# The best harnesses for a personal agent, by our grades (slim)

> The open-source programs people run to turn a model into a personal agent on their own machine, from OpenClaw to ZeroClaw and Hermes Agent, read against our grades and what each one does before it acts for you.

- Full: https://www.anchorterminal.com/blog/best-harnesses-for-personal-agents.md (~3,250 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/blog/best-harnesses-for-personal-agents.json · canonical https://www.anchorterminal.com/blog/best-harnesses-for-personal-agents
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-19
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

By Anchor Terminal research, 18 October 2026. 1,231 words, about 5 min to read.

If you've tried to run a personal agent of your own this year you've probably met OpenClaw, or one of the projects that grew up around it with a claw somewhere in the name, and you've probably noticed that the model is the easy part.

We list eleven of these in our [Personal assistants](/categories/personal-assistants) category, all open source, all graded on 12 October 2026 by the same checklist we use for every other tool [[3]](#ref-3).

## The question we kept coming back to

Our checklist was written for tools an agent calls, so it scores a harness on its interfaces, its security record, how it's maintained and how well it's documented.

| Harness | Grade | Score | What it does before acting, out of the box |
| --- | --- | --- | --- |
| [ZeroClaw](/tools/zeroclaw) | BB | 70.2 | Asks you for every tool outside an eleven-item read-only list |
| [NanoClaw](/tools/nanoclaw) | B | 68.3 | Runs each session in its own Docker container, with no prompts inside it |
| [Hermes Agent](/tools/hermes-agent) | B | 67.9 | Ignores every sender until you set an allowlist, and asks before card payments |
| [OpenClaw](/tools/openclaw) | B | 67.1 | Full access, no approval and no sandbox |
| [IronClaw](/tools/ironclaw) | B | 66.7 | Has an approval step, but auto-approve is switched on |
| [nanobot](/tools/nanobot) | B | 62.4 | No approval step, though unknown senders are refused |
| [QwenPaw](/tools/qwenpaw) | B | 62.2 | Asks for mail, and otherwise only when a guard rule flags a call |
| [AstrBot](/tools/astrbot) | C | 58.8 | No approval step, with shell and file tools off until an admin turns them on |
| [CowAgent](/tools/cowagent) | C | 58.5 | Full access and no approval step |
| [PicoClaw](/tools/picoclaw) | D | 46.1 | No approval step |
| [Leon](/tools/leon) | E | 41.0 | No approval step, and it runs a task every 30 minutes on its own |

Grades and scores are from our listings on 18 October 2026, and the last column from the evidence behind each one [[3]](#ref-3) [[6]](#ref-6) [[7]](#ref-7) [[8]](#ref-8) [[9]](#ref-9) [[10]](#ref-10) [[11]](#ref-11) [[12]](#ref-12) [[13]](#ref-13) [[14]](#ref-14) [[15]](#ref-15) [[16]](#ref-16).

Read down that last column and six of the eleven have no approval step at all by default, which is OpenClaw, nanobot, AstrBot, CowAgent, PicoClaw and Leon, and IronClaw has one that its own default turns off [[9]](#ref-9) [[10]](#ref-10) [[11]](#ref-11) [[13]](#ref-13) [[14]](#ref-14) [[15]](#ref-15) [[16]](#ref-16).

## OpenClaw, since most people start there

It's the one with the community, about 391,800 GitHub stars, and a lot of what it does is sensible, like keeping memory as plain Markdown files you can open and read, and offering four permission modes from read-only up to full plus an optional Docker or Podman sandbox [[9]](#ref-9).

## The three at the top, and why they're there

ZeroClaw, at the top, is one Rust binary, and its default is supervision, so anything outside a short read-only list waits for you to approve it, and if nobody answers within 120 seconds that counts as a no [[6]](#ref-6).

NanoClaw goes the other way round.

Hermes Agent is the chat-first one, and the thing it gets right is strangers.

## Two that we wouldn't start with today

PicoClaw hasn't had a commit since 19 August 2026 or a release since 3 July, and there are 15 CVEs listed against it with no advisory or security policy from the project itself [[15]](#ref-15).

## The quieter stuff

Telemetry came up more than we expected.

These projects also move fast, Hermes Agent's release of 8 October listed six security fixes on its own, so treat any grade here as a reading on one date rather than a verdict [[8]](#ref-8).

---

More in [From the data](https://www.anchorterminal.com/blog/from-the-data/index.md) · Previous from the data [The tools personal assistants will reach for, and where they get stuck](https://www.anchorterminal.com/blog/tools-for-personal-assistants.md)

- Older: [The Log, issue 2: agents loose, money strange, a month's notice](https://www.anchorterminal.com/blog/the-log/issue-2-consent-quality-assistants.md)
- Newer: [How to sign your API's responses with a Cloudflare Worker](https://www.anchorterminal.com/blog/how-to-sign-responses-with-a-cloudflare-worker.md)
- All posts: https://www.anchorterminal.com/blog/index.md

## References

Read on 18 October 2026, from listings researched on 12 October 2026.

[1] Tom's Hardware, Minisforum launches local AI solutions at IFA 2026, 4 September 2026. Source for OpenClaw pre-installed on the N5 Max-P495 AI NAS.

[2] Minisforum, Minisforum showcases upcoming AI PC models compatible with OpenClaw, 13 March 2026. Source for Minisforum recommending OpenClaw on the M2 Pro.

[3] Anchor Terminal, Personal assistants category, 18 October 2026. Source for the eleven open-source harnesses, their grades and scores, and the date they were graded.

[4] Anchor Terminal, LocalGhost listing, 18 October 2026. Source for LocalGhost's grade and score.

[5] Anchor Terminal, research notes for the personal assistants category, 12 October 2026, not published.

[6] Anchor Terminal, ZeroClaw listing, graded 12 October 2026. Source for the supervised default, the 120-second denial, encrypted secrets, the unaudited commands and the network access of sandboxed tools.

[7] Anchor Terminal, NanoClaw listing, graded 12 October 2026. Source for the per-session containers, the credential gateway, the prompts off inside the container, the open egress and the PostHog events.

[8] Anchor Terminal, Hermes Agent listing, graded 12 October 2026. Source for the sender allowlist, card payment approvals, no telemetry, host shell commands, unapproved memory writes and the six security fixes of 8 October.

[9] Anchor Terminal, OpenClaw listing, graded 12 October 2026. Source for the stars, Markdown memory, permission modes and sandbox, the full-access default and the 722 advisories.

[10] Anchor Terminal, IronClaw listing, graded 12 October 2026. Source for auto-approve being on by default.

[11] Anchor Terminal, nanobot listing, graded 12 October 2026. Source for no approval step and unknown senders being refused.

[12] Anchor Terminal, QwenPaw listing, graded 12 October 2026. Source for approval only on flagged calls and for mail, and usage data on by default.

[13] Anchor Terminal, AstrBot listing, graded 12 October 2026. Source for no approval step, shell and file tools off by default, and usage statistics on by default.

[14] Anchor Terminal, CowAgent listing, graded 12 October 2026. Source for the full-access default and no approval step.

[15] Anchor Terminal, PicoClaw listing, graded 12 October 2026. Source for no approval step, the last commit and release, and the 15 CVEs.

[16] Anchor Terminal, Leon listing, graded 12 October 2026. Source for no approval step, the 30-minute task, the last tagged release, the Developer Preview and telemetry on by default.