{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "zeroclaw", "name": "ZeroClaw", "vendor": "ZeroClaw Labs", "vendorUrl": "https://www.zeroclaw.com", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite.", "url": "https://www.anchorterminal.com/tools/zeroclaw", "markdownUrl": "https://www.anchorterminal.com/tools/zeroclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zeroclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zeroclaw.json", "repo": "https://github.com/zeroclaw-labs/zeroclaw", "license": "MIT OR Apache-2.0", "transports": [], "packages": [ { "registry": "oci", "name": "ghcr.io/zeroclaw-labs/zeroclaw" } ], "auth": "none", "authNotes": "No account with the vendor. Model keys, bot tokens and mail passwords go in `~/.zeroclaw/config.toml` as encrypted secret fields, set through `zeroclaw config set`, the dashboard or the terminal UI. OpenAI Codex and Claude subscription tokens are accepted in place of API keys. Gateway clients pair first and then send `Authorization: Bearer \u003ctoken\u003e`, with token hashes kept in config (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/authentication.md).", "pricing": "free", "pricingNotes": "Free under MIT or Apache-2.0, with no subscription and no hosted seat (https://www.zeroclaw.com/). The owner pays the model provider, or nothing with a local model. ZeroRouter, the vendor's hosted beta model gateway, is optional and its prices were not read (checked 2026-10-12).", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source at commit 6c0b1f9 (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 32965, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.zeroclaw.com/master/en/introduction.html", "llmsTxt": "https://www.zeroclaw.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "rust", "mit", "apache-2.0", "pre-1.0", "no-telemetry", "mcp-client", "approvals", "acp", "docker", "llms-txt" ], "lastRelease": "2026-09-05", "graded": true, "anchor": { "graded": true, "score": 70.2, "grade": "BB", "agentReady": true, "rank": 161, "ranked": true, "rankOf": 986, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 60, "reliability": 74, "schema": 82, "security": 76, "transparency": 64 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 74, "points": 14.8, "reason": "Read with the local-software lines, as software the owner runs. An install script that fetches a prebuilt binary, Homebrew, a ghcr.io image and source builds on Rust 1.96, with setup pages for Linux, macOS, Windows, FreeBSD, NixOS and Docker (20). The CI workflow runs on every push to master, and the three latest runs, on 11 October 2026, passed (25). 576 open issues and 384 open pull requests. The 30 newest bug reports carry labels and at least one comment within days, and several P1 reports from that week are open, among them a Telegram listener that can hang (#11608) and a memory leak in config paths (#11614) (15 of 25). Release notes carry a Breaking Changes section, but 0.8.4 and 0.8.5 are patch-level versions that removed settings and skill sources (10 of 15). Version 0.8.5, with v1.0 shown as planned on the home page (4 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Harness reading of the six lines, as the Goose dossier used. A running gateway serves an OpenAPI document at `/api/openapi.json` for what the docs call the currently documented subset, and `zeroclaw config schema` prints the full config schema, from which the published config reference is generated. We read neither from a running copy (18 of 25). An llms.txt on www.zeroclaw.com, and the docs are Markdown in the repository (10). The autonomy, sandboxing and YOLO pages say what each setting allows, when to use it and when not to (16 of 20). Typed TOML with enumerated levels, validation warnings and rejection of unknown values such as `read_only` (12 of 15). Worked config examples on most pages and a troubleshooting page, with no single error reference (12 of 15). Dated release notes, a blog post a release and a versioned config schema with automatic migration (14 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "Harness reading. MCP servers reach an agent only through its `mcp_bundles`, skills can load on demand in compact mode, and most built-in integrations are off until configured, though the built-in tool list is long (18 of 25). Daily and monthly cost budgets, history trimming and a 1 MB cap on Google Workspace output (15 of 20). A blocked call returns a tool error that names the policy, and the docs describe each failure path (15 of 20). Provider fallback chains, resumable procedure runs and approval timeouts that deny, with no idempotency guidance for sends (14 of 20). One binary and a guided quickstart, and `zeroclaw agent -a \u003calias\u003e -m` for one-shot runs, but a working config needs four sections and there is no SDK (10 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 76, "points": 13.3, "reason": "Harness reading, with 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs state no telemetry, we found no vendor host in the source apart from the optional ZeroRouter provider, secrets are encrypted with ChaCha20-Poly1305 beside a 0600 key file on the same disk, and the gateway binds 127.0.0.1 with pairing on. Web search and page fetches run without approval (27). Supervised mode is the default, `always_ask` outranks full autonomy, prompts time out to a denial, and an OS sandbox is auto-detected, but sandboxed tools keep network egress, unattended runs skip the shell prompt and rely on the command policy, and an open report says `firejail_args` is never applied (#11594) (17). A guard scans for injection patterns with a default action of warn, trigger payloads are framed as untrusted, a leak detector redacts credentials in replies by default, and an empty peer set denies all senders. No guidance page on injection through mail or web content was found (10). Approval events and a runtime trace are logged, tool receipts are opt-in and not durable, and the docs state command execution is not audited (8). SECURITY.md with private reporting and response times, one advisory published, CodeQL, cargo-deny, a daily audit and build attestations. No bounty and no security.txt, and SECURITY.md and the README name different contacts (14)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol (0). Free under MIT or Apache-2.0 with nothing to buy for the assistant, so 20, 20 and 20 on the last three lines. It runs local models with no sign-up. ZeroRouter, the vendor's optional hosted model gateway, was not graded and its prices were not read." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "v0.8.5 was released on 5 September 2026, 37 days before this check (20 of 30). Three releases in the 90 days to 12 October, v0.8.3 on 16 July, v0.8.4 on 2 August and v0.8.5 on 5 September (20). Master had 200 commits between 25 September and 11 October, and bug reports from the last week carry priority labels, comments and linked fix pull requests, against 576 open issues and 384 open pull requests (20 of 25). Not an MCP server and no SDK. Release workflows publish the binary, a ghcr.io image and crates, AUR and Scoop packages, which we read as workflow files and did not confirm on the registries (11 of 15). cargo-deny, a daily advisory audit, a monthly outdated-dependency job, CodeQL, Trivy and SBOM workflows, with CI passing (9 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 64, "points": 5.6, "note": "editorial 74, provenance 53", "reason": "MIT or Apache-2.0, with a CLA that leaves copyright with contributors (30). The docs map every state store, say what is sent to a model provider and list what to back up, and the site says there is no ZeroClaw cloud in between. There is no privacy policy or terms on zeroclaw.com, and no data statement was read for the hosted ZeroRouter beta that the `zerorouter` slot defaults to (16 of 30). Release notes name removed and deprecated settings, and SECURITY.md says only the latest minor line gets fixes. No deprecation policy with notice periods was found (10 of 20). The docs state there is no telemetry, and our source search found no vendor host beyond ZeroRouter. We did not audit every outbound call (18 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading. MCP servers reach an agent only through its `mcp_bundles`, skills can load on demand in compact mode, and most built-in integrations are off until configured, though the built-in tool list is long (18 of 25). Daily and monthly cost budgets, history trimming and a 1 MB cap on Google Workspace output (15 of 20). A blocked call returns a tool error that names the policy, and the docs describe each failure path (15 of 20). Provider fallback chains, resumable procedure runs and approval timeouts that deny, with no idempotency guidance for sends (14 of 20). One binary and a guided quickstart, and `zeroclaw agent -a \u003calias\u003e -m` for one-shot runs, but a working config needs four sections and there is no SDK (10 of 15).", "maintenance": "v0.8.5 was released on 5 September 2026, 37 days before this check (20 of 30). Three releases in the 90 days to 12 October, v0.8.3 on 16 July, v0.8.4 on 2 August and v0.8.5 on 5 September (20). Master had 200 commits between 25 September and 11 October, and bug reports from the last week carry priority labels, comments and linked fix pull requests, against 576 open issues and 384 open pull requests (20 of 25). Not an MCP server and no SDK. Release workflows publish the binary, a ghcr.io image and crates, AUR and Scoop packages, which we read as workflow files and did not confirm on the registries (11 of 15). cargo-deny, a daily advisory audit, a monthly outdated-dependency job, CodeQL, Trivy and SBOM workflows, with CI passing (9 of 10).", "payments": "Read with the self-hosted rule. No payment protocol (0). Free under MIT or Apache-2.0 with nothing to buy for the assistant, so 20, 20 and 20 on the last three lines. It runs local models with no sign-up. ZeroRouter, the vendor's optional hosted model gateway, was not graded and its prices were not read.", "reliability": "Read with the local-software lines, as software the owner runs. An install script that fetches a prebuilt binary, Homebrew, a ghcr.io image and source builds on Rust 1.96, with setup pages for Linux, macOS, Windows, FreeBSD, NixOS and Docker (20). The CI workflow runs on every push to master, and the three latest runs, on 11 October 2026, passed (25). 576 open issues and 384 open pull requests. The 30 newest bug reports carry labels and at least one comment within days, and several P1 reports from that week are open, among them a Telegram listener that can hang (#11608) and a memory leak in config paths (#11614) (15 of 25). Release notes carry a Breaking Changes section, but 0.8.4 and 0.8.5 are patch-level versions that removed settings and skill sources (10 of 15). Version 0.8.5, with v1.0 shown as planned on the home page (4 of 15).", "schema": "Harness reading of the six lines, as the Goose dossier used. A running gateway serves an OpenAPI document at `/api/openapi.json` for what the docs call the currently documented subset, and `zeroclaw config schema` prints the full config schema, from which the published config reference is generated. We read neither from a running copy (18 of 25). An llms.txt on www.zeroclaw.com, and the docs are Markdown in the repository (10). The autonomy, sandboxing and YOLO pages say what each setting allows, when to use it and when not to (16 of 20). Typed TOML with enumerated levels, validation warnings and rejection of unknown values such as `read_only` (12 of 15). Worked config examples on most pages and a troubleshooting page, with no single error reference (12 of 15). Dated release notes, a blog post a release and a versioned config schema with automatic migration (14 of 15).", "security": "Harness reading, with 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs state no telemetry, we found no vendor host in the source apart from the optional ZeroRouter provider, secrets are encrypted with ChaCha20-Poly1305 beside a 0600 key file on the same disk, and the gateway binds 127.0.0.1 with pairing on. Web search and page fetches run without approval (27). Supervised mode is the default, `always_ask` outranks full autonomy, prompts time out to a denial, and an OS sandbox is auto-detected, but sandboxed tools keep network egress, unattended runs skip the shell prompt and rely on the command policy, and an open report says `firejail_args` is never applied (#11594) (17). A guard scans for injection patterns with a default action of warn, trigger payloads are framed as untrusted, a leak detector redacts credentials in replies by default, and an empty peer set denies all senders. No guidance page on injection through mail or web content was found (10). Approval events and a runtime trace are logged, tool receipts are opt-in and not durable, and the docs state command execution is not audited (8). SECURITY.md with private reporting and response times, one advisory published, CodeQL, cargo-deny, a daily audit and build attestations. No bounty and no security.txt, and SECURITY.md and the README name different contacts (14).", "transparency": "MIT or Apache-2.0, with a CLA that leaves copyright with contributors (30). The docs map every state store, say what is sent to a model provider and list what to back up, and the site says there is no ZeroClaw cloud in between. There is no privacy policy or terms on zeroclaw.com, and no data statement was read for the hosted ZeroRouter beta that the `zerorouter` slot defaults to (16 of 30). Release notes name removed and deprecated settings, and SECURITY.md says only the latest minor line gets fixes. No deprecation policy with notice periods was found (10 of 20). The docs state there is no telemetry, and our source search found no vendor host beyond ZeroRouter. We did not audit every outbound call (18 of 20)." }, "sources": [ { "what": "repository master at commit 6c0b1f9 (shallow clone, 200 commits)", "url": "https://github.com/zeroclaw-labs/zeroclaw", "seen": "2026-10-12" }, { "what": "README", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/README.md", "seen": "2026-10-12" }, { "what": "security policy", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/SECURITY.md", "seen": "2026-10-12" }, { "what": "autonomy levels", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/autonomy.md", "seen": "2026-10-12" }, { "what": "security model and default posture", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/model.md", "seen": "2026-10-12" }, { "what": "sandboxing", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/sandboxing.md", "seen": "2026-10-12" }, { "what": "tool receipts", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/tool-receipts.md", "seen": "2026-10-12" }, { "what": "YOLO mode", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/getting-started/yolo.md", "seen": "2026-10-12" }, { "what": "authentication and principals", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/authentication.md", "seen": "2026-10-12" }, { "what": "channels overview", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/overview.md", "seen": "2026-10-12" }, { "what": "email channels", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/email.md", "seen": "2026-10-12" }, { "what": "peer groups", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/peer-groups.md", "seen": "2026-10-12" }, { "what": "tools overview", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/tools/overview.md", "seen": "2026-10-12" }, { "what": "built-in tool inventory", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/developing/tool-inventory.md", "seen": "2026-10-12" }, { "what": "MCP client", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/tools/mcp.md", "seen": "2026-10-12" }, { "what": "runtime state and persistence", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/runtime-state-and-persistence.md", "seen": "2026-10-12" }, { "what": "memory and payload lifecycle", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/memory-payload-lifecycle.md", "seen": "2026-10-12" }, { "what": "memory backends decision record", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/decisions/ADR-005-pluggable-memory-backends.md", "seen": "2026-10-12" }, { "what": "provider catalogue, with ZeroRouter", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/providers/catalog.md", "seen": "2026-10-12" }, { "what": "network deployment and gateway binding", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/ops/network-deployment.md", "seen": "2026-10-12" }, { "what": "gateway API overview", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/gateway/api.md", "seen": "2026-10-12" }, { "what": "cost tracking", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/ops/cost-tracking.md", "seen": "2026-10-12" }, { "what": "ownership and telemetry statement", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/philosophy/you-own-it.md", "seen": "2026-10-12" }, { "what": "release verification", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/maintainers/release-verification.md", "seen": "2026-10-12" }, { "what": "config schema source, default auto-approve list and Google Workspace settings", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/schema.rs", "seen": "2026-10-12" }, { "what": "approval decision source", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-runtime/src/approval/mod.rs", "seen": "2026-10-12" }, { "what": "secret store source", "url": "https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/secrets.rs", "seen": "2026-10-12" }, { "what": "releases and release notes", "url": "https://github.com/zeroclaw-labs/zeroclaw/releases", "seen": "2026-10-12" }, { "what": "published advisories, read from the GitHub API after the web page answered 504 twice", "url": "https://api.github.com/repos/zeroclaw-labs/zeroclaw/security-advisories", "seen": "2026-10-12" }, { "what": "repository metadata and star count (GitHub API)", "url": "https://api.github.com/repos/zeroclaw-labs/zeroclaw", "seen": "2026-10-12" }, { "what": "CI runs on master (GitHub API)", "url": "https://api.github.com/repos/zeroclaw-labs/zeroclaw/actions/workflows/ci.yml/runs?branch=master", "seen": "2026-10-12" }, { "what": "open bug reports (GitHub API)", "url": "https://api.github.com/repos/zeroclaw-labs/zeroclaw/issues?state=open\u0026labels=bug", "seen": "2026-10-12" }, { "what": "home page and FAQ", "url": "https://www.zeroclaw.com/", "seen": "2026-10-12" }, { "what": "llms.txt", "url": "https://www.zeroclaw.com/llms.txt", "seen": "2026-10-12" }, { "what": "security.txt, 404", "url": "https://www.zeroclaw.com/.well-known/security.txt", "seen": "2026-10-12" }, { "what": "blog index", "url": "https://www.zeroclaw.com/blog", "seen": "2026-10-12" }, { "what": "incident recap of 1 April 2026", "url": "https://www.zeroclaw.com/blog/community-and-stability", "seen": "2026-10-12" }, { "what": "domain registration (RDAP)", "url": "https://rdap.verisign.com/com/v1/domain/zeroclaw.com", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is `harness`. ZeroClaw is a self-hosted agent program, and harness is the closest kind the briefs define. Reliability was read with the local-software lines and Payments with the self-hosted rule.", "The lead gave the licence as Apache-2.0. The repository is MIT or Apache-2.0 at the user's choice, and GitHub's API reports only Apache-2.0.", "unchecked: nothing was installed or run, so the approval prompts, the sandbox, the OpenAPI document and the quickstart defaults were read from docs and source only.", "unchecked: zerorouter.ai, the vendor's hosted beta model gateway, was not opened. Its prices, terms and data handling are unknown, as is whether quickstart preselects it.", "unchecked: the crates.io, Homebrew, AUR and Scoop packages were not looked up. Their existence rests on the docs and the release workflow files.", "unchecked: the advisories page on github.com answered 504 twice. The one published advisory was read from the GitHub API, and the full advisory text was not read.", "unchecked: the telemetry statement was checked by a search of the source for vendor hosts, not by an audit of every outbound call.", "The 1 April 2026 merge incident took 1 point. Whether any unreviewed merge reached a tagged release was not established.", "The site heading says shell access you can audit, while the docs say command execution is not audited and receipts are opt-in. Recorded as a weakness with no deduction.", "No company form or address for ZeroClaw Labs was found, and the site publishes no terms or privacy policy." ] }, "negative": -3, "negativeNotes": [ "2026-09-05. GHSA-93f6-34w8-5g98 (high), an unvalidated `wasm_path` let `zeroclaw plugin install` write an attacker-controlled file outside the plugins directory in 0.8.4 and earlier. Fixed in 0.8.5 and published the same day, inside six months, -2. https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98", "2026-04-01. The project lead wrote that a maintainer's AI automation merged pull requests that should not have gone through and that GitHub took enforcement action on the organisation. Disclosed, the maintainer removed and merge access tightened, over six months old, -1. https://www.zeroclaw.com/blog/community-and-stability" ], "verdict": "Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.", "bestFor": "One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model.", "strengths": [ "Supervised mode is the default. Tools outside an eleven-item read-only and fetch list prompt the owner, and an unanswered prompt is a denial after 120 seconds", "Approval prompts arrive on the channel in use, and `approval_route` can send them to a separate approver channel that denies when unreachable", "Channel secrets and provider keys are encrypted with ChaCha20-Poly1305 in `config.toml`, with the key in `.secret_key` at mode 0600", "An empty peer set denies every inbound sender, and the gateway binds 127.0.0.1 with pairing required by default", "Three tagged releases in the 90 days to 12 October 2026, each with a Breaking Changes section, and CI passing on master on 11 October" ], "weaknesses": [ "The docs state that command execution is not audited. `[security.audit]` records certificate events only, and tool receipts are opt-in and not durable", "No privacy policy, terms or security.txt on zeroclaw.com, and the home page links none", "`web_fetch`, `web_search_tool` and `browser_open` run without approval by default, and sandboxed tools keep full network egress", "GHSA-93f6-34w8-5g98 (high) let a plugin install write outside the plugins directory in 0.8.4 and earlier, fixed in 0.8.5 on 5 September 2026", "Version 0.8.5 is pre-1.0, patch releases carry breaking changes, and 576 issues and 384 pull requests were open on 12 October 2026" ], "agentNotes": [ "Keep `[risk_profiles.\u003calias\u003e] level = \"supervised\"`. `full` runs every tool not listed in `always_ask`, and the YOLO preset removes the sandbox and path rules too", "Add sending and account tools such as `send_via`, `google_workspace` and `http_request` to `always_ask` so a session-level Always grant cannot skip the prompt", "List senders in `[peer_groups.\u003cname\u003e] external_peers`. `[\"*\"]` accepts anyone on that channel", "Set `[web_fetch].allowed_domains` and `[http_request].allowed_domains`. Fetches run unprompted and the OS sandbox does not block egress", "Run one-shot tasks with `zeroclaw agent -a \u003calias\u003e -m \"\u003ctask\u003e\"`. A cron or webhook turn has no prompt, so shell calls fall to the command policy" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.2 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 60, "reliability": 74, "schema": 82, "security": 76, "transparency": 74 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/install.sh | sh # or: brew install zeroclaw", "headless": { "command": "zeroclaw agent -a \u003calias\u003e -m \"$TASK\"", "setup": "zeroclaw quickstart" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/zeroclaw" }, "notable": [ "Supervised autonomy is the default. Low-risk tools run, medium-risk tools ask the operator and high-risk calls are blocked (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/autonomy.md)", "The security model page says audit logging covers certificate issuance and renewal only and that command execution is not audited (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/model.md)", "One published advisory, GHSA-93f6-34w8-5g98 (high), published 5 September 2026. An unvalidated `wasm_path` let `zeroclaw plugin install` write outside the plugins directory in 0.8.4 and earlier, fixed in 0.8.5 (https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98)", "A post of 1 April 2026 by the project lead says a maintainer's AI automation merged pull requests that should not have gone through, that GitHub took enforcement action on the organisation, and that the maintainer was removed (https://www.zeroclaw.com/blog/community-and-stability)", "The licence is MIT or Apache-2.0 at the user's choice. GitHub's API reports only Apache-2.0 (https://github.com/zeroclaw-labs/zeroclaw/blob/master/README.md)", "Version 0.8.5 added a `zerorouter` provider slot that defaults to a hosted beta model gateway at zerorouter.ai (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/providers/catalog.md)", "The philosophy page says no telemetry, no cloud tenancy and no licence server (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/philosophy/you-own-it.md)", "The home page shows v1.0 as planned and says the v0.8.x line has shipped about monthly since June 2026 (https://www.zeroclaw.com/)" ], "area": "frameworks", "details": [ { "label": "Where it runs", "value": "One Rust binary on the owner's machine, VPS or single-board computer, as a CLI, a daemon or a system service. State lives under `~/.zeroclaw/` (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/runtime-state-and-persistence.md)" }, { "label": "Acts without asking", "value": "By default `file_read`, `memory_recall`, `web_search_tool`, `web_fetch`, `calculator`, `glob_search`, `content_search`, `image_info`, `weather`, `tool_search` and `browser_open` run unprompted. Replies to accepted senders are sent without a prompt. Every other tool asks (https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/schema.rs)" }, { "label": "Approval controls", "value": "Three levels on a risk profile, `readonly`, `supervised` (default) and `full`. Per-tool `auto_approve`, `always_ask` and `excluded_tools`, a shell command allow list, optional one-time codes and `zeroclaw estop`. Prompts time out to a denial after 120 seconds (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/autonomy.md)" }, { "label": "Sandbox", "value": "Auto-detected. Landlock, Bubblewrap, Firejail or Docker on Linux, Seatbelt on macOS, AppContainer (experimental) on Windows. Files are confined to the workspace. Network egress stays open by default (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/sandboxing.md)" }, { "label": "Proactive work", "value": "Cron jobs the agent can create (`cron_add`), an optional heartbeat every 30 minutes that is off by default, and event-triggered procedures from MQTT, webhooks, cron and file changes" }, { "label": "Channels", "value": "The default build has ACP, webhook, email, Telegram, Discord and filesystem. Standard release builds add Git, Matrix, Lark and WhatsApp Web. Slack, Signal, LINE, Mattermost, iMessage, voice calls and others need compile-time flags. The site says 30+ (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/overview.md)" }, { "label": "Who can message it", "value": "Senders are checked against `[peer_groups.\u003cname\u003e]`. An empty set denies everyone and `\"*\"` accepts anyone. The gateway requires a pairing token by default (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/peer-groups.md)" }, { "label": "Accounts", "value": "Mail by IMAP and SMTP with an app password, or Gmail push with an OAuth token. Opt-in tools for Google Workspace (through the external `gws` CLI, all 14 services unless narrowed), Microsoft 365, Notion, Jira, LinkedIn and Composio" }, { "label": "Credential storage", "value": "Secret fields in `config.toml` are encrypted with ChaCha20-Poly1305. The key is `~/.zeroclaw/.secret_key`, mode 0600, on the same disk. Google Workspace credentials stay with the `gws` CLI (https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/secrets.rs)" }, { "label": "Memory", "value": "SQLite under `data/memory/` by default, with Markdown, PostgreSQL, Qdrant and Lucid as alternatives. Conversation autosave is on by default. Session history is a separate SQLite file" }, { "label": "Deleting memory", "value": "`memory_forget` removes one entry and `memory_purge` a namespace or session. The Markdown backend is append-only and does not delete entries. Session history, logs and the cost ledger are separate files (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/decisions/ADR-005-pluggable-memory-backends.md)" }, { "label": "Model providers", "value": "Anthropic, OpenAI, Gemini, Bedrock, Azure OpenAI, Ollama and any OpenAI-compatible endpoint, with the owner's key. Prompts, recalled memory and tool results go to the chosen provider. The site says 70+ providers, the README about 20 others" }, { "label": "Other outbound traffic", "value": "The docs state no telemetry. Web search goes to DuckDuckGo by default. The `zerorouter` provider slot defaults to the vendor's hosted beta at zerorouter.ai when chosen" }, { "label": "MCP client", "value": "stdio, HTTP and SSE. A server reaches an agent only through that agent's `mcp_bundles`. Tools are named `\u003cserver\u003e__\u003ctool\u003e` (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/tools/mcp.md)" }, { "label": "Interfaces for other programs", "value": "Gateway REST and WebSocket on 127.0.0.1:42617 with an OpenAPI document at `/api/openapi.json`, ACP over stdio, and `zeroclaw agent -a \u003calias\u003e -m`" }, { "label": "Audit", "value": "Approval events and runtime logs go to `data/state/runtime-trace.jsonl`. Command execution is not audited. Tool receipts (HMAC-SHA256) are opt-in with an in-memory key (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/model.md)" }, { "label": "Cost", "value": "Free. The owner pays the model provider, or nothing with a local model. Daily and monthly budgets and a cost ledger are built in" }, { "label": "Releases in 90 days", "value": "3 (v0.8.3 on 16 July, v0.8.4 on 2 August, v0.8.5 on 5 September 2026)" } ], "provenance": { "legalEntity": "ZeroClaw Labs", "domain": "zeroclaw.com", "domainRegistered": "2026-03-02", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/zeroclaw-labs/zeroclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The NOTICE file reads Copyright 2025 ZeroClaw Labs and the blog signs posts as CEO, ZeroClaw Labs. No company form, registration or address was found on the site or in the repository.", "The home page of www.zeroclaw.com links no terms and no privacy policy, so both fields are empty and the MIT or Apache-2.0 licence stands in.", "www.zeroclaw.com/.well-known/security.txt answered 404 on 12 October 2026. SECURITY.md asks for GitHub private vulnerability reporting and the README gives security@zeroclaw.dev.", "RDAP gives zeroclaw.com a registration date of 2026-03-02, registrar Atom.com Domains LLC. The repository was created on 13 February 2026.", "There is no hosted endpoint for the assistant. A gateway answers on its owner's own host." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "ZeroClaw Labs", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "zeroclaw.com, registered 2026-03-02 (under a year)", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT OR Apache-2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zeroclaw.json" } }