{ "data": { "category": { "area": "frameworks", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "description": "Assistants that work for one person across their own mail, calendar, messages and files, remember them, and act without being asked each time. Hosted apps reached by text message or chat, and open-source agents the owner runs on their own machine. Compared on what they may do without approval, which accounts they hold and how those credentials are kept, what they remember and how it is deleted, the channels they answer on and what they cost.", "json": "https://www.anchorterminal.com/categories/personal-assistants.json", "name": "Personal assistants", "slug": "personal-assistants", "test": "In this run, public evidence against the published checklist, with hosted assistants read as hosted services and self-hosted ones as software the owner runs. When the task suites run, the same week of mail, calendar and messages given to each assistant, with a meeting to move, a bill to chase and a message carrying an instruction it should not follow. We check what it does unasked, what it asks before sending or paying, whether the planted instruction is refused, and what it keeps afterwards.", "title": "AI personal assistants that act for one person", "toolCount": 20, "tools": [ "zeroclaw", "nanoclaw", "hermes-agent", "openclaw", "ironclaw", "nanobot", "qwenpaw", "astrbot", "cowagent", "gaia", "picoclaw", "grok-bot", "zo-computer", "leon", "poke", "lindy", "openai-dots", "gemini-spark", "haven", "instinct" ], "url": "https://www.anchorterminal.com/categories/personal-assistants" }, "faq": [ { "answer": "ZeroClaw has the highest benchmark score of the 20 ranked AI personal assistants that act for one person, 70.2 (BB). NanoClaw is second with 68.3 (B).", "question": "What are the highest-rated AI personal assistants that act for one person for AI agents?" }, { "answer": "1 of the 20 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.", "question": "How many AI personal assistants that act for one person are agent-ready?" }, { "answer": "None of the ranked listings here accepts x402 for its main call yet.", "question": "Which AI personal assistants that act for one person accept x402 payments?" }, { "answer": "By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 12 October 2026.", "question": "How is this list ranked?" } ], "howToChoose": [ { "label": "What it does without asking", "detail": "Check which actions run without approval, such as sending mail, paying or deleting, since an assistant that acts unasked can act on an instruction hidden in a message it read." }, { "label": "Accounts and how credentials are kept", "detail": "Check which accounts it connects to, with what scope, and where the tokens are stored, because one assistant can hold the keys to a person's mail, calendar, files and money." }, { "label": "Memory and deletion", "detail": "Check what it remembers about the owner, where that is stored and whether deleting it removes every copy, since the memory is a profile of one person." }, { "label": "Where it runs and what leaves", "detail": "Check whether it runs on the owner's machine or the vendor's servers and which model provider sees the content, since private messages may pass through several companies." }, { "label": "Channels and cost", "detail": "Check which messaging apps it answers on and what a month of use costs, including model usage billed separately for self-hosted assistants." } ], "picks": [ { "also": { "name": "NanoClaw", "slug": "nanoclaw", "why": "B, 68.3/100" }, "name": "ZeroClaw", "need": "Highest score overall", "slug": "zeroclaw", "why": "BB, 70.2/100 on the benchmark" }, { "name": "CowAgent", "need": "Reliability", "slug": "cowagent", "why": "84/100 on reliability, against 74 for the overall leader" }, { "name": "OpenClaw", "need": "Schema \u0026 documentation", "slug": "openclaw", "why": "84/100 on schema \u0026 documentation, against 82 for the overall leader" }, { "name": "Hermes Agent", "need": "Agent ergonomics", "slug": "hermes-agent", "why": "80/100 on agent ergonomics, against 72 for the overall leader" }, { "name": "OpenClaw", "need": "Maintenance \u0026 community", "slug": "openclaw", "why": "86/100 on maintenance \u0026 community, against 80 for the overall leader" }, { "name": "IronClaw", "need": "Transparency \u0026 trust", "slug": "ironclaw", "why": "75/100 on transparency \u0026 trust, against 64 for the overall leader" } ], "ranked": 20, "shortlist": [ { "bestFor": "One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model.", "grade": "BB", "name": "ZeroClaw", "position": 1, "price": "Free · OSS", "score": 70.2, "slug": "zeroclaw", "strengths": [ "Supervised mode is the default. Tools outside an eleven-item read-only and fetch list prompt the owner, and an unanswered prompt is a denial after 120 seconds", "Approval prompts arrive on the channel in use, and `approval_route` can send them to a separate approver channel that denies when unreachable", "Channel secrets and provider keys are encrypted with ChaCha20-Poly1305 in `config.toml`, with the key in `.secret_key` at mode 0600" ], "url": "https://www.anchorterminal.com/tools/zeroclaw", "verdict": "Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.", "weaknesses": [ "The docs state that command execution is not audited. `[security.audit]` records certificate events only, and tool receipts are opt-in and not durable", "No privacy policy, terms or security.txt on zeroclaw.com, and the home page links none", "`web_fetch`, `web_search_tool` and `browser_open` run without approval by default, and sandboxed tools keep full network egress" ], "where": "local", "x402": "no" }, { "bestFor": "A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.", "grade": "B", "name": "NanoClaw", "position": 2, "price": "Free · OSS", "score": 68.3, "slug": "nanoclaw", "strengths": [ "Each session runs in a non-root Docker container with all capabilities dropped, and the project root and `.env` are never mounted", "API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders", "Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial" ], "url": "https://www.anchorterminal.com/tools/nanoclaw", "verdict": "Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.", "weaknesses": [ "The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt", "Egress lockdown is off by default, so a container can reach the internet directly unless `NANOCLAW_EGRESS_LOCKDOWN=true` is set", "The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404" ], "where": "local", "x402": "no" }, { "bestFor": "A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model.", "grade": "B", "name": "Hermes Agent", "position": 3, "price": "Free · OSS", "score": 67.9, "slug": "hermes-agent", "strengths": [ "Every saved-card fill asks for approval, and cron, webhook and API sessions are refused because nobody can confirm", "The messaging gateway denies all senders until an allowlist or a pairing code approved on the CLI is in place", "The docs say no telemetry, usage data or analytics is collected, and conversations, memory and skills stay in `~/.hermes/`" ], "url": "https://www.anchorterminal.com/tools/hermes-agent", "verdict": "Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.", "weaknesses": [ "The default terminal backend runs commands on the host, and the default `smart` mode lets an auxiliary model approve commands it rates low-risk", "The Google Workspace skill requests full Gmail, Calendar and Drive scopes, and its confirm-before-sending rule is an instruction in SKILL.md, not enforced in code", "Memory writes are saved without approval by default (`memory.write_approval: false`), including from a background review after each turn" ], "where": "local", "x402": "no" }, { "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.", "grade": "B", "name": "OpenClaw", "position": 4, "price": "Free · OSS", "score": 67.1, "slug": "openclaw", "strengths": [ "State, memory and credentials stay under `~/.openclaw` on the owner's machine, and the project sells no hosted service or paid tier", "Memory is plain Markdown files in the workspace, and `openclaw memory forget` removes what a named session contributed", "Four session permission modes (`read-only`, `guarded`, `workspace`, `full`), exec approvals and an optional Docker or Podman tool sandbox" ], "url": "https://www.anchorterminal.com/tools/openclaw", "verdict": "Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.", "weaknesses": [ "Without configuration the default is full access. Host exec runs with no approval and sandboxing is off", "Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send", "722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page" ], "where": "local", "x402": "no" }, { "bestFor": "One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.", "grade": "B", "name": "IronClaw", "position": 5, "price": "$20 / mo", "score": 66.7, "slug": "ironclaw", "strengths": [ "Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it", "Each extension tool declares a default permission, effects, network targets and OAuth scopes in `manifest.toml`. Gmail reads use `gmail.readonly` and sends use `gmail.send`", "Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox" ], "url": "https://www.anchorterminal.com/tools/ironclaw", "verdict": "Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off.", "weaknesses": [ "Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask", "The `main` branch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open", "Docs pages for heartbeat, cron, shell and WASM limits name settings such as `HEARTBEAT_ENABLED` and `ALLOW_LOCAL_TOOLS` that do not appear in the 1.4.1 source" ], "where": "local", "x402": "no" }, { "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "grade": "B", "name": "nanobot", "position": 6, "price": "Free · OSS", "score": 62.4, "slug": "nanobot", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5", "Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back", "Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves" ], "url": "https://www.anchorterminal.com/tools/nanobot", "verdict": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "weaknesses": [ "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none", "Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch" ], "where": "local", "x402": "no" }, { "bestFor": "One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice.", "grade": "B", "name": "QwenPaw", "position": 7, "price": "Free · OSS", "score": 62.2, "slug": "qwenpaw", "strengths": [ "New mail driver cards default to the `ask` policy, and automatic mail handling may not call `delete_message` or write to unknown recipients", "Kernel sandbox on macOS, Linux and Windows, with a documented list of constraints each backend does not enforce", "Model keys, mail credentials and environment secrets are encrypted with a master key held in the OS keychain or a 0600 file" ], "url": "https://www.anchorterminal.com/tools/qwenpaw", "verdict": "Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.", "weaknesses": [ "Usage data is on by default, `qwenpaw init --defaults` accepts it without a prompt, and the opt-out variable is absent from the README and docs", "The default approval level AUTO asks only for tool calls a guard rule flags, and `/proactive` skips approval prompts entirely", "Channel direct-message and group policies default to `open`, and Console login is off by default" ], "where": "local", "x402": "no" }, { "bestFor": "Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins.", "grade": "C", "name": "AstrBot", "position": 8, "price": "Free · OSS", "score": 58.8, "slug": "astrbot", "strengths": [ "Official adapters for 14 messaging platforms in the README table, among them QQ, Telegram, Slack, Discord, LINE, Lark, DingTalk and WeCom", "Agent shell, Python and file tools are off by default (`computer_use_runtime` is `none`) and limited to administrators when turned on", "HTTP API under `/api/v1` with a published OpenAPI file of 170 paths and API keys limited by 11 scopes, stored as PBKDF2 hashes" ], "url": "https://www.anchorterminal.com/tools/astrbot", "verdict": "Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.", "weaknesses": [ "No approval step before any tool call. The agent sends messages, creates scheduled tasks and calls MCP tools without asking", "No built-in mail, calendar or file-account connector and no long-term memory of the owner. Both depend on third-party plugins or MCP servers", "Usage statistics are on by default and include the hostname and an installation ID, while the EULA says nothing personally identifiable is collected" ], "where": "local", "x402": "no" }, { "bestFor": "One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers.", "grade": "C", "name": "CowAgent", "position": 9, "price": "Free · OSS", "score": 58.5, "slug": "cowagent", "strengths": [ "Memory is plain Markdown under `~/cow` (`MEMORY.md`, `memory/YYYY-MM-DD.md`), readable and removable by the owner", "Three permission modes per session (read-only, workspace-write, full-access), with a global default in `agent_permission_mode`", "The web console binds to 127.0.0.1 by default, and the cloud client loads only when `use_linkai` and a deployment id are both set" ], "url": "https://www.anchorterminal.com/tools/cowagent", "verdict": "MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.", "weaknesses": [ "Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call", "The permission checks read arguments and are not an OS sandbox, as the source says. The `bash` blocklist covers only root deletion, disk wiping and power commands", "Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master" ], "where": "local", "x402": "no" }, { "bestFor": "It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source.", "grade": "D", "name": "GAIA", "position": 10, "price": "$30 / mo", "score": 49.5, "slug": "gaia", "strengths": [ "The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.", "Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.", "Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control." ], "url": "https://www.anchorterminal.com/tools/gaia", "verdict": "GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.", "weaknesses": [ "The default approval mode in the source is `always_allow`, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval.", "The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.", "The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product." ], "where": "local", "x402": "no" } ], "updated": "2026-10-12" }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/best/personal-assistants/", "json": "https://www.anchorterminal.com/best/personal-assistants/index.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/best/personal-assistants/index.md", "slim": "https://www.anchorterminal.com/best/personal-assistants/index.min.md" }, "markdown": "The 10 highest-scoring of 20 AI personal assistants that act for one person on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.\n\n- Ranked: 20 · agent-ready (BB or better): 1 · accept x402: 0 · hosted endpoints: 1\n- Full ranked table: https://www.anchorterminal.com/categories/personal-assistants.md\n- Head-to-head comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md (190)\n- Methodology: https://www.anchorterminal.com/benchmark/index.md\n\n## The shortlist\n\n| # | Tool | Grade | Score | Best for | Price | Where |\n| --- | --- | --- | --- | --- | --- | --- |\n| 1 | [ZeroClaw](https://www.anchorterminal.com/tools/zeroclaw.md) | BB | 70.2 | One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model. | Free · OSS | Local |\n| 2 | [NanoClaw](https://www.anchorterminal.com/tools/nanoclaw.md) | B | 68.3 | A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork. | Free · OSS | Local |\n| 3 | [Hermes Agent](https://www.anchorterminal.com/tools/hermes-agent.md) | B | 67.9 | A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model. | Free · OSS | Local |\n| 4 | [OpenClaw](https://www.anchorterminal.com/tools/openclaw.md) | B | 67.1 | A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete. | Free · OSS | Local |\n| 5 | [IronClaw](https://www.anchorterminal.com/tools/ironclaw.md) | B | 66.7 | One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach. | $20 / mo | Local |\n| 6 | [nanobot](https://www.anchorterminal.com/tools/nanobot.md) | B | 62.4 | A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model. | Free · OSS | Local |\n| 7 | [QwenPaw](https://www.anchorterminal.com/tools/qwenpaw.md) | B | 62.2 | One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice. | Free · OSS | Local |\n| 8 | [AstrBot](https://www.anchorterminal.com/tools/astrbot.md) | C | 58.8 | Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins. | Free · OSS | Local |\n| 9 | [CowAgent](https://www.anchorterminal.com/tools/cowagent.md) | C | 58.5 | One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers. | Free · OSS | Local |\n| 10 | [GAIA](https://www.anchorterminal.com/tools/gaia.md) | D | 49.5 | It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source. | $30 / mo | Local |\n\n## Picks by need\n\n- Highest score overall: [ZeroClaw](https://www.anchorterminal.com/tools/zeroclaw.md), BB, 70.2/100 on the benchmark. Also [NanoClaw](https://www.anchorterminal.com/tools/nanoclaw.md), B, 68.3/100.\n- Reliability: [CowAgent](https://www.anchorterminal.com/tools/cowagent.md), 84/100 on reliability, against 74 for the overall leader.\n- Schema \u0026 documentation: [OpenClaw](https://www.anchorterminal.com/tools/openclaw.md), 84/100 on schema \u0026 documentation, against 82 for the overall leader.\n- Agent ergonomics: [Hermes Agent](https://www.anchorterminal.com/tools/hermes-agent.md), 80/100 on agent ergonomics, against 72 for the overall leader.\n- Maintenance \u0026 community: [OpenClaw](https://www.anchorterminal.com/tools/openclaw.md), 86/100 on maintenance \u0026 community, against 80 for the overall leader.\n- Transparency \u0026 trust: [IronClaw](https://www.anchorterminal.com/tools/ironclaw.md), 75/100 on transparency \u0026 trust, against 64 for the overall leader.\n\n## How to choose\n\n- What it does without asking: Check which actions run without approval, such as sending mail, paying or deleting, since an assistant that acts unasked can act on an instruction hidden in a message it read.\n- Accounts and how credentials are kept: Check which accounts it connects to, with what scope, and where the tokens are stored, because one assistant can hold the keys to a person's mail, calendar, files and money.\n- Memory and deletion: Check what it remembers about the owner, where that is stored and whether deleting it removes every copy, since the memory is a profile of one person.\n- Where it runs and what leaves: Check whether it runs on the owner's machine or the vendor's servers and which model provider sees the content, since private messages may pass through several companies.\n- Channels and cost: Check which messaging apps it answers on and what a month of use costs, including model usage billed separately for self-hosted assistants.\n\n- How the benchmark tests this category: In this run, public evidence against the published checklist, with hosted assistants read as hosted services and self-hosted ones as software the owner runs. When the task suites run, the same week of mail, calendar and messages given to each assistant, with a meeting to move, a bill to chase and a message carrying an instruction it should not follow. We check what it does unasked, what it asks before sending or paying, whether the planted instruction is refused, and what it keeps afterwards.\n\n## Each one in detail\n\n### 1. ZeroClaw, BB 70.2/100\n\nOpen-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite.\n\n- Verdict: Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.\n- Best for: One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model.\n- Strength: Supervised mode is the default. Tools outside an eleven-item read-only and fetch list prompt the owner, and an unanswered prompt is a denial after 120 seconds\n- Strength: Approval prompts arrive on the channel in use, and `approval_route` can send them to a separate approver channel that denies when unreachable\n- Strength: Channel secrets and provider keys are encrypted with ChaCha20-Poly1305 in `config.toml`, with the key in `.secret_key` at mode 0600\n- Weakness: The docs state that command execution is not audited. `[security.audit]` records certificate events only, and tool receipts are opt-in and not durable\n- Weakness: No privacy policy, terms or security.txt on zeroclaw.com, and the home page links none\n- Weakness: `web_fetch`, `web_search_tool` and `browser_open` run without approval by default, and sandboxed tools keep full network egress\n- Price: Free · OSS · Auth: None · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/zeroclaw.md\n\n### 2. NanoClaw, B 68.3/100\n\nOpen-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.\n\n- Verdict: Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.\n- Best for: A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.\n- Strength: Each session runs in a non-root Docker container with all capabilities dropped, and the project root and `.env` are never mounted\n- Strength: API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders\n- Strength: Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial\n- Weakness: The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt\n- Weakness: Egress lockdown is off by default, so a container can reach the internet directly unless `NANOCLAW_EGRESS_LOCKDOWN=true` is set\n- Weakness: The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404\n- Price: Free · OSS · Auth: None · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/nanoclaw.md\n- Against #1: https://www.anchorterminal.com/compare/nanoclaw-vs-zeroclaw.md\n\n### 3. Hermes Agent, B 67.9/100\n\nOpen-source personal agent from Nous Research that the owner runs on a computer or server. It answers on messaging apps, keeps memory between sessions, runs scheduled jobs and connects to accounts, models and MCP servers the owner configures.\n\n- Verdict: Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.\n- Best for: A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model.\n- Strength: Every saved-card fill asks for approval, and cron, webhook and API sessions are refused because nobody can confirm\n- Strength: The messaging gateway denies all senders until an allowlist or a pairing code approved on the CLI is in place\n- Strength: The docs say no telemetry, usage data or analytics is collected, and conversations, memory and skills stay in `~/.hermes/`\n- Weakness: The default terminal backend runs commands on the host, and the default `smart` mode lets an auxiliary model approve commands it rates low-risk\n- Weakness: The Google Workspace skill requests full Gmail, Calendar and Drive scopes, and its confirm-before-sending rule is an instruction in SKILL.md, not enforced in code\n- Weakness: Memory writes are saved without approval by default (`memory.write_approval: false`), including from a background review after each turn\n- Price: Free · OSS · Auth: None · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/hermes-agent.md\n- Against #1: https://www.anchorterminal.com/compare/hermes-agent-vs-zeroclaw.md\n\n### 4. OpenClaw, B 67.1/100\n\nOpen-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.\n\n- Verdict: Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.\n- Best for: A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.\n- Strength: State, memory and credentials stay under `~/.openclaw` on the owner's machine, and the project sells no hosted service or paid tier\n- Strength: Memory is plain Markdown files in the workspace, and `openclaw memory forget` removes what a named session contributed\n- Strength: Four session permission modes (`read-only`, `guarded`, `workspace`, `full`), exec approvals and an optional Docker or Podman tool sandbox\n- Weakness: Without configuration the default is full access. Host exec runs with no approval and sandboxing is off\n- Weakness: Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send\n- Weakness: 722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page\n- Price: Free · OSS · Auth: OAuth or key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/openclaw.md\n- Against #1: https://www.anchorterminal.com/compare/openclaw-vs-zeroclaw.md\n\n### 5. IronClaw, B 66.7/100\n\nIronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory.\n\n- Verdict: Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off.\n- Best for: One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.\n- Strength: Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it\n- Strength: Each extension tool declares a default permission, effects, network targets and OAuth scopes in `manifest.toml`. Gmail reads use `gmail.readonly` and sends use `gmail.send`\n- Strength: Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox\n- Weakness: Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask\n- Weakness: The `main` branch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open\n- Weakness: Docs pages for heartbeat, cron, shell and WASM limits name settings such as `HEARTBEAT_ENABLED` and `ALLOW_LOCAL_TOOLS` that do not appear in the 1.4.1 source\n- Price: $20 / mo · Auth: OAuth or key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/ironclaw.md\n- Against #1: https://www.anchorterminal.com/compare/ironclaw-vs-zeroclaw.md\n\n### 6. nanobot, B 62.4/100\n\nnanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.\n\n- Verdict: nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.\n- Best for: A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.\n- Strength: MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5\n- Strength: Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back\n- Strength: Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves\n- Weakness: No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking\n- Weakness: `tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none\n- Weakness: Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch\n- Price: Free · OSS · Auth: None · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/nanobot.md\n- Against #1: https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw.md\n\n### 7. QwenPaw, B 62.2/100\n\nOpen-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files.\n\n- Verdict: Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.\n- Best for: One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice.\n- Strength: New mail driver cards default to the `ask` policy, and automatic mail handling may not call `delete_message` or write to unknown recipients\n- Strength: Kernel sandbox on macOS, Linux and Windows, with a documented list of constraints each backend does not enforce\n- Strength: Model keys, mail credentials and environment secrets are encrypted with a master key held in the OS keychain or a 0600 file\n- Weakness: Usage data is on by default, `qwenpaw init --defaults` accepts it without a prompt, and the opt-out variable is absent from the README and docs\n- Weakness: The default approval level AUTO asks only for tool calls a guard rule flags, and `/proactive` skips approval prompts entirely\n- Weakness: Channel direct-message and group policies default to `open`, and Console login is off by default\n- Price: Free · OSS · Auth: None · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/qwenpaw.md\n- Against #1: https://www.anchorterminal.com/compare/qwenpaw-vs-zeroclaw.md\n\n### 8. AstrBot, C 58.8/100\n\nAstrBot is an open-source chatbot and agent program that the owner runs and connects to messaging platforms such as QQ, Telegram, Slack, Discord, Lark and WeCom, with scheduled tasks, MCP tools, plugins and a web admin panel.\n\n- Verdict: Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.\n- Best for: Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins.\n- Strength: Official adapters for 14 messaging platforms in the README table, among them QQ, Telegram, Slack, Discord, LINE, Lark, DingTalk and WeCom\n- Strength: Agent shell, Python and file tools are off by default (`computer_use_runtime` is `none`) and limited to administrators when turned on\n- Strength: HTTP API under `/api/v1` with a published OpenAPI file of 170 paths and API keys limited by 11 scopes, stored as PBKDF2 hashes\n- Weakness: No approval step before any tool call. The agent sends messages, creates scheduled tasks and calls MCP tools without asking\n- Weakness: No built-in mail, calendar or file-account connector and no long-term memory of the owner. Both depend on third-party plugins or MCP servers\n- Weakness: Usage statistics are on by default and include the hostname and an installation ID, while the EULA says nothing personally identifiable is collected\n- Price: Free · OSS · Auth: OAuth or key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/astrbot.md\n- Against #1: https://www.anchorterminal.com/compare/astrbot-vs-zeroclaw.md\n\n### 9. CowAgent, C 58.5/100\n\nCowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.\n\n- Verdict: MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.\n- Best for: One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers.\n- Strength: Memory is plain Markdown under `~/cow` (`MEMORY.md`, `memory/YYYY-MM-DD.md`), readable and removable by the owner\n- Strength: Three permission modes per session (read-only, workspace-write, full-access), with a global default in `agent_permission_mode`\n- Strength: The web console binds to 127.0.0.1 by default, and the cloud client loads only when `use_linkai` and a deployment id are both set\n- Weakness: Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call\n- Weakness: The permission checks read arguments and are not an OS sandbox, as the source says. The `bash` blocklist covers only root deletion, disk wiping and power commands\n- Weakness: Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master\n- Price: Free · OSS · Auth: OAuth or key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/cowagent.md\n- Against #1: https://www.anchorterminal.com/compare/cowagent-vs-zeroclaw.md\n\n### 10. GAIA, D 49.5/100\n\nGAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting.\n\n- Verdict: GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.\n- Best for: It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source.\n- Strength: The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.\n- Strength: Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.\n- Strength: Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control.\n- Weakness: The default approval mode in the source is `always_allow`, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval.\n- Weakness: The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.\n- Weakness: The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product.\n- Price: $30 / mo · Auth: OAuth · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/gaia.md\n- Against #1: https://www.anchorterminal.com/compare/gaia-vs-zeroclaw.md\n\n10 more are ranked in the full table: https://www.anchorterminal.com/categories/personal-assistants.md\n\n## Head to head\n\n- [NanoClaw vs ZeroClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-zeroclaw.md)\n- [Hermes Agent vs ZeroClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-zeroclaw.md)\n- [OpenClaw vs ZeroClaw](https://www.anchorterminal.com/compare/openclaw-vs-zeroclaw.md)\n- [IronClaw vs ZeroClaw](https://www.anchorterminal.com/compare/ironclaw-vs-zeroclaw.md)\n- [Hermes Agent vs NanoClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-nanoclaw.md)\n- [NanoClaw vs OpenClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-openclaw.md)\n- [IronClaw vs NanoClaw](https://www.anchorterminal.com/compare/ironclaw-vs-nanoclaw.md)\n- [Hermes Agent vs OpenClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-openclaw.md)\n- [Hermes Agent vs IronClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-ironclaw.md)\n- [IronClaw vs OpenClaw](https://www.anchorterminal.com/compare/ironclaw-vs-openclaw.md)\n\n## Questions\n\n### What are the highest-rated AI personal assistants that act for one person for AI agents?\n\nZeroClaw has the highest benchmark score of the 20 ranked AI personal assistants that act for one person, 70.2 (BB). NanoClaw is second with 68.3 (B).\n\n### How many AI personal assistants that act for one person are agent-ready?\n\n1 of the 20 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.\n\n### Which AI personal assistants that act for one person accept x402 payments?\n\nNone of the ranked listings here accepts x402 for its main call yet.\n\n### How is this list ranked?\n\nBy the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 12 October 2026.\n\n## How this list is made\n\nThe order is the Anchor benchmark score, the same number as on each listing. Each listing is graded from public evidence against the benchmark checklist, and the picks are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Best of", "url": "https://www.anchorterminal.com/best/" }, { "name": "Personal assistants", "url": "" } ], "description": "ZeroClaw (BB), NanoClaw (B) and Hermes Agent (B) lead the 20 ranked AI personal assistants that act for one person. Picks by need, strengths, weaknesses and prices from the Anchor benchmark.", "facts": [ "ZeroClaw BB", "NanoClaw B", "Hermes Agent B" ], "h1": "Best AI personal assistants that act for one person", "image": "https://www.anchorterminal.com/assets/og/best-personal-assistants.png", "path": "/best/personal-assistants/", "published": "", "section": "tools", "title": "Best AI personal assistants that act for one person in 2026, ranked", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/best/personal-assistants/" }, "tokens": { "markdown": 6850, "slim": 1580 }, "version": 1 }