Best of · Agent frameworks
Best AI personal assistants that act for one person
The 10 highest-scoring of 20 AI personal assistants that act for one person on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.
- 20 ranked
- 1 agent-ready
- 1 hosted endpoints
- Updated 12 October 2026
Top three
Picks by need
Worked out from the scores, prices and facts, so they change when the research does.
The shortlist
| # | Tool | Grade | Best for | Price | Where |
|---|---|---|---|---|---|
| 1 | ZeroClaw ZeroClaw Labs |
BB 70.2 | One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model. | Free · OSS | Local |
| 2 | NanoClaw NanoCo, Inc. |
B 68.3 | A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork. | Free · OSS | Local |
| 3 | Hermes Agent Nous Research |
B 67.9 | A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model. | Free · OSS | Local |
| 4 | OpenClaw OpenClaw Foundation |
B 67.1 | A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete. | Free · OSS | Local |
| 5 | IronClaw NEAR AI |
B 66.7 | One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach. | $20 / mo | Local |
| 6 | nanobot HKUDS |
B 62.4 | A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model. | Free · OSS | Local |
| 7 | QwenPaw AgentScope |
B 62.2 | One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice. | Free · OSS | Local |
| 8 | AstrBot AstrBotDevs |
C 58.8 | Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins. | Free · OSS | Local |
| 9 | CowAgent zhayujie |
C 58.5 | One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers. | Free · OSS | Local |
| 10 | GAIA The Experience Company |
D 49.5 | It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source. | $30 / mo | Local |
10 more are ranked in the full table.
How to choose
- What it does without askingCheck which actions run without approval, such as sending mail, paying or deleting, since an assistant that acts unasked can act on an instruction hidden in a message it read.
- Accounts and how credentials are keptCheck which accounts it connects to, with what scope, and where the tokens are stored, because one assistant can hold the keys to a person's mail, calendar, files and money.
- Memory and deletionCheck what it remembers about the owner, where that is stored and whether deleting it removes every copy, since the memory is a profile of one person.
- Where it runs and what leavesCheck whether it runs on the owner's machine or the vendor's servers and which model provider sees the content, since private messages may pass through several companies.
- Channels and costCheck which messaging apps it answers on and what a month of use costs, including model usage billed separately for self-hosted assistants.
How the benchmark tests this category. In this run, public evidence against the published checklist, with hosted assistants read as hosted services and self-hosted ones as software the owner runs. When the task suites run, the same week of mail, calendar and messages given to each assistant, with a meeting to move, a bill to chase and a message carrying an instruction it should not follow. We check what it does unasked, what it asks before sending or paying, whether the planted instruction is refused, and what it keeps afterwards.
Each one in detail
ZeroClaw
BB 70.2/100Open-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite.
Verdict Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.
Best for One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model.
Strengths
- Supervised mode is the default. Tools outside an eleven-item read-only and fetch list prompt the owner, and an unanswered prompt is a denial after 120 seconds
- Approval prompts arrive on the channel in use, and
approval_routecan send them to a separate approver channel that denies when unreachable - Channel secrets and provider keys are encrypted with ChaCha20-Poly1305 in
config.toml, with the key in.secret_keyat mode 0600
Weaknesses
- The docs state that command execution is not audited.
[security.audit]records certificate events only, and tool receipts are opt-in and not durable - No privacy policy, terms or security.txt on zeroclaw.com, and the home page links none
web_fetch,web_search_toolandbrowser_openrun without approval by default, and sandboxed tools keep full network egress
Price Free · OSSAuth Nonex402 NoLocal
NanoClaw
B 68.3/100Open-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.
Verdict Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.
Best for A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.
Strengths
- Each session runs in a non-root Docker container with all capabilities dropped, and the project root and
.envare never mounted - API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders
- Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial
Weaknesses
- The Claude provider runs with
permissionMode: 'bypassPermissions', so shell, file and web tools run inside the container with no prompt - Egress lockdown is off by default, so a container can reach the internet directly unless
NANOCLAW_EGRESS_LOCKDOWN=trueis set - The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404
Price Free · OSSAuth Nonex402 NoLocal
Hermes Agent
B 67.9/100Open-source personal agent from Nous Research that the owner runs on a computer or server. It answers on messaging apps, keeps memory between sessions, runs scheduled jobs and connects to accounts, models and MCP servers the owner configures.
Verdict Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.
Best for A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model.
Strengths
- Every saved-card fill asks for approval, and cron, webhook and API sessions are refused because nobody can confirm
- The messaging gateway denies all senders until an allowlist or a pairing code approved on the CLI is in place
- The docs say no telemetry, usage data or analytics is collected, and conversations, memory and skills stay in
~/.hermes/
Weaknesses
- The default terminal backend runs commands on the host, and the default
smartmode lets an auxiliary model approve commands it rates low-risk - The Google Workspace skill requests full Gmail, Calendar and Drive scopes, and its confirm-before-sending rule is an instruction in SKILL.md, not enforced in code
- Memory writes are saved without approval by default (
memory.write_approval: false), including from a background review after each turn
Price Free · OSSAuth Nonex402 NoLocal
OpenClaw
B 67.1/100Open-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.
Verdict Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.
Best for A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.
Strengths
- State, memory and credentials stay under
~/.openclawon the owner's machine, and the project sells no hosted service or paid tier - Memory is plain Markdown files in the workspace, and
openclaw memory forgetremoves what a named session contributed - Four session permission modes (
read-only,guarded,workspace,full), exec approvals and an optional Docker or Podman tool sandbox
Weaknesses
- Without configuration the default is full access. Host exec runs with no approval and sandboxing is off
- Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send
- 722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page
Price Free · OSSAuth OAuth or keyx402 NoLocal
IronClaw
B 66.7/100IronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory.
Verdict Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as gmail.send_message, run unprompted until the owner turns it off.
Best for One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.
Strengths
- Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it
- Each extension tool declares a default permission, effects, network targets and OAuth scopes in
manifest.toml. Gmail reads usegmail.readonlyand sends usegmail.send - Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox
Weaknesses
- Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask
- The
mainbranch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open - Docs pages for heartbeat, cron, shell and WASM limits name settings such as
HEARTBEAT_ENABLEDandALLOW_LOCAL_TOOLSthat do not appear in the 1.4.1 source
Price $20 / moAuth OAuth or keyx402 NoLocal
nanobot
B 62.4/100nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.
Verdict nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.
Best for A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.
Strengths
- MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5
- Long-term memory is plain files (
USER.md,SOUL.md,memory/MEMORY.md) versioned with Git, with/dream-logand/dream-restoreto inspect and roll back - Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves
Weaknesses
- No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking
tools.restrictToWorkspacedefaults to false andtools.exec.sandboxto empty. Neither sandbox restricts network access, and Windows has none- Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch
Price Free · OSSAuth Nonex402 NoLocal
QwenPaw
B 62.2/100Open-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files.
Verdict Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.
Best for One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice.
Strengths
- New mail driver cards default to the
askpolicy, and automatic mail handling may not calldelete_messageor write to unknown recipients - Kernel sandbox on macOS, Linux and Windows, with a documented list of constraints each backend does not enforce
- Model keys, mail credentials and environment secrets are encrypted with a master key held in the OS keychain or a 0600 file
Weaknesses
- Usage data is on by default,
qwenpaw init --defaultsaccepts it without a prompt, and the opt-out variable is absent from the README and docs - The default approval level AUTO asks only for tool calls a guard rule flags, and
/proactiveskips approval prompts entirely - Channel direct-message and group policies default to
open, and Console login is off by default
Price Free · OSSAuth Nonex402 NoLocal
AstrBot
C 58.8/100AstrBot is an open-source chatbot and agent program that the owner runs and connects to messaging platforms such as QQ, Telegram, Slack, Discord, Lark and WeCom, with scheduled tasks, MCP tools, plugins and a web admin panel.
Verdict Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.
Best for Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins.
Strengths
- Official adapters for 14 messaging platforms in the README table, among them QQ, Telegram, Slack, Discord, LINE, Lark, DingTalk and WeCom
- Agent shell, Python and file tools are off by default (
computer_use_runtimeisnone) and limited to administrators when turned on - HTTP API under
/api/v1with a published OpenAPI file of 170 paths and API keys limited by 11 scopes, stored as PBKDF2 hashes
Weaknesses
- No approval step before any tool call. The agent sends messages, creates scheduled tasks and calls MCP tools without asking
- No built-in mail, calendar or file-account connector and no long-term memory of the owner. Both depend on third-party plugins or MCP servers
- Usage statistics are on by default and include the hostname and an installation ID, while the EULA says nothing personally identifiable is collected
Price Free · OSSAuth OAuth or keyx402 NoLocal
CowAgent
C 58.5/100CowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.
Verdict MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.
Best for One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers.
Strengths
- Memory is plain Markdown under
~/cow(MEMORY.md,memory/YYYY-MM-DD.md), readable and removable by the owner - Three permission modes per session (read-only, workspace-write, full-access), with a global default in
agent_permission_mode - The web console binds to 127.0.0.1 by default, and the cloud client loads only when
use_linkaiand a deployment id are both set
Weaknesses
- Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call
- The permission checks read arguments and are not an OS sandbox, as the source says. The
bashblocklist covers only root deletion, disk wiping and power commands - Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master
Price Free · OSSAuth OAuth or keyx402 NoLocal
GAIA
D 49.5/100GAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting.
Verdict GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.
Best for It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source.
Strengths
- The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.
- Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.
- Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control.
Weaknesses
- The default approval mode in the source is
always_allow, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval. - The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.
- The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product.
Price $30 / moAuth OAuthx402 NoLocal
Head to head
- NanoClaw vs ZeroClaw B 68.3 vs BB 70.2
- Hermes Agent vs ZeroClaw B 67.9 vs BB 70.2
- OpenClaw vs ZeroClaw B 67.1 vs BB 70.2
- IronClaw vs ZeroClaw B 66.7 vs BB 70.2
- Hermes Agent vs NanoClaw B 67.9 vs B 68.3
- NanoClaw vs OpenClaw B 68.3 vs B 67.1
- IronClaw vs NanoClaw B 66.7 vs B 68.3
- Hermes Agent vs OpenClaw B 67.9 vs B 67.1
- Hermes Agent vs IronClaw B 67.9 vs B 66.7
- IronClaw vs OpenClaw B 66.7 vs B 67.1
Questions
What are the highest-rated AI personal assistants that act for one person for AI agents?
ZeroClaw has the highest benchmark score of the 20 ranked AI personal assistants that act for one person, 70.2 (BB). NanoClaw is second with 68.3 (B).
How many AI personal assistants that act for one person are agent-ready?
1 of the 20 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.
Which AI personal assistants that act for one person accept x402 payments?
None of the ranked listings here accepts x402 for its main call yet.
How is this list ranked?
By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 12 October 2026.
How this list is made
The order is the Anchor benchmark score, the same number as on each listing and in the top list. Each listing is graded from public evidence against the benchmark checklist, and the picks above are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.
Full ranked table · 190 head-to-head comparisons · Best tools in every category