux, AppContainer or restricted token on Windows. The whole filesystem is readable by default with writes limited to the workspace. Network is open by default, and containers fall back to `mode=none` with no isolation" }, { "label": "MCP client", "value": "stdio, streamable HTTP and SSE, with per-tool enable lists and access policies in `drivers/mcp/*.yaml`" }, { "label": "Telemetry", "value": "On by default. Version, install method, OS, Python version, CPU architecture, GPU presence and a random id go to an Alibaba Cloud Function Compute endpoint once a version. Main since 17 September 2026 also sends one event per active day. `QWENPAW_TELEMETRY_DISABLED` turns both off" }, { "label": "Cost", "value": "Free under Apache-2.0. Model usage is billed by the chosen provider, or nothing with a local model. The README describes a hosted deployment on AgentScope Platform as free" }, { "label": "Releases in 90 days", "value": "Four stable (2.0.1 on 24 July, 2.1.0 on 13 August, 2.2.0 on 3 September, 2.2.1 on 11 September 2026) and more than 20 tagged pre-releases, the latest 2.2.2-beta.4 on 30 September" } ], "provenance": { "legalEntity": "Qwenpaw PRIVATE LIMITED", "domain": "agentscope.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://qwenpaw.agentscope.io/release-notes", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The site footer in the repository's website source reads © 2026 Qwenpaw PRIVATE LIMITED. The LICENSE file names The QwenPaw Authors, and the README credits the AgentScope team.", "SECURITY.md sends vulnerability reports to the Alibaba Security Response Centre. We found no other first-hand statement of ownership by Alibaba.", "The site links a Usage Policy dated 26 August 2026 and no terms of service or privacy policy, so both links are left out and the Apache-2.0 licence stands in.", "qwenpaw.agentscope.io answered 404 for robots.txt, llms.txt and /.well-known/security.txt on 12 October 2026.", "No hosted endpoint is graded. A self-hosted instance answers on its owner's own host. We did not look up the domain's registration date." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "Qwenpaw PRIVATE LIMITED", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "agentscope.io, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache-2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/qwenpaw.json" } }