{ "data": { "category": { "area": "frameworks", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "description": "Assistants that work for one person across their own mail, calendar, messages and files, remember them, and act without being asked each time. Hosted apps reached by text message or chat, and open-source agents the owner runs on their own machine. Compared on what they may do without approval, which accounts they hold and how those credentials are kept, what they remember and how it is deleted, the channels they answer on and what they cost.", "json": "https://www.anchorterminal.com/categories/personal-assistants.json", "name": "Personal assistants", "slug": "personal-assistants", "test": "In this run, public evidence against the published checklist, with hosted assistants read as hosted services and self-hosted ones as software the owner runs. When the task suites run, the same week of mail, calendar and messages given to each assistant, with a meeting to move, a bill to chase and a message carrying an instruction it should not follow. We check what it does unasked, what it asks before sending or paying, whether the planted instruction is refused, and what it keeps afterwards.", "title": "AI personal assistants that act for one person", "toolCount": 20, "tools": [ "zeroclaw", "nanoclaw", "hermes-agent", "openclaw", "ironclaw", "nanobot", "qwenpaw", "astrbot", "cowagent", "gaia", "picoclaw", "grok-bot", "zo-computer", "leon", "poke", "lindy", "openai-dots", "gemini-spark", "haven", "instinct" ], "url": "https://www.anchorterminal.com/categories/personal-assistants" }, "tools": [ { "slug": "zeroclaw", "name": "ZeroClaw", "vendor": "ZeroClaw Labs", "vendorUrl": "https://www.zeroclaw.com", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite.", "url": "https://www.anchorterminal.com/tools/zeroclaw", "markdownUrl": "https://www.anchorterminal.com/tools/zeroclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zeroclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zeroclaw.json", "repo": "https://github.com/zeroclaw-labs/zeroclaw", "license": "MIT OR Apache-2.0", "transports": [], "packages": [ { "registry": "oci", "name": "ghcr.io/zeroclaw-labs/zeroclaw" } ], "auth": "none", "authNotes": "No account with the vendor. Model keys, bot tokens and mail passwords go in `~/.zeroclaw/config.toml` as encrypted secret fields, set through `zeroclaw config set`, the dashboard or the terminal UI. OpenAI Codex and Claude subscription tokens are accepted in place of API keys. Gateway clients pair first and then send `Authorization: Bearer \u003ctoken\u003e`, with token hashes kept in config (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/authentication.md).", "pricing": "free", "pricingNotes": "Free under MIT or Apache-2.0, with no subscription and no hosted seat (https://www.zeroclaw.com/). The owner pays the model provider, or nothing with a local model. ZeroRouter, the vendor's hosted beta model gateway, is optional and its prices were not read (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source at commit 6c0b1f9 (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 32965, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.zeroclaw.com/master/en/introduction.html", "llmsTxt": "https://www.zeroclaw.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "rust", "mit", "apache-2.0", "pre-1.0", "no-telemetry", "mcp-client", "approvals", "acp", "docker", "llms-txt" ], "lastRelease": "2026-09-05", "graded": true, "anchor": { "graded": true, "score": 70.2, "grade": "BB", "agentReady": true, "rank": 161, "ranked": true, "rankOf": 986, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 60, "reliability": 74, "schema": 82, "security": 76, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -3, "negativeNotes": [ "2026-09-05. GHSA-93f6-34w8-5g98 (high), an unvalidated `wasm_path` let `zeroclaw plugin install` write an attacker-controlled file outside the plugins directory in 0.8.4 and earlier. Fixed in 0.8.5 and published the same day, inside six months, -2. https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98", "2026-04-01. The project lead wrote that a maintainer's AI automation merged pull requests that should not have gone through and that GitHub took enforcement action on the organisation. Disclosed, the maintainer removed and merge access tightened, over six months old, -1. https://www.zeroclaw.com/blog/community-and-stability" ], "verdict": "Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.", "bestFor": "One person who wants an assistant on their own hardware that answers on Telegram, Discord, Matrix or email, asks before it writes or runs commands, and works with a local model.", "strengths": [ "Supervised mode is the default. Tools outside an eleven-item read-only and fetch list prompt the owner, and an unanswered prompt is a denial after 120 seconds", "Approval prompts arrive on the channel in use, and `approval_route` can send them to a separate approver channel that denies when unreachable", "Channel secrets and provider keys are encrypted with ChaCha20-Poly1305 in `config.toml`, with the key in `.secret_key` at mode 0600", "An empty peer set denies every inbound sender, and the gateway binds 127.0.0.1 with pairing required by default", "Three tagged releases in the 90 days to 12 October 2026, each with a Breaking Changes section, and CI passing on master on 11 October" ], "weaknesses": [ "The docs state that command execution is not audited. `[security.audit]` records certificate events only, and tool receipts are opt-in and not durable", "No privacy policy, terms or security.txt on zeroclaw.com, and the home page links none", "`web_fetch`, `web_search_tool` and `browser_open` run without approval by default, and sandboxed tools keep full network egress", "GHSA-93f6-34w8-5g98 (high) let a plugin install write outside the plugins directory in 0.8.4 and earlier, fixed in 0.8.5 on 5 September 2026", "Version 0.8.5 is pre-1.0, patch releases carry breaking changes, and 576 issues and 384 pull requests were open on 12 October 2026" ], "agentNotes": [ "Keep `[risk_profiles.\u003calias\u003e] level = \"supervised\"`. `full` runs every tool not listed in `always_ask`, and the YOLO preset removes the sandbox and path rules too", "Add sending and account tools such as `send_via`, `google_workspace` and `http_request` to `always_ask` so a session-level Always grant cannot skip the prompt", "List senders in `[peer_groups.\u003cname\u003e] external_peers`. `[\"*\"]` accepts anyone on that channel", "Set `[web_fetch].allowed_domains` and `[http_request].allowed_domains`. Fetches run unprompted and the OS sandbox does not block egress", "Run one-shot tasks with `zeroclaw agent -a \u003calias\u003e -m \"\u003ctask\u003e\"`. A cron or webhook turn has no prompt, so shell calls fall to the command policy" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.2 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 60, "reliability": 74, "schema": 82, "security": 76, "transparency": 74 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/install.sh | sh # or: brew install zeroclaw", "headless": { "command": "zeroclaw agent -a \u003calias\u003e -m \"$TASK\"", "setup": "zeroclaw quickstart" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/zeroclaw" }, "area": "frameworks", "provenance": { "legalEntity": "ZeroClaw Labs", "domain": "zeroclaw.com", "domainRegistered": "2026-03-02", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/zeroclaw-labs/zeroclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The NOTICE file reads Copyright 2025 ZeroClaw Labs and the blog signs posts as CEO, ZeroClaw Labs. No company form, registration or address was found on the site or in the repository.", "The home page of www.zeroclaw.com links no terms and no privacy policy, so both fields are empty and the MIT or Apache-2.0 licence stands in.", "www.zeroclaw.com/.well-known/security.txt answered 404 on 12 October 2026. SECURITY.md asks for GitHub private vulnerability reporting and the README gives security@zeroclaw.dev.", "RDAP gives zeroclaw.com a registration date of 2026-03-02, registrar Atom.com Domains LLC. The repository was created on 13 February 2026.", "There is no hosted endpoint for the assistant. A gateway answers on its owner's own host." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zeroclaw.json" }, { "slug": "nanoclaw", "name": "NanoClaw", "vendor": "NanoCo, Inc.", "vendorUrl": "https://nanoclaw.dev", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.", "url": "https://www.anchorterminal.com/tools/nanoclaw", "markdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanoclaw.json", "repo": "https://github.com/nanocoai/nanoclaw", "license": "MIT", "transports": [], "packages": [], "auth": "none", "authNotes": "No account is needed to run it. Owners and admins are rows in a local `user_roles` table, and strangers are handled by each chat's `unknown_sender_policy` (https://docs.nanoclaw.dev/concepts/security). Model and service credentials are registered with a credential gateway on the host, OneCLI Agent Vault by default, which adds them to outbound HTTPS requests. Containers receive placeholders such as `onecli-managed` (https://docs.nanoclaw.dev/operate/credentials). Channel tokens stay in the host's `.env`. An optional free NanoClaw account, used for a prebuilt agent image and a managed Slack app, keeps its token in `~/.config/nanoclaw/account.json` with mode 0600 (https://github.com/nanocoai/nanoclaw/blob/main/README.md).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing on sale. The optional NanoClaw account, the Echo image and the managed Slack app are free of charge per the terms of 31 July 2026 (https://nanoclaw.dev/terms). The owner pays the model provider through a Claude subscription, an API key or another provider, and any service a channel or tool uses, such as Dial. Since 2.4.0 Claude groups default to Opus 5.5 (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 30929, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.nanoclaw.dev", "llmsTxt": "https://docs.nanoclaw.dev/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "tags": [ "open-source", "local", "free", "no-card", "docker", "llms-txt" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 68.3, "grade": "B", "agentReady": false, "rank": 229, "ranked": true, "rankOf": 986, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -5, "negativeNotes": [ "2026-10-09. Release 2026.10.0 fixed four symlink flaws through which a manipulated agent could make the host read, write or delete files outside its folders, plus an admin-command bypass, a cross-group read through `ncl` and a command injection in Mattermost setup. Fixed and described in the changelog within the week, but the advisories it links (GHSA-frvf-5rf5-89fq and seven others) were not public on 12 October 2026. -5. https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md" ], "verdict": "Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.", "bestFor": "A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.", "strengths": [ "Each session runs in a non-root Docker container with all capabilities dropped, and the project root and `.env` are never mounted", "API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders", "Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial", "Memory is plain Markdown under `groups/\u003cfolder\u003e/memory/`, which the owner can read, edit or delete on the host", "The security page states what the design does not stop, including messages to wired chats and spending through granted credentials" ], "weaknesses": [ "The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt", "Egress lockdown is off by default, so a container can reach the internet directly unless `NANOCLAW_EGRESS_LOCKDOWN=true` is set", "The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404", "Setup sends events to PostHog unless `NANOCLAW_NO_DIAGNOSTICS=1` is set, and the privacy policy does not mention them", "The docs say trunk has no Gmail or Google Calendar integration, while the GitHub repository description still names Gmail", "294 open issues and 750 open pull requests on 12 October 2026, and 10 of the 12 newest open issues had no reply" ], "agentNotes": [ "Install with `git clone` and `bash nanoclaw.sh`. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential", "Set `NANOCLAW_EGRESS_LOCKDOWN=true` before giving an agent credentials or an audience of strangers. The default leaves egress open", "Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree", "Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured", "On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.3 } ], "editorialScores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 77 }, "provenanceScore": 53 }, "connect": { "install": "git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2 \u0026\u0026 cd nanoclaw-v2 \u0026\u0026 bash nanoclaw.sh" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanoclaw" }, "area": "frameworks", "provenance": { "legalEntity": "NanoCo, Inc.", "domain": "nanoclaw.dev", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The terms and privacy policy at nanoclaw.dev name NanoCo, Inc. and Delaware law. Both say they cover the website and the optional account, not the software, so neither is linked and the MIT licence stands in.", "nanoclaw.dev/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md points to GitHub private vulnerability reporting.", "There is no hosted endpoint. The assistant runs on the owner's machine, and the optional account service is at portal.nanoclaw.dev, which we did not open.", "The registration date of nanoclaw.dev was not checked." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanoclaw.json" }, { "slug": "hermes-agent", "name": "Hermes Agent", "vendor": "Nous Research", "vendorUrl": "https://hermes-agent.nousresearch.com", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal agent from Nous Research that the owner runs on a computer or server. It answers on messaging apps, keeps memory between sessions, runs scheduled jobs and connects to accounts, models and MCP servers the owner configures.", "url": "https://www.anchorterminal.com/tools/hermes-agent", "markdownUrl": "https://www.anchorterminal.com/tools/hermes-agent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hermes-agent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hermes-agent.json", "repo": "https://github.com/NousResearch/hermes-agent", "license": "MIT", "transports": [], "packages": [ { "registry": "oci", "name": "nousresearch/hermes-agent" } ], "auth": "none", "authNotes": "No account of its own. Model and channel keys go in `~/.hermes/.env` or come from Bitwarden, 1Password or a command helper at start-up. Google Workspace, MCP servers and Nous Portal sign in by OAuth, with tokens stored under `~/.hermes/`. The optional API server takes a bearer key set in `API_SERVER_KEY`.", "pricing": "free", "pricingNotes": "Free under the MIT licence. The owner pays the model provider chosen, or nothing with a local model. Nous Portal plans ($0, $20, $100 and $200 a month in credits) and Hermes Cloud hosting ($0.51 a day running on the Standard size, plus inference) are optional and sold separately.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on Hermes Agent's own interfaces. An optional skill lets the agent pay other services over MPP, which is a client and not a way to pay for Hermes (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 253000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://hermes-agent.nousresearch.com/docs/", "llmsTxt": "https://hermes-agent.nousresearch.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "python", "docker", "llms-txt", "pre-1.0" ], "lastRelease": "2026-10-11", "graded": true, "anchor": { "graded": true, "score": 67.9, "grade": "B", "agentReady": false, "rank": 244, "ranked": true, "rankOf": 986, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 84, "payments": 60, "reliability": 57, "schema": 80, "security": 75, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -3, "negativeNotes": [ "2026-10-08. The v0.21.6 release notes list six security fixes, among them a native sign-in flaw that could send login codes to a non-loopback redirect and a quoted display name in the `From` header that affected the email gateway's sender check. SECURITY.md counts unauthorised access to an external surface as in scope, yet the repository shows no published advisory, so owners on older versions have no advisory to act on. Fixed and described in the notes, -3. https://github.com/NousResearch/hermes-agent/releases/tag/v0.21.6; https://github.com/NousResearch/hermes-agent/security/advisories" ], "verdict": "Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.", "bestFor": "A technical owner who wants one always-on agent across chat apps with memory and scheduled jobs, on their own machine or a small server, with any model.", "strengths": [ "Every saved-card fill asks for approval, and cron, webhook and API sessions are refused because nobody can confirm", "The messaging gateway denies all senders until an allowlist or a pairing code approved on the CLI is in place", "The docs say no telemetry, usage data or analytics is collected, and conversations, memory and skills stay in `~/.hermes/`", "SECURITY.md states that in-process checks are not a boundary and names OS-level isolation as the only one", "Ten releases between 19 August and 11 October 2026, the latest v0.21.7 on 11 October" ], "weaknesses": [ "The default terminal backend runs commands on the host, and the default `smart` mode lets an auxiliary model approve commands it rates low-risk", "The Google Workspace skill requests full Gmail, Calendar and Drive scopes, and its confirm-before-sending rule is an instruction in SKILL.md, not enforced in code", "Memory writes are saved without approval by default (`memory.write_approval: false`), including from a background review after each turn", "Release v0.21.6 of 8 October 2026 lists six security fixes and the repository has no published security advisory", "15,102 open issues and more than 5,000 open pull requests on 12 October 2026", "The Nous Portal terms grant Nous a licence to train models on customer data when the Portal is the model provider" ], "agentNotes": [ "Set `approvals.mode: manual` before giving it real accounts. The default `smart` lets an auxiliary model approve commands", "Run the gateway with `terminal.backend: docker` or the project's Docker image when it reads mail, web pages or group chats", "Set `memory.write_approval: true` and `skills.write_approval: true` to review what it saves about the owner", "Leave `approvals.cron_mode` and `approvals.unattended_mode` at `deny` for scheduled and webhook runs", "Set `TELEGRAM_ALLOWED_USERS` or the matching allowlist per channel. Never set `GATEWAY_ALLOW_ALL_USERS=true`" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.9 } ], "editorialScores": { "ergonomics": 80, "maintenance": 84, "payments": 60, "reliability": 57, "schema": 80, "security": 75, "transparency": 73 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash # then: hermes setup", "headless": { "command": "hermes chat -q \"$TASK\" --format stream-json --max-turns 30" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/hermes-agent" }, "area": "frameworks", "provenance": { "legalEntity": "Nous Research, Inc.", "domain": "nousresearch.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/NousResearch/hermes-agent/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The site footer reads Nous Research, Inc., and the Nous Portal terms name it as a Delaware corporation.", "No terms or privacy link is given. The Nous Portal terms and privacy policy (both dated 28 September 2026) govern the optional Portal and Hermes Cloud services, not the software the owner runs under the MIT licence, so the licence stands in.", "hermes-agent.nousresearch.com/.well-known/security.txt answered 404. SECURITY.md in the repository gives security@nousresearch.com and GitHub private reporting.", "No status page applies to software the owner runs. None was looked for on the Portal.", "The domain registration date was not looked up." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hermes-agent.json" }, { "slug": "openclaw", "name": "OpenClaw", "vendor": "OpenClaw Foundation", "vendorUrl": "https://openclaw.ai", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.", "url": "https://www.anchorterminal.com/tools/openclaw", "markdownUrl": "https://www.anchorterminal.com/tools/openclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openclaw.json", "repo": "https://github.com/openclaw/openclaw", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "openclaw" }, { "registry": "oci", "name": "ghcr.io/openclaw/openclaw" } ], "auth": "mixed", "authNotes": "No OpenClaw account exists. The owner supplies model provider API keys or signs in with a ChatGPT or Claude subscription, and adds a bot token, QR pairing or OAuth grant for each channel and account. Clients reach the Gateway with a token or password (`gateway.auth.mode`), or through a trusted proxy, and paired devices hold their own tokens. Operator scopes (`operator.read`, `operator.write`, `operator.admin` and others) apply to paired clients, but a shared-secret bearer token on `POST /tools/invoke` gets full operator access whatever scopes the caller sends (https://docs.openclaw.ai/gateway/tools-invoke-http-api; https://docs.openclaw.ai/gateway/operator-scopes).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with no paid tier, hosted service or subscription. The owner pays the model provider for usage, or nothing with a local model, plus any search, speech or media API they configure (https://github.com/openclaw/openclaw; https://docs.openclaw.ai/reference/api-usage-costs).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 391800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.openclaw.ai", "llmsTxt": "https://docs.openclaw.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "foundation", "llms-txt", "docker", "typescript" ], "lastRelease": "2026-10-12", "graded": true, "anchor": { "graded": true, "score": 67.1, "grade": "B", "agentReady": false, "rank": 270, "ranked": true, "rankOf": 986, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 77, "maintenance": 86, "payments": 60, "reliability": 75, "schema": 84, "security": 74, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -8, "negativeNotes": [ "2026-09-11. The project's security page and GitHub advisory list show 722 advisories published between 31 January and 11 September 2026, 14 critical, 249 high, 390 medium and 69 low, 39 with a CVE. The largest groups are Gateway auth and scopes (182) and exec, sandbox and approvals (160). The project says all 14 critical issues are fixed and disclosed and reports no known compromise of its infrastructure. Fixed and published, which decays the deduction, but the volume and the two areas affected bear directly on an assistant that holds its owner's accounts, -8. https://openclaw.ai/security; https://github.com/openclaw/openclaw/security/advisories" ], "verdict": "Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.", "strengths": [ "State, memory and credentials stay under `~/.openclaw` on the owner's machine, and the project sells no hosted service or paid tier", "Memory is plain Markdown files in the workspace, and `openclaw memory forget` removes what a named session contributed", "Four session permission modes (`read-only`, `guarded`, `workspace`, `full`), exec approvals and an optional Docker or Podman tool sandbox", "Unknown direct-message senders get a pairing code by default and are ignored until the owner approves them", "Telemetry is documented field by field. Feature statistics are opt-in and `update.checkOnStart: false` stops every automatic request", "13 stable releases in the 90 days to 12 October 2026, with npm provenance attestations on the published package" ], "weaknesses": [ "Without configuration the default is full access. Host exec runs with no approval and sandboxing is off", "Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send", "722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page", "Credentials sit in files and SQLite databases under `~/.openclaw`, protected by file permissions unless the owner configures a secret provider", "The project's own maturity scorecard rates the product at 68 per cent, labelled Alpha", "The privacy policy covers the mobile apps, the Chrome extension and website analytics, and says it does not cover the Gateway" ], "agentNotes": [ "Set a session permission mode of `guarded` or `workspace`, or `tools.exec.mode`, before connecting mail. The default runs host commands without approval", "Turn on `agents.defaults.sandbox` for any agent that reads mail, web pages or attachments. Sandboxing is off by default", "Set `tools.message.crossContext.allowAcrossProviders` and `allowWithinProvider` to `false` to confine sends to the current conversation", "Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny `gateway`, `cron`, `sessions_spawn` and `sessions_send` for it", "Run `openclaw security audit` after setup, and treat the Gateway token as an owner credential. `POST /tools/invoke` accepts it with full operator access" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.1 } ], "editorialScores": { "ergonomics": 77, "maintenance": 86, "payments": 60, "reliability": 75, "schema": 84, "security": 74, "transparency": 82 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://openclaw.ai/install.sh | bash # or: npm install -g openclaw@latest --allow-scripts=openclaw \u0026\u0026 openclaw onboard --install-daemon" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/openclaw" }, "area": "frameworks", "provenance": { "legalEntity": "OpenClaw Foundation", "domain": "openclaw.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/openclaw/openclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The README and the `LICENSE` file name the OpenClaw Foundation, described as an independent 501(c)(3). Its site at www.openclaw.org gave no address, registration number, board or filings on the page we read.", "No terms of service were found for the software, so the MIT licence stands in.", "The privacy policy at openclaw.ai/privacy, effective 2 August 2026, covers the iOS and Android apps, the Chrome extension and website analytics, and says it does not cover the gateway, server or AI provider the owner connects. It is not linked here for that reason.", "openclaw.ai/.well-known/security.txt returned 404 on 12 October 2026. The repository has a SECURITY.md with private GitHub reporting and security@openclaw.ai.", "There is no hosted endpoint. A Gateway answers on its owner's own host. The daily update check goes to telemetry.openclaw.ai.", "The domain registration date was not looked up." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openclaw.json" }, { "slug": "ironclaw", "name": "IronClaw", "vendor": "NEAR AI", "vendorUrl": "https://www.ironclaw.com", "kind": "harness", "category": "personal-assistants", "summary": "IronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory.", "url": "https://www.anchorterminal.com/tools/ironclaw", "markdownUrl": "https://www.anchorterminal.com/tools/ironclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ironclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ironclaw.json", "repo": "https://github.com/nearai/ironclaw", "license": "MIT OR Apache-2.0", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "`ironclaw onboard` writes a bearer token to `~/.ironclaw/reborn/webui-token` and prints a login link that carries it as a `token` query parameter. The same token authorises the web interface and the Responses API with operator rights. Multi-user deployments can add Google or GitHub single sign-on and per-user API tokens with owner, admin or member roles. Connected accounts use OAuth (Google, Slack), a Telegram pairing code, or keys held in the encrypted secret store. The web interface binds to 127.0.0.1:3000 unless `--host` is changed (https://docs.ironclaw.com/using/webui.md).", "pricing": "freemium", "pricingNotes": "Free to self-host under MIT or Apache-2.0, with model usage billed by whichever provider the owner selects, or nothing with Ollama. NEAR AI sells hosted instances on ironclaw.com as Starter (shown as $5 beside $0 a month, 1 agent, $5 credits), Basic at $20 a month (2 agents, $20 credits) and Pro+ at $200 a month (5 agents, $200 credits). The page does not say whether a card is needed. NEAR AI Cloud inference is priced per million tokens on near.ai/pricing (checked 2026-10-12).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the release notes (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 12648, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.ironclaw.com", "llmsTxt": "https://docs.ironclaw.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "rust", "wasm", "telegram", "slack", "gmail", "mcp", "hosted-option", "llms-txt" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 66.7, "grade": "B", "agentReady": false, "rank": 288, "ranked": true, "rankOf": 986, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 74, "payments": 60, "reliability": 67, "schema": 74, "security": 66, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -2, "negativeNotes": [ "2026-10-12. The ironclaw.com home page lists Discord and Signal among integrations, while the channel docs for the current release say Discord, Signal, WeChat and WeCom are not part of the 1.0 release, which shipped on 27 July 2026. The docs site also says it documents the latest stable release while its heartbeat, cron, shell and WASM pages name settings absent from the 1.4.1 source. A misleading claim, at the minimum, -2. https://www.ironclaw.com/; https://docs.ironclaw.com/channels/overview.md; https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/routines/heartbeat.mdx" ], "verdict": "Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off.", "bestFor": "One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.", "strengths": [ "Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it", "Each extension tool declares a default permission, effects, network targets and OAuth scopes in `manifest.toml`. Gmail reads use `gmail.readonly` and sends use `gmail.send`", "Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox", "No analytics library was found in the 1.4.1 source. Trace Commons is opt-in and has no default endpoint", "Six stable releases between 27 July and 29 September 2026, each with dated notes and upgrade steps" ], "weaknesses": [ "Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask", "The `main` branch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open", "Docs pages for heartbeat, cron, shell and WASM limits name settings such as `HEARTBEAT_ENABLED` and `ALLOW_LOCAL_TOOLS` that do not appear in the 1.4.1 source", "No SECURITY.md, security.txt or published GitHub advisory was found", "The home page lists Discord and Signal integrations, while the channel docs say both are not part of the 1.0 release" ], "agentNotes": [ "Open Settings and turn off global auto-approve, or set send and delete tools to ask each time, before connecting mail or chat accounts", "Install with the release installer and run `ironclaw onboard`. 1.x does not migrate 0.29 data, so use a fresh home directory", "Call `POST /api/v1/responses` with the bearer token from `~/.ironclaw/reborn/webui-token`. Keep under 30 requests in 60 seconds", "Resolve approval and OAuth gates in the web interface. The Responses API fails the turn instead of surfacing them", "Connect MCP servers over HTTP only. The stdio transport is rejected" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.7 } ], "editorialScores": { "ergonomics": 69, "maintenance": 74, "payments": 60, "reliability": 67, "schema": 74, "security": 66, "transparency": 79 }, "provenanceScore": 71 }, "connect": { "install": "IRONCLAW_RELEASE_TAG=ironclaw-v1.4.1\ncurl --proto '=https' --tlsv1.2 -LsSf \"https://github.com/nearai/ironclaw/releases/download/${IRONCLAW_RELEASE_TAG}/ironclaw-installer.sh\" | sh\nironclaw onboard" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/ironclaw" }, "area": "frameworks", "unitPrices": [ { "item": "Hosted Basic plan (2 agents, $20 credits)", "unit": "month", "usd": 20, "note": "NEAR AI Cloud, per ironclaw.com" }, { "item": "Hosted Pro+ plan (5 agents, $200 credits)", "unit": "month", "usd": 200, "note": "NEAR AI Cloud, per ironclaw.com" } ], "provenance": { "legalEntity": "Jasnah, Inc. d/b/a NEAR AI", "domain": "ironclaw.com", "domainRegistered": "2018-01-04", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://near.ai/privacy-policy", "statusPage": "", "changelog": "https://github.com/nearai/ironclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The NEAR AI terms of service (updated 24 September 2026) name Jasnah, Inc. d/b/a NEAR AI under Delaware law and cover NEAR AI Cloud and its API. They do not mention IronClaw or agent hosting, so no terms link is set and the MIT or Apache-2.0 licence stands in for the self-hosted software.", "The privacy policy (updated 4 September 2026) lists ironclaw.com, agent.near.ai, the IronClaw framework and IronHub among what it covers.", "The ironclaw.com home page says Built by Near Foundation and its footer says by NEAR AI.", "security.txt answered 404 on www.ironclaw.com, docs.ironclaw.com and near.ai.", "RDAP for ironclaw.com gives a registration date of 2018-01-04 and Cloudflare, Inc. as registrar, last changed 2026-04-20.", "A self-hosted instance answers on its owner's own host. Hosted instances answer at \u003cinstance-id\u003e.agents.near.ai per the quickstart." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ironclaw.json" }, { "slug": "nanobot", "name": "nanobot", "vendor": "HKUDS", "vendorUrl": "https://nanobot.wiki", "kind": "harness", "category": "personal-assistants", "summary": "nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.", "url": "https://www.anchorterminal.com/tools/nanobot", "markdownUrl": "https://www.anchorterminal.com/tools/nanobot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanobot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanobot.json", "repo": "https://github.com/HKUDS/nanobot", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "nanobot-ai" } ], "auth": "none", "authNotes": "No account with the project. The owner supplies model provider keys or an OAuth sign-in, and bot tokens or mailbox passwords for each channel, in `~/.nanobot/config.json`. The WebUI on localhost needs no password, and binding to all interfaces requires a token.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays the model provider, or nothing with a local model. The optional Render deployment needs a paid Render service.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 49000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://nanobot.wiki/docs/latest/getting-started/nanobot-overview", "llmsTxt": "https://nanobot.wiki/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "mit", "llms-txt", "docker", "alpha" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 446, "ranked": true, "rankOf": 986, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 48 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -6, "negativeNotes": [ "2026-09-02. GHSA-vc5v-6vwm-wf9m (critical, 9.3, no CVE). Web fetch did not block internal addresses, so cloud metadata and internal services could be read without authentication in versions before 0.3.0. Fixed in 0.3.0 of 25 July and published, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m", "2026-03-27. GHSA-4gmr-2vc8-7qh3 (CVE-2026-33654, high). A spoofed email could inject instructions through email polling with no user action, up to command execution, in 0.1.4.post5 and earlier. Fixed in 0.1.4.post6 and published, more than six months ago, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "2026-03-11. GHSA-g6cf-xjwr-pm77 (CVE-2026-31977, critical, 9.0). A sender ID containing `|` passed the `allowFrom` check in versions before 0.1.4.post4. Fixed and published, more than six months ago, -1. https://github.com/HKUDS/nanobot/security/advisories/GHSA-g6cf-xjwr-pm77", "2026-04-14 and 2026-05-24. GHSA-v5j3-4q66-58cf (CVE-2026-35589, high, 8.0), cross-site WebSocket hijacking of the WhatsApp bridge, fixed in 0.1.5, and GHSA-3f63-vcp3-hvqr (CVE-2026-48716, high, 8.7), file write through a WhatsApp document name. Both fixed and published, -1 together. https://github.com/HKUDS/nanobot/security/advisories" ], "verdict": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5", "Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back", "Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves", "Email requires SPF and DKIM results from a named receiving service since v0.3.5, and mailbox access stays off until `consentGranted` is set", "Optional `bwrap` (Linux) and `seatbelt` (macOS) sandboxes for shell commands, and an SSRF guard on web fetches and HTTP MCP connections" ], "weaknesses": [ "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none", "Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch", "SECURITY.md lists plain-text API keys in `config.json`, no rate limiting and limited security event logging as known limitations", "Version 0.3.5 with an Alpha classifier, 214 open issues and 614 open pull requests on 12 October 2026" ], "agentNotes": [ "Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default", "Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)", "Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing", "Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text", "Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 69 }, "provenanceScore": 27 }, "connect": { "install": "python -m pip install nanobot-ai # or: uv tool install nanobot-ai # then: nanobot webui", "headless": { "command": "nanobot -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanobot" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "nanobot.wiki", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/HKUDS/nanobot/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No legal entity is named. The repository belongs to the GitHub organisation HKUDS, which a published advisory title calls the Hong Kong University Data Intelligence Lab. pyproject.toml names Xubin Ren and the nanobot contributors as authors.", "nanobot.wiki has no terms or privacy page linked from its home page or llms.txt, and `/.well-known/security.txt` answered with the site's not-found page on 12 October 2026.", "SECURITY.md in the repository asks for reports through a private GitHub advisory or by email and aims to respond within 48 hours.", "There is no hosted endpoint. A gateway answers on its owner's own host." ], "score": 27 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanobot.json" }, { "slug": "qwenpaw", "name": "QwenPaw", "vendor": "AgentScope", "vendorUrl": "https://qwenpaw.agentscope.io", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files.", "url": "https://www.anchorterminal.com/tools/qwenpaw", "markdownUrl": "https://www.anchorterminal.com/tools/qwenpaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/qwenpaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/qwenpaw.json", "repo": "https://github.com/agentscope-ai/QwenPaw", "license": "Apache-2.0", "transports": [ "http", "stdio" ], "packages": [ { "registry": "pypi", "name": "qwenpaw" }, { "registry": "oci", "name": "agentscope/qwenpaw" } ], "auth": "none", "authNotes": "No account. The Console and API bind to 127.0.0.1:8088 with login off by default. `QWENPAW_AUTH_ENABLED=true` adds one admin account with a salted SHA-256 password hash and a signed token valid for seven days, and requests from localhost skip it. Each channel takes its own bot credentials, and the mailbox takes an IMAP and SMTP authorisation code or app password.", "pricing": "free", "pricingNotes": "Free under Apache-2.0 with nothing to buy. Model usage is billed by whichever provider the owner configures, and local models through llama.cpp, Ollama or LM Studio need no key. The README describes a hosted deployment on AgentScope Platform as free. That platform's pages are script-drawn and its terms and limits were not read (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs source or the dependency list (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 35621, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://qwenpaw.agentscope.io/docs", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "docker", "desktop-app", "mcp", "telemetry-default-on" ], "lastRelease": "2026-09-11", "graded": true, "anchor": { "graded": true, "score": 62.2, "grade": "B", "agentReady": false, "rank": 454, "ranked": true, "rankOf": 986, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 73, "payments": 60, "reliability": 70, "schema": 68, "security": 60, "transparency": 56 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -3, "negativeNotes": [ "2026-09-11. Version 2.2.1 began enforcing each MCP server's tool allowlist on the agent runtime path (commit f2a292d of 4 September, #7504). Before it, a tool the owner had disabled on an MCP client could still be invoked by the agent. Fixed and listed in the release notes, with no security advisory, -2. https://github.com/agentscope-ai/QwenPaw/pull/7504", "2026-09-03. Version 2.2.0 blocked shell line-continuation variants that bypassed sensitive-path protections (#7472). Fixed and listed in the release notes, with no security advisory, -1. https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/release-notes/v2.2.0.md" ], "verdict": "Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.", "bestFor": "One person who wants an assistant on Chinese and Western chat apps with scheduled digests, a consumer mailbox and file-based memory, on their own machine and with a model of their choice.", "strengths": [ "New mail driver cards default to the `ask` policy, and automatic mail handling may not call `delete_message` or write to unknown recipients", "Kernel sandbox on macOS, Linux and Windows, with a documented list of constraints each backend does not enforce", "Model keys, mail credentials and environment secrets are encrypted with a master key held in the OS keychain or a 0600 file", "Memory is plain Markdown in the agent workspace that the owner can read, edit and remove", "Four stable releases in the 90 days to 12 October 2026, each with dated release notes" ], "weaknesses": [ "Usage data is on by default, `qwenpaw init --defaults` accepts it without a prompt, and the opt-out variable is absent from the README and docs", "The default approval level AUTO asks only for tool calls a guard rule flags, and `/proactive` skips approval prompts entirely", "Channel direct-message and group policies default to `open`, and Console login is off by default", "No privacy policy, terms of service or security.txt on qwenpaw.agentscope.io, and no published GitHub security advisory", "Inside containers the sandbox falls back to `mode=none`, which the docs say enforces no isolation", "671 open issues and 381 open pull requests on 12 October 2026, and the Tests workflow on main had not completed a run since 30 September" ], "agentNotes": [ "Set `QWENPAW_TELEMETRY_DISABLED=true` before `qwenpaw init --defaults` or `qwenpaw app`. Both send usage data without asking", "Set `approval_level` to `STRICT` or `SMART` in `agent.json`. The default `AUTO` runs every tool call no guard rule flags", "Set `dm_policy` and `group_policy` to `allowlist` with `allow_from` on each channel. Both default to `open`", "Set `QWENPAW_AUTH_ENABLED=true` before binding beyond 127.0.0.1. Requests from localhost skip login even then", "Keep mail tools on `ask` for `send_message`, `delete_message` and `delete_thread`, and turn on Mail Access Control with automatic handling" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.2 } ], "editorialScores": { "ergonomics": 67, "maintenance": 73, "payments": 60, "reliability": 70, "schema": 68, "security": 60, "transparency": 58 }, "provenanceScore": 53 }, "connect": { "install": "pip install qwenpaw \u0026\u0026 qwenpaw init --defaults \u0026\u0026 qwenpaw app # Python 3.11 to 3.13; or: docker pull agentscope/qwenpaw:latest", "http": "curl -X POST http://localhost:8088/api/console/chat -H \"Content-Type: application/json\" -H \"X-Agent-Id: default\" -d '{\"input\": [...]}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/qwenpaw" }, "area": "frameworks", "provenance": { "legalEntity": "Qwenpaw PRIVATE LIMITED", "domain": "agentscope.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://qwenpaw.agentscope.io/release-notes", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The site footer in the repository's website source reads © 2026 Qwenpaw PRIVATE LIMITED. The LICENSE file names The QwenPaw Authors, and the README credits the AgentScope team.", "SECURITY.md sends vulnerability reports to the Alibaba Security Response Centre. We found no other first-hand statement of ownership by Alibaba.", "The site links a Usage Policy dated 26 August 2026 and no terms of service or privacy policy, so both links are left out and the Apache-2.0 licence stands in.", "qwenpaw.agentscope.io answered 404 for robots.txt, llms.txt and /.well-known/security.txt on 12 October 2026.", "No hosted endpoint is graded. A self-hosted instance answers on its owner's own host. We did not look up the domain's registration date." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/qwenpaw.json" }, { "slug": "astrbot", "name": "AstrBot", "vendor": "AstrBotDevs", "vendorUrl": "https://astrbot.app", "kind": "harness", "category": "personal-assistants", "summary": "AstrBot is an open-source chatbot and agent program that the owner runs and connects to messaging platforms such as QQ, Telegram, Slack, Discord, Lark and WeCom, with scheduled tasks, MCP tools, plugins and a web admin panel.", "url": "https://www.anchorterminal.com/tools/astrbot", "markdownUrl": "https://www.anchorterminal.com/tools/astrbot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/astrbot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/astrbot.json", "repo": "https://github.com/AstrBotDevs/AstrBot", "license": "AGPL-3.0-or-later", "transports": [], "packages": [ { "registry": "pypi", "name": "astrbot" }, { "registry": "oci", "name": "soulter/astrbot" } ], "auth": "mixed", "authNotes": "No account with the project. The web panel signs in with the user `astrbot` and a random initial password printed in the startup log, with optional TOTP and a login rate limit (https://github.com/AstrBotDevs/AstrBot/blob/master/docs/en/use/webui.md). Outside programs use `abk_` API keys created in Settings, OpenAPI, sent as `Authorization: Bearer` or `X-API-Key`, limited by 11 scopes and two sensitive sub-scopes and stored as PBKDF2 hashes (https://github.com/AstrBotDevs/AstrBot/blob/master/docs/en/dev/openapi.md). Messaging platform tokens and model provider keys are entered in the panel and kept in `data/cmd_config.json`.", "pricing": "free", "pricingNotes": "Free under AGPL-3.0 with nothing to buy. The EULA says the team sells no service and that a request for payment is a likely scam (https://github.com/AstrBotDevs/AstrBot/blob/master/EULA.md). The owner pays the model provider and any search or sandbox service, or nothing with a local model. The README links a paid third-party cloud host and several model resellers through referral links (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI file or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 41800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.astrbot.app", "openapi": "https://github.com/AstrBotDevs/AstrBot/blob/master/docs/public/openapi.json", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "free", "no-card", "python", "docker", "openapi", "agpl", "telemetry-default-on" ], "lastRelease": "2026-09-27", "graded": true, "anchor": { "graded": true, "score": 58.8, "grade": "C", "agentReady": false, "rank": 584, "ranked": true, "rankOf": 986, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 81, "payments": 60, "reliability": 81, "schema": 62, "security": 44, "transparency": 40 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -2, "negativeNotes": [ "2025-11-14. GHSA-4m32-cjv7-f425 (CVE-2025-55449, critical, 9.8), a hard-coded JWT signing key that let an unauthenticated attacker install a plugin and run commands on any reachable instance at 3.5.17 or earlier. Patched in 3.5.18 on 21 June 2025 and published five months later, inside the last 12 months. Fixed and documented, so the deduction decays to -2. https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-4m32-cjv7-f425" ], "verdict": "Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.", "bestFor": "Someone who wants one self-run bot answering on QQ, Telegram, Slack, Discord, Lark or WeCom, in private or group chats, with scheduled tasks, a knowledge base and plugins.", "strengths": [ "Official adapters for 14 messaging platforms in the README table, among them QQ, Telegram, Slack, Discord, LINE, Lark, DingTalk and WeCom", "Agent shell, Python and file tools are off by default (`computer_use_runtime` is `none`) and limited to administrators when turned on", "HTTP API under `/api/v1` with a published OpenAPI file of 170 paths and API keys limited by 11 scopes, stored as PBKDF2 hashes", "About 15 tagged releases in the 90 days to 12 October 2026, each with a dated changelog file in English and Chinese", "Unit tests run on Linux, macOS and Windows, and the last master runs we saw on 12 October 2026 passed" ], "weaknesses": [ "No approval step before any tool call. The agent sends messages, creates scheduled tasks and calls MCP tools without asking", "No built-in mail, calendar or file-account connector and no long-term memory of the owner. Both depend on third-party plugins or MCP servers", "Usage statistics are on by default and include the hostname and an installation ID, while the EULA says nothing personally identifiable is collected", "The web panel listens on 0.0.0.0 by default, and the repository has no SECURITY.md or security.txt", "No prompt-injection guidance found, although group messages, web pages and MCP results all reach the model" ], "agentNotes": [ "Set `ASTRBOT_DISABLE_METRICS=1` before the first start. Statistics, including the hostname, are sent to tickstats.soulter.top by default", "Set `dashboard.host` to 127.0.0.1 in `data/cmd_config.json`, or the `DASHBOARD_HOST` variable, unless remote access is intended. The default is 0.0.0.0", "Create an `abk_` key in Settings, OpenAPI with only the scopes needed, and send it as `Authorization: Bearer` or `X-API-Key`", "Include `username` in every `POST /api/v1/chat` body. Without the `chat:admin` scope an administrator ID is rejected", "Check Extensions, Future Tasks after asking for a schedule. One-off tasks are deleted after their run even when the run fails" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.8 } ], "editorialScores": { "ergonomics": 54, "maintenance": 81, "payments": 60, "reliability": 81, "schema": 62, "security": 44, "transparency": 56 }, "provenanceScore": 23 }, "connect": { "install": "uv tool install astrbot --python 3.12 \u0026\u0026 astrbot init \u0026\u0026 astrbot run", "http": "curl -N 'http://localhost:6185/api/v1/chat' -H 'Authorization: Bearer abk_xxx' -H 'Content-Type: application/json' -d '{\"message\":\"Hello\",\"username\":\"alice\"}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/astrbot" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "astrbot.app", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://github.com/AstrBotDevs/AstrBot/blob/master/EULA.md", "privacy": "", "statusPage": "", "changelog": "https://github.com/AstrBotDevs/AstrBot/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No legal entity was found. The docs call AstrBot a non-profit project under the AstrBotDevs organisation, and the EULA speaks for the AstrBot Team.", "The EULA in the repository (last updated 12 January 2026) is the only terms document found. Its section 8 is the only privacy statement, so no privacy link is given.", "astrbot.app answers every path, robots.txt and `/.well-known/security.txt` included, with the same script-drawn page, so the site has no robots rules and no security.txt. docs.astrbot.app answers 404 for security.txt and llms.txt.", "GitHub says the project has not set up a SECURITY.md. A Report a vulnerability button is shown and two advisories are published.", "Usage statistics go to tickstats.soulter.top, a host outside the project's domain.", "The domain's registration date was not looked up." ], "score": 23 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/astrbot.json" }, { "slug": "cowagent", "name": "CowAgent", "vendor": "zhayujie", "vendorUrl": "https://cowagent.ai", "kind": "harness", "category": "personal-assistants", "summary": "CowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.", "url": "https://www.anchorterminal.com/tools/cowagent", "markdownUrl": "https://www.anchorterminal.com/tools/cowagent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cowagent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cowagent.json", "repo": "https://github.com/zhayujie/CowAgent", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "zhayujie/chatgpt-on-wechat" } ], "auth": "mixed", "authNotes": "No account. The web console listens on 127.0.0.1 with no password by default, and `web_password` adds a login whose session lasts 30 days. `external_api_token` is one Bearer token for the OpenAI-compatible endpoint, which stays off while the token is empty (https://docs.cowagent.ai/channels/web). Messaging channels use each platform's bot token or app secret in `config.json`. Model keys go in `config.json` or environment variables.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy to run it. The owner pays the configured model provider, or nothing with a local model behind an OpenAI-compatible endpoint. The README names LinkAI as a seller of managed hosting, and link-ai.tech did not answer on 12 October 2026, so its prices were not read.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 47400, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.cowagent.ai/intro/index", "llmsTxt": "https://docs.cowagent.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "llms-txt", "docker", "python", "openai-compatible" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 58.5, "grade": "C", "agentReady": false, "rank": 591, "ranked": true, "rankOf": 986, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 83, "payments": 60, "reliability": 84, "schema": 67, "security": 43, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -5, "negativeNotes": [ "2026-07-31. Issue #2998 reports that a member of a Feishu group asked the bot for local files and it sent the owner's documents into the group. This is the reporter's account and we did not reproduce it. We confirmed in the master source on 12 October 2026 that group channels accept every group, that full-access is the default and that the proposed sender gating is absent. Open and unfixed, -3. https://github.com/zhayujie/CowAgent/issues/2998", "2026-07-29. Version 2.1.5 fixed a chain in which injected content led the agent to rewrite the MCP config, run arbitrary commands and take keys, and fixed the `edit` tool reaching `~/.cow/.env`. Both are described in the release notes with no advisory. Fixed and documented, -2. https://docs.cowagent.ai/releases/v2.1.5" ], "verdict": "MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.", "bestFor": "One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers.", "strengths": [ "Memory is plain Markdown under `~/cow` (`MEMORY.md`, `memory/YYYY-MM-DD.md`), readable and removable by the owner", "Three permission modes per session (read-only, workspace-write, full-access), with a global default in `agent_permission_mode`", "The web console binds to 127.0.0.1 by default, and the cloud client loads only when `use_linkai` and a deployment id are both set", "Seven tagged releases between 20 July and 30 September 2026, each with dated notes in the docs", "Tests run on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw passed on 12 October 2026" ], "weaknesses": [ "Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call", "The permission checks read arguments and are not an OS sandbox, as the source says. The `bash` blocklist covers only root deletion, disk wiping and power commands", "Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master", "No setting limits which Telegram, Slack or Discord users may message the bot, and those channels reply in every group", "No SECURITY.md, security.txt, privacy policy or terms. Model keys sit in `config.json` and MCP keys in `mcp.json` as plain text" ], "agentNotes": [ "Set `agent_permission_mode` to `workspace-write` or `read-only` before connecting any channel. Source and Docker installs default to `full-access`", "Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner", "Set `web_password` before changing `web_host` to `0.0.0.0`. The password is empty by default", "Set `external_api_token` to enable `POST /v1/chat/completions`, and send `conversation_id` to keep one session. The `model` field does not select a model", "Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.5 } ], "editorialScores": { "ergonomics": 59, "maintenance": 83, "payments": 60, "reliability": 84, "schema": 67, "security": 43, "transparency": 62 }, "provenanceScore": 27 }, "connect": { "install": "bash \u003c(curl -fsSL https://cdn.link-ai.tech/code/cow/run.sh) # or: curl -O https://cdn.link-ai.tech/code/cow/docker-compose.yml \u0026\u0026 docker compose up -d", "http": "curl http://localhost:9899/v1/chat/completions -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d '{\"model\":\"cowagent\",\"conversation_id\":\"example-conversation\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/cowagent" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "cowagent.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://docs.cowagent.ai/releases/overview", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No company or legal entity is named for CowAgent. The licence names zhayujie, and the cowagent.ai footer reads Copyright 2026 CowAgent.", "The README lists sales@simple-future.tech and LinkAI (link-ai.tech) for enterprise services and managed hosting. link-ai.tech did not answer our robots.txt request on 12 October 2026, so none of its pages were read.", "cowagent.ai links no terms and no privacy policy. Its sitemap lists the home, download and blog pages only.", "cowagent.ai answers `/.well-known/security.txt` and `/llms.txt` with the home page, so neither file exists. docs.cowagent.ai serves an llms.txt.", "The registration date of cowagent.ai was not looked up." ], "score": 27 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cowagent.json" }, { "slug": "gaia", "name": "GAIA", "vendor": "The Experience Company", "vendorUrl": "https://heygaia.io", "kind": "platform", "category": "personal-assistants", "summary": "GAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting.", "url": "https://www.anchorterminal.com/tools/gaia", "markdownUrl": "https://www.anchorterminal.com/tools/gaia.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gaia.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gaia.json", "repo": "https://github.com/theexperiencecompany/gaia", "license": "PolyForm-Noncommercial-1.0.0", "transports": [], "packages": [ { "registry": "npm", "name": "@heygaia/cli" } ], "auth": "oauth", "authNotes": "People sign in to the hosted app in a browser, and the backend uses WorkOS for sign-in. Integrations connect by OAuth on the provider's consent screen, through Composio for built-in ones, and Gmail asks for the `gmail.modify` scope. Custom MCP servers take no auth, a bearer token or OAuth 2.1 with PKCE and dynamic client registration, with tokens Fernet-encrypted in PostgreSQL. Bot users link a chat identity with `/auth`. No API key for outside callers was found (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py; https://docs.heygaia.io/guides/adding-mcp-integrations).", "pricing": "paid", "pricingNotes": "Pro is $30 a month on the pricing page, the only plan shown there, and its FAQ says GAIA is a paid product. The README and docs also describe a Free plan with daily caps and an Enterprise plan by contact, so whether a new account can use the hosted service without paying was not established. Payments run through Dodo Payments. Self-hosting is free for noncommercial use, plus model usage and a WorkOS account (https://heygaia.io/pricing; https://docs.heygaia.io/guides/usage-subscription; checked 2026-10-12).", "priceSummary": "$30 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the backend source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 308, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.heygaia.io", "llmsTxt": "https://docs.heygaia.io/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "hosted", "source-available", "noncommercial-licence", "self-hosted", "messaging", "imessage", "whatsapp", "telegram", "slack", "discord", "gmail", "mcp-client", "status-page", "llms-txt", "approval-off-by-default" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 49.5, "grade": "D", "agentReady": false, "rank": 813, "ranked": true, "rankOf": 986, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 78, "payments": 20, "reliability": 67, "schema": 51, "security": 54, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -5, "negativeNotes": [ "-3. The release notes of 26 August 2026 say GAIA pauses and asks before a tool that deletes, sends or overwrites, the privacy policy (7 August 2026) says destructive actions require explicit approval, and the pricing page says anything outward-facing waits for the owner's OK. The source at `api-v0.24.0` (14 September 2026) and on master sets the default mode to `always_allow`, commented as nothing gated until flipped after launch. Read from source, not from a live account. https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py", "-2. The pricing page FAQ, read on 12 October 2026, says GAIA never shares data with model providers. Section 3.1 of the privacy policy says content, files and data from connected accounts are shared with third-party AI model providers. https://heygaia.io/pricing and https://heygaia.io/privacy" ], "verdict": "GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.", "bestFor": "It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source.", "strengths": [ "The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.", "Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.", "Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control.", "A BetterStack status page covers the API, web app and four bots, and lists no incident in the 90 days to 12 October 2026.", "Three sets of tagged releases in the 90 days to 12 October 2026, the latest on 14 September, with 91 commits on master in the last 30 days." ], "weaknesses": [ "The default approval mode in the source is `always_allow`, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval.", "The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.", "The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product.", "Gmail connects with the `gmail.modify` scope, and built-in integrations run through Composio, so a third party holds those OAuth connections.", "No security.txt, bug bounty, certification, subprocessor list or DPA was found, and self-hosting needs a WorkOS account and five data services.", "The Terms of Service forbid automated systems accessing the Service. Recorded as a fact, and it matters before any probe is run." ], "agentNotes": [ "Set Settings \u003e Approvals to Always ask or Auto before connecting mail. The default in the source runs every action, including send and delete, without asking.", "Expect no public API on the hosted service. The backend turns off its OpenAPI document in production, so reach GAIA through its apps, bots or CLI.", "Check the plan before relying on the hosted service. The README and docs describe a Free plan, and the pricing page says GAIA is a paid product.", "For self-hosting, prepare Docker, Node.js 20, a WorkOS account and a model key first, and confirm the use is noncommercial under the licence.", "Add outside tools as MCP servers by URL on the Integrations page. GAIA asks before adding a server in every approval mode." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49.5 } ], "editorialScores": { "ergonomics": 54, "maintenance": 78, "payments": 20, "reliability": 67, "schema": 51, "security": 54, "transparency": 50 }, "provenanceScore": 70 }, "connect": { "install": "npm install -g @heygaia/cli \u0026\u0026 gaia init # choose Self-Host (Docker), then open http://localhost:3000" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/gaia" }, "area": "frameworks", "unitPrices": [ { "item": "Pro", "unit": "month", "usd": 30, "note": "billed monthly, with usage limits the pricing page does not state" } ], "provenance": { "legalEntity": "The Experience Company, Inc.", "domain": "heygaia.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://heygaia.io/terms", "privacy": "https://heygaia.io/privacy", "statusPage": "https://status.heygaia.io", "changelog": "https://docs.heygaia.io/release-notes", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The Terms of Service (effective 14 August 2026) name The Experience Company, Inc., a Delaware corporation. Neither the terms nor the privacy policy gives a postal address.", "The privacy policy (effective 7 August 2026) gives support@heygaia.so as its contact, a different domain from heygaia.io, where the README's security and contact addresses sit.", "heygaia.io/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md gives an email address for reports.", "The status page lists api.heygaia.io as the backend. We sent nothing to that host.", "heygaia.io's robots.txt allows every path and names ClaudeBot, Claude-Web and anthropic-ai with Allow. docs.heygaia.io carries Content-Signal ai-input=yes. status.heygaia.io returned an empty robots.txt.", "The domain's registration date was not looked up." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gaia.json", "live": { "slug": "gaia", "vendorStatus": { "page": "https://status.heygaia.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-12T17:28:08.466725732Z" }, "updatedAt": "2026-10-12T17:28:08.466725732Z" } }, { "slug": "picoclaw", "name": "PicoClaw", "vendor": "Sipeed", "vendorUrl": "https://picoclaw.io", "kind": "harness", "category": "personal-assistants", "summary": "PicoClaw is an open-source personal AI assistant from Sipeed, a single Go binary for small Linux boards, desktops and Android, reached through chat apps. Its last commit on the main branch was on 19 August 2026.", "url": "https://www.anchorterminal.com/tools/picoclaw", "markdownUrl": "https://www.anchorterminal.com/tools/picoclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/picoclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/picoclaw.json", "repo": "https://github.com/sipeed/picoclaw", "license": "MIT", "transports": [], "packages": [ { "registry": "oci", "name": "docker.io/sipeed/picoclaw" }, { "registry": "oci", "name": "ghcr.io/sipeed/picoclaw" } ], "auth": "none", "authNotes": "No account with Sipeed. The owner supplies model provider keys, chat bot tokens and search keys, kept in `~/.picoclaw/.security.yml`. The web launcher asks for a password set on first run, stored as a bcrypt hash. Each channel's `allow_from` list decides who may talk to the assistant, and an empty list admits everyone.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays their model provider by usage, or nothing with a local model through Ollama or vLLM. Search keys are optional, and DuckDuckGo search needs none.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, docs or source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 30000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.picoclaw.io", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "go", "docker", "pre-1.0" ], "lastRelease": "2026-07-03", "graded": true, "anchor": { "graded": true, "score": 46.1, "grade": "D", "agentReady": false, "rank": 879, "ranked": true, "rankOf": 986, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 22, "payments": 60, "reliability": 54, "schema": 51, "security": 51, "transparency": 56 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -7, "negativeNotes": [ "2026-04-25 to 2026-07-19. 15 advisories are listed for PicoClaw in the GitHub Advisory Database. Two are reviewed, CVE-2026-36045 (high, 7.3, command injection past the exec deny list, 0.1.2 and earlier) and CVE-2026-6987 (moderate, injection through the launcher's `/api/gateway/restart`, 0.2.4 and earlier), and 13 unreviewed entries of 10 to 19 July name versions up to 0.2.9. None lists a patched version, the project has published no advisory of its own, and it has no security policy. We read four of the fifteen. Several concern old versions and some fixes are in the git history, so -5. https://github.com/advisories?query=picoclaw", "Current behaviour, checked 2026-10-12. The repository's configuration guide says `tools.exec.allow_remote` defaults to `false`. The source at v0.3.1 and on main sets it to `true`, and the docs site calls fully open the default, so a remote chat can run shell commands on a default install. A misleading claim on a security default, the minimum, -2. https://github.com/sipeed/picoclaw/blob/main/docs/guides/configuration.md; https://github.com/sipeed/picoclaw/blob/main/pkg/config/defaults.go" ], "verdict": "Self-hosted under the MIT licence, with 19 documented chat channels, scheduled and heartbeat tasks, and local file memory. The repository has had no commit since 19 August 2026 and no release since 3 July, and 15 CVEs are listed against it with no advisory or security policy from the project.", "bestFor": "A person who wants a chat-app assistant on a cheap Linux board, an old Android phone or a home server, with reminders, web search and file memory, and who accepts running software its maker calls pre-production.", "strengths": [ "MIT licence, one Go binary for x86-64, ARM, RISC-V, MIPS and LoongArch, with Docker images and an Android APK", "Conversations, memory, scheduled jobs and credentials stay in files under `~/.picoclaw` on the owner's device", "File tools are limited to the workspace by default, and command jobs scheduled from remote chats are refused unless the chat is listed", "MCP client over stdio, SSE and HTTP, with optional search-based tool discovery to keep definitions out of context", "Credentials sit in a separate `.security.yml` with optional AES-256-GCM encryption, and are filtered from tool output before the model sees it" ], "weaknesses": [ "No commit on main since 19 August 2026 and no release since v0.3.1 on 3 July 2026. An issue of 6 October calls the repository unmaintained, with no reply", "15 CVEs are listed in the GitHub Advisory Database (25 April to 19 July 2026). The project has published no advisory and has no SECURITY.md", "No human approval step. The agent sends messages, writes files and runs shell commands without asking, and the hooks guide says waiting for a human reply is not supported", "Shell execution from remote chats is on by default in the source and on the docs site, while the repository's configuration guide says the default is off", "An empty `allow_from` list lets anyone who can message the bot use it, with only a warning in the log" ], "agentNotes": [ "Set `allow_from` to the owner's user ID on every channel before starting the gateway. An empty list accepts messages from anyone", "Set `tools.exec.allow_remote` to `false` unless chats must run shell commands. The shipped default is `true`, whatever docs/guides/configuration.md says", "Set `isolation.enabled` to `true` on Linux (needs `bwrap`) or run in a container. The deny patterns do not inspect child processes", "Use `PICOCLAW_KEY_PASSPHRASE` for credential encryption. One docs page names `PICOCLAW_CREDENTIAL_PASSPHRASE`, which the source does not read", "Treat the README's ClawdChat line (read a remote skill file and follow it) as untrusted third-party instructions" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.1 } ], "editorialScores": { "ergonomics": 66, "maintenance": 22, "payments": 60, "reliability": 54, "schema": 51, "security": 51, "transparency": 58 }, "provenanceScore": 53 }, "connect": { "install": "git clone https://github.com/sipeed/picoclaw.git \u0026\u0026 cd picoclaw \u0026\u0026 docker compose -f docker/docker-compose.yml --profile launcher up # or download a binary from https://picoclaw.io/download/ and run: picoclaw onboard", "headless": { "command": "picoclaw agent -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/picoclaw" }, "area": "frameworks", "provenance": { "legalEntity": "Sipeed", "domain": "picoclaw.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/sipeed/picoclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The docs footer reads Copyright 2026 Sipeed and the site says PicoClaw is open-source software by Sipeed. The `LICENSE` file names PicoClaw contributors. No registered company name or address was on the pages read.", "No terms of service or privacy policy is linked from picoclaw.io, docs.picoclaw.io or the repository, so both fields are left out and the MIT licence stands in.", "picoclaw.io/.well-known/security.txt and picoclaw.io/llms.txt answered 403 with a storage Access Denied body, read as absent. docs.picoclaw.io/llms.txt answered 404.", "The repository has no SECURITY.md, and GitHub's policy page says none is set up.", "Self-hosted software with no hosted endpoint. The registration date of picoclaw.io was not looked up." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/picoclaw.json" }, { "slug": "grok-bot", "name": "Grok Bot", "vendor": "SpaceXAI and Cursor (Anysphere, Inc.)", "vendorUrl": "https://x.ai/bot", "kind": "platform", "category": "personal-assistants", "summary": "Hosted assistant from SpaceXAI and Cursor. Named Bots work on a persistent cloud computer with a browser, files and terminal, reached from desktop and mobile apps, Slack and X, with routines that run on a schedule.", "url": "https://www.anchorterminal.com/tools/grok-bot", "markdownUrl": "https://www.anchorterminal.com/tools/grok-bot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/grok-bot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/grok-bot.json", "license": "Proprietary", "transports": [], "packages": [], "auth": "mixed", "authNotes": "A person signs in with a Cursor account in the browser, or with Sign in with Grok for a Grok Business seat. SAML 2.0 single sign-on applies to teams, and SCIM is Enterprise only. Connectors are added from Connect apps and authenticated in the browser by OAuth, or configured with a key or token. OAuth tokens stay on Cursor's backend. For passwords, passkeys, two-factor codes, CAPTCHAs and payment confirmations the Bot hands the computer to the owner, and a secure secret request masks a value and keeps it out of the transcript and away from the model. Browser sessions then persist on the cloud computer shared by all of the user's Bots (https://docs.x.ai/grok-bot/security; https://docs.x.ai/grok-bot/approvals-security-and-privacy; https://docs.x.ai/grok-bot/team-bots). No API key or public API for the assistant was found. An Admin API for team settings is linked from the docs and was not read.", "pricing": "paid", "pricingNotes": "No separate subscription. Grok Bot is included with every paid individual Cursor plan (Pro, Pro+, Ultra) and with Cursor Teams, or through a linked individual SuperGrok, SuperGrok Plus, SuperGrok Heavy or X Premium+ subscription, or a seat on a self-serve Grok Business plan. Cursor's pricing page shows Individual at $20 a month and Teams at $40 a user a month. The Pro+ and Ultra prices sit behind tabs our reader did not see. Each tier includes weekly usage with no amount published, metered by agent steps and tokens. After that, on-demand usage is billed through Cursor up to a monthly limit the owner sets, which is not a hard stop in the middle of a run. A free trial is a usage credit with a 7-day window and never becomes a paid plan. SuperGrok Lite is not included, and a SuperGrok link cannot be undone or moved (https://cursor.com/help/grok-bot/plans; https://cursor.com/pricing; checked 2026-10-12).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Grok Bot docs, the plans page or the Grok Bot Terms (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.x.ai/grok-bot/overview", "llmsTxt": "https://docs.x.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.accounts", "assistant.memory", "assistant.messaging", "agent.mcp-client" ], "tags": [ "hosted", "closed-source", "desktop-app", "mobile-app", "computer-use", "scheduled-routines", "slack", "status-page", "iso27001", "soc2", "llms-txt", "paid" ], "graded": true, "anchor": { "graded": true, "score": 45.2, "grade": "E", "agentReady": false, "rank": 893, "ranked": true, "rankOf": 986, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 20, "payments": 25, "reliability": 40, "schema": 40, "security": 68, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Connector tokens stay on Cursor's backend and each user gets a separate microVM, with approvals, drafts and a review model before risky actions. All of a user's Bots share one computer and its sign-ins, the review model skips memory writes, and the status page shows seven major Grok Bot incidents since 3 September 2026.", "bestFor": "A person or team already paying for Cursor or SuperGrok who wants named assistants that keep working on a cloud computer, with routines and Slack or X entry points, and who will write approval rules.", "strengths": [ "Connector OAuth tokens stay on Cursor's backend. Bots call tools without receiving them, and tokens are never stored on the cloud computer", "Each user's work runs in a dedicated Firecracker microVM. A Bot has no identity of its own and holds no more access than the signed-in member", "Approvals from routines, triggers or other Bots expire after about 10 minutes and the action does not run", "Email and Slack messages can appear as editable drafts with Send and Discard buttons, and passwords, two-factor codes and payment confirmations are handed to the owner", "Markdown copies of every docs page and an llms.txt, with a security page that states what the controls do not cover" ], "weaknesses": [ "All of one user's Bots share one cloud computer, with its files, browser sessions and command-line credentials. The docs say separate Bots are not a security boundary", "The review model does not check memory writes or most settings changes, and the Grok Bot Terms call approval controls aids only", "Deleting a Bot leaves shared files and browser sessions on the computer. No way to view or delete single memories was found in the docs read", "Seven incidents marked major named Grok Bot on status.cursor.com between 3 September and 6 October 2026, the longest about six and a half hours", "Audit logs, Action Recording, network allowlists and enforced review rules are Enterprise only. Other teams default to allow-all network access", "Cursor chooses the model with no picker and no fixed set of model vendors, and no Grok Bot changelog was found" ], "agentNotes": [ "State in each request what the Bot may change and where it must stop. Which actions pause for approval depends on the tool, the risk and the owner's Auto-review rules", "Add narrow Ask first rules for sending, publishing, purchasing and deleting. Ask first wins over Allow automatically when both match", "Treat any sign-in or file on the cloud computer as available to every Bot on the account. Give a workload its own Cursor user when it needs separate credentials", "Run Test run with safe inputs. A test run performs real work and can call connected tools", "To remove access, pause routines, sign out of sites on the computer, uninstall connectors and revoke them at the source service. Deleting the Bot is not enough" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 45.2 } ], "editorialScores": { "ergonomics": 50, "maintenance": 20, "payments": 25, "reliability": 40, "schema": 40, "security": 68, "transparency": 48 }, "provenanceScore": 84 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/grok-bot" }, "sameCompany": [ "cursor-cli" ], "area": "frameworks", "unitPrices": [ { "item": "Cursor Individual plan, as shown on the pricing page", "unit": "month", "usd": 20, "note": "Includes Grok Bot with weekly usage. On-demand usage extra" }, { "item": "Cursor Teams plan", "unit": "seat-month", "usd": 40, "note": "Includes Grok Bot for every member. On-demand usage on by default" } ], "provenance": { "legalEntity": "Anysphere, Inc.", "domain": "cursor.com", "domainRegistered": "1995-12-20", "endpointOnVendorDomain": null, "terms": "https://cursor.com/en-US/terms/grok-bot", "privacy": "https://cursor.com/privacy", "statusPage": "https://status.cursor.com", "changelog": "", "securityTxt": "valid", "checked": "2026-10-12", "notes": [ "The Grok Bot Terms (last updated 3 September 2026) supplement the agreement that governs the customer's use of the Services and define the Provider as the entity under that agreement. For a Cursor account that agreement is Cursor's Terms of Service (last updated 3 September 2026), which name Anysphere, Inc., 2261 Market Street STE 86466, San Francisco, CA 94114 (https://cursor.com/terms-of-service).", "The product docs are on docs.x.ai, titled SpaceXSI Docs, and name SpaceXAI. The Grok Bot Terms say they create no contractual relationship between the customer and any affiliate of the Provider. No page read states how the two companies are related.", "The privacy policy (last updated 11 October 2026) is Anysphere's and says it does not apply where Anysphere processes data for commercial customers as a processor.", "cursor.com/.well-known/security.txt gives a GitHub security page and security-reports@cursor.com as contacts and has no Expires field.", "The docs name api2.cursor.sh and *.cursorvm.com as the hosts the app and the cloud computer use. There is no endpoint an outside agent calls.", "RDAP for cursor.com gives a registration date of 1995-12-20.", "No changelog for Grok Bot was found. Cursor's changelog entries from 29 July to 6 October 2026 do not mention it.", "docs.x.ai's robots.txt allows every path with Content-Signal ai-input=yes. x.ai's robots.txt does the same, but x.ai/bot and status.x.ai answered HTTP 403." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/grok-bot.json", "live": { "slug": "grok-bot", "vendorStatus": { "page": "https://status.cursor.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-12T18:56:36.692375788Z" }, "updatedAt": "2026-10-12T18:56:36.692375788Z" } }, { "slug": "zo-computer", "name": "Zo Computer", "vendor": "Zo Computer Company", "vendorUrl": "https://www.zo.computer", "kind": "http-api", "category": "personal-assistants", "summary": "Hosted personal assistant from Zo Computer Company that runs on a cloud Linux computer assigned to each user. It answers by web chat, SMS, email, Slack, Discord and Telegram, runs scheduled automations, and has an HTTP API and MCP endpoint.", "url": "https://www.anchorterminal.com/tools/zo-computer", "markdownUrl": "https://www.anchorterminal.com/tools/zo-computer.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zo-computer.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zo-computer.json", "license": "Proprietary service under Zo Computer Company's terms of service", "transports": [ "http" ], "remoteUrl": "https://api.zo.computer/mcp", "packages": [], "auth": "api-key", "authNotes": "A bearer access token with the prefix `zo_sk_`, created by the owner under Settings \u003e Advanced and shown once. The same token is used for the HTTP API and the MCP endpoint, and both guides say it grants full access to the workspace. No scoped, read-only or expiring token and no OAuth flow for outside clients were found in the docs. Whether a token can be revoked individually is not stated on the pages read. `GET /models/catalog` needs no authentication. Sign-up is in a browser behind Cloudflare Turnstile.", "pricing": "freemium", "pricingNotes": "Free Trial is $0 for 14 days with no card, then ordinary computer access ends. Basic is $18 a month with $10 of AI credit, Pro $64 with $40 and Ultra $200 with $100. API and MCP access are included on all plans. Chat is billed at per-token rates on the models pages, which we did not read, and media at fixed per-request prices from $0.035. A user's own model API key can replace Zo-billed usage (checked 2026-10-12).", "priceSummary": "$18 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API guide, the OpenAPI file, the billing guide or the pricing page, checked 12 October 2026. Billing is a Stripe subscription with prepaid credits.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://www.zo.computer/guide", "llmsTxt": "https://www.zo.computer/llms.txt", "openapi": "https://www.zo.computer/docs-assets/openapi.json", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "agent.mcp-client" ], "tags": [ "official", "hosted", "closed-source", "assistant", "mcp", "openapi", "llms-txt", "free-trial" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 43.1, "grade": "E", "agentReady": false, "rank": 911, "ranked": true, "rankOf": 986, "categoryRank": 13, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 34, "maintenance": 68, "payments": 40, "reliability": 15, "schema": 73, "security": 37, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Zo publishes an OpenAPI file, Markdown docs, plan prices and a named list of the providers that receive user content. One access token grants full access to the workspace, no approval step before sending or buying was found in the reviewed docs, and no status page, rate limit or SLA is published.", "bestFor": "One person who wants a hosted assistant with its own Linux machine, reachable by text message and chat apps, and who accepts that the assistant acts on connected accounts without a documented approval step.", "strengths": [ "OpenAPI 3.1 file, llms.txt and a Markdown copy of every guide and reference page are public", "Persona permissions remove tools from a conversation, with 19 named scopes and a Read only preset", "The security page names each infrastructure, inference and tool provider and states which can see user content", "Plan prices, included AI credit and per-request media prices are public, with a 14-day trial that needs no card", "Dated weekly changelog, with nine weekly entries between 20 July and 14 September 2026" ], "weaknesses": [ "The access token for the API and MCP endpoint grants full access to the workspace, with no scoped or read-only token documented", "No approval step before sending mail, posting or buying was found. The browser guide says Zo can buy and send on signed-in sites", "No status page, incident history, rate limit figures or SLA were found on the pages read", "The privacy policy lists only email address, trackers, usage data and SMS data, and does not describe workspace files, memory or connected accounts", "Memory storage and deletion are not documented beyond a design aim and whole-account deletion or factory reset" ], "agentNotes": [ "Send `POST https://api.zo.computer/zo/ask` with `Authorization: Bearer zo_sk_...` and an `input` string. The owner creates the token under Settings \u003e Advanced", "Pass `persona_id` for a persona with a narrow tool set. The token itself carries every permission the owner has", "Set `memory_mode` to `off` to keep workspace memory out of a request. The field is in the OpenAPI file and absent from the API guide", "Do not retry `/zo/ask` blindly after a timeout. No idempotency key is documented and the request may already have sent a message", "Append `.md` to any guide or reference URL for Markdown" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.1 } ], "editorialScores": { "ergonomics": 34, "maintenance": 68, "payments": 40, "reliability": 15, "schema": 73, "security": 37, "transparency": 46 }, "provenanceScore": 73 }, "connect": { "http": "curl -X POST https://api.zo.computer/zo/ask \\\n -H \"Authorization: Bearer zo_sk_your_key_here\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"input\": \"Hello, Zo!\"}'", "claudeCode": "claude mcp add --transport http zo https://api.zo.computer/mcp --header \"Authorization: Bearer zo_sk_your_key_here\"", "config": { "mcpServers": { "zo": { "headers": { "Authorization": "Bearer zo_sk_your_key_here" }, "type": "http", "url": "https://api.zo.computer/mcp" } } } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/zo-computer" }, "area": "frameworks", "unitPrices": [ { "item": "Basic plan", "unit": "month", "usd": 18, "note": "Includes $10 of AI credit a month." }, { "item": "Pro plan", "unit": "month", "usd": 64, "note": "Includes $40 of AI credit a month." }, { "item": "Ultra plan", "unit": "month", "usd": 200, "note": "Includes $100 of AI credit a month." } ], "provenance": { "legalEntity": "Zo Computer Company", "domain": "zo.computer", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.zo.computer/reference/information/terms", "privacy": "https://www.zo.computer/reference/information/privacy-policy", "statusPage": "", "changelog": "https://www.zo.computer/updates", "securityTxt": "valid", "checked": "2026-10-12", "notes": [ "The terms of service name Zo Computer Company at 13 Grattan St Unit 102, Brooklyn, NY 11206, under New York law. They were last updated on 8 August 2025.", "The terms refer to an Acceptable Use Policy that we did not find linked from the pages read.", "security.txt at www.zo.computer/.well-known/security.txt gives a contact, a policy link and an expiry of 8 April 2027.", "No status page is linked from the home page, the docs index, the security page or the help centre home page.", "The API and MCP endpoint are on api.zo.computer. The domain's registration date was not looked up.", "The X handle is the one the home page footer links." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zo-computer.json", "live": { "slug": "zo-computer", "probe": { "target": "https://api.zo.computer/mcp", "method": "get", "lastAt": "2026-10-12T19:01:35.563750129Z", "lastOk": true, "lastStatus": 405, "lastMs": 472, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 320, "p95ms24h": 1228, "samples24h": 18, "samples30d": 18, "days": [ { "date": "2026-10-12", "probes": 18, "ok": 18 } ] }, "updatedAt": "2026-10-12T19:01:35.563750129Z" } }, { "slug": "leon", "name": "Leon", "vendor": "Louis Grenard (Leon AI)", "vendorUrl": "https://getleon.ai", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant by Louis Grenard that the owner runs on their own machine or server. The 2.0 Developer Preview adds an agent loop with tools, layered memory, computer use and a proactive pulse, reached through a web app.", "url": "https://www.anchorterminal.com/tools/leon", "markdownUrl": "https://www.anchorterminal.com/tools/leon.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/leon.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/leon.json", "repo": "https://github.com/leon-ai/leon", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@leon-ai/cli" } ], "auth": "none", "authNotes": "No account. The web app and the Socket.IO and HTTP interfaces accept any client unless `client_interface.auth.enabled` is set, after which a `\u003cprofile\u003e:\u003ctoken\u003e` credential from `LEON_PROFILE_TOKEN` is required. Model provider keys go in the profile `.env`. Connected apps use OAuth or a pasted token.", "pricing": "free", "pricingNotes": "Free and MIT, with nothing to buy. The project takes sponsorship. Model usage is billed by the provider the owner picks, or costs nothing with a local llama.cpp model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the context documents or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 17568, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://github.com/leon-ai/leon/blob/develop/README.md", "capabilities": [ "assistant.proactive", "assistant.self-hosted", "assistant.memory", "assistant.accounts" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "typescript", "beta", "telemetry-default-on" ], "lastRelease": "2023-05-01", "graded": true, "anchor": { "graded": true, "score": 41, "grade": "E", "agentReady": false, "rank": 934, "ranked": true, "rankOf": 986, "categoryRank": 14, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 15, "payments": 60, "reliability": 32, "schema": 33, "security": 34, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Connected-app credentials are encrypted per profile and the Gmail connection is read-only. The 2.0 Developer Preview has no tagged release, runs tools and a 30-minute proactive pulse with no approval step, listens on every network interface with client authentication off, and sends telemetry by default.", "bestFor": "A developer who wants a self-hosted assistant with memory, computer use and a local model, and who will read the source.", "strengths": [ "MIT licence, with the whole server, web app, tools and skills in one public repository", "Connected-app credentials are stored per profile with AES-256-GCM, and the Gmail connection asks only for the `gmail.readonly` scope", "Runs with a local llama.cpp model or any of 11 hosted providers, so the owner chooses which company sees the content", "Tool allow and disable lists, a configurable iteration limit (256 by default) and per-profile tool-call logs", "At least 200 commits between 25 September and 12 October 2026, with a fresh-install check passing on develop three times a week" ], "weaknesses": [ "No tagged release of the core since 1.0.0-beta.8 on 1 May 2023. The 2.0 Developer Preview is installed by cloning the develop branch", "No approval step before a tool call. Shell commands pass a blocklist of patterns, and the proactive pulse is on by default and runs one task every 30 minutes", "The server listens on 0.0.0.0 and client authentication is off in the sample config", "Telemetry is on in the sample config and posts an instance ID, versions and hardware details to telemetry.getleon.ai. The README and the docs pages read do not describe it", "No `SECURITY.md`, security.txt, privacy policy or 2.0 documentation, and no messaging-app channel or MCP client on the develop branch" ], "agentNotes": [ "Clone the develop branch for 2.0. `npm install --global @leon-ai/cli` and docs.getleon.ai install and describe the legacy 1.0 betas", "Set `client_interface.auth.enabled: true` and a `LEON_PROFILE_TOKEN` before the machine joins a shared network. The server binds 0.0.0.0", "Set `telemetry_enabled: false` and `runtime.pulse_enabled: false` in the profile `config.yml` for an unattended or private run", "Use `availability.tools.allowed` to limit tools. Shell, file writes, computer use and browser control are otherwise available to the agent with no approval prompt", "Back up `LEON_CONNECTIONS_ENCRYPTION_KEY` from the profile `.env`. Without it the stored connections cannot be read" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41 } ], "editorialScores": { "ergonomics": 57, "maintenance": 15, "payments": 60, "reliability": 32, "schema": 33, "security": 34, "transparency": 52 }, "provenanceScore": 68 }, "connect": { "install": "git clone https://github.com/leon-ai/leon.git \u0026\u0026 cd leon \u0026\u0026 npm install --global pnpm@latest \u0026\u0026 pnpm install \u0026\u0026 pnpm start" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/leon" }, "area": "frameworks", "provenance": { "legalEntity": "No legal entity found. Copyright Louis Grenard", "domain": "getleon.ai", "domainRegistered": "2018-02-16", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/leon-ai/leon/blob/develop/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "`LICENSE.md` and the footer of getleon.ai read Copyright 2019 to present Louis Grenard. No company or foundation is named on the pages read.", "No terms of service or privacy policy was found on getleon.ai, docs.getleon.ai or in the repository, so no link is given and the MIT licence stands in.", "getleon.ai/.well-known/security.txt returns 404, and the repository has no `SECURITY.md`. The GitHub API lists no published security advisory.", "RDAP for getleon.ai gives a registration date of 2018-02-16.", "The assistant answers on the owner's own host. The only vendor endpoint the source names is telemetry.getleon.ai, which receives telemetry.", "`CHANGELOG.md` ends at 1.0.0-beta.8 of 1 May 2023. Changes to the 2.0 Developer Preview are recorded only as commits." ], "score": 68 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/leon.json" }, { "slug": "poke", "name": "Poke", "vendor": "The Interaction Company of California Inc.", "vendorUrl": "https://poke.com", "kind": "platform", "category": "personal-assistants", "summary": "Hosted personal assistant from The Interaction Company of California, reached by text on Apple Messages, WhatsApp, Telegram and RCS. It works across the owner's Gmail or Outlook mail, calendar, contacts and connected apps.", "url": "https://www.anchorterminal.com/tools/poke", "markdownUrl": "https://www.anchorterminal.com/tools/poke.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/poke.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/poke.json", "license": "Proprietary service under Poke's Terms of Service. The `poke` npm package (CLI and Node.js SDK) declares MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "poke" } ], "auth": "api-key", "authNotes": "A person signs up at poke.com and connects a Google or Microsoft account. The Poke API takes `Authorization: Bearer \u003ckey\u003e` with a V2 key created in Kitchen under API Keys. Keys are named, shown once, revocable one at a time and have no scopes. Older `pk_` keys work only on the deprecated endpoint. The CLI signs in with a browser device code and stores credentials in `~/.config/poke/credentials.json`. Third-party MCP servers are connected with an API key or OAuth (https://poke.com/docs/api; https://poke.com/docs/mcp-servers; https://poke.com/docs/creating-recipes).", "pricing": "freemium", "pricingNotes": "Free at $0 with no card. Pro is $19 a month and Ultra $199 a month on monthly billing. Free and Pro have a refilling usage allowance, with no figures published, and Poke continues in a lighter mode past it. Ultra includes a monthly credit pool (1 credit is $1 of usage), with top-ups and optional auto-reload. Poke Human is included with Ultra, with real-world expenses charged at cost. Model usage is not billed separately (https://poke.com/pricing; https://poke.com/docs/usage-and-resets; https://poke.com/faq, checked 2026-10-12).", "priceSummary": "$19 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt or the pricing page (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://poke.com/docs", "llmsTxt": "https://poke.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "agent.mcp-client" ], "tags": [ "hosted", "closed-source", "messaging", "imessage", "whatsapp", "telegram", "gmail", "outlook", "mcp-client", "api-key", "free-tier", "status-page", "llms-txt", "trains-on-data-by-default" ], "lastRelease": "2026-06-25", "graded": true, "anchor": { "graded": true, "score": 37.6, "grade": "F", "agentReady": false, "rank": 955, "ranked": true, "rankOf": 986, "categoryRank": 15, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 30, "maintenance": 31, "payments": 30, "reliability": 51, "schema": 42, "security": 24, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Hosted assistant that answers in Apple Messages, WhatsApp, Telegram and RCS and acts in Gmail, Outlook, calendars and MCP servers. Plan prices and a status page are public. No approval settings, credential storage, model providers or retention periods are documented, and customer content trains models unless Maximum Privacy is selected.", "bestFor": "One person who wants an assistant in their text messages that reads and drafts mail, manages a calendar and reaches other apps through MCP.", "strengths": [ "Answers on Apple Messages, WhatsApp, Telegram and RCS, with the channel chosen in settings, per the docs welcome page and FAQ", "Free plan with no card, Pro at $19 a month and Ultra at $199 a month, all published without a sign-in", "Connects any remote MCP server by URL, with API key or OAuth, and OAuth servers with Dynamic Client Registration need no setup", "status.poke.com lists App, Email, Integrations, three messaging channels and API, with two incidents from July to 12 October 2026", "Named API keys are created in Kitchen, shown once and revoked one at a time" ], "weaknesses": [ "No documented setting for which actions need approval before Poke sends, deletes or spends. Release notes mention email draft approval only in passing", "Customer content, including email contents, may train AI models unless the user selects Maximum Privacy, per the privacy notice of 11 September 2026", "Model providers, sub-processors, hosting locations and where account tokens are stored are not named in the pages read", "An API key message is processed with full access to email, calendar and integrations. Keys have no scopes", "No security.txt, disclosure policy, bug bounty or certification was found on poke.com", "The terms forbid automated access for scraping and use for benchmarking or competitive analysis. This matters before any probe is run" ], "agentNotes": [ "POST JSON to `https://poke.com/api/v1/inbound/api-message` with a Bearer key from Kitchen. Legacy `pk_` keys work only on the deprecated `/api/v1/inbound-sms/webhook`", "Expect only `{\"success\": true}` back. Poke's answer goes to the owner's message thread, not to the caller", "Do not retry a POST blindly. No idempotency key is documented, and a repeated message may make Poke act twice", "Treat an API key as full access to the owner's mail, calendar and integrations. Create one key per automation and revoke it when done", "Avoid the prefilled integration link with `apiKey` in the query string for real secrets. Enter the key in the form or use `npx poke@latest mcp add -k`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 37.6 } ], "editorialScores": { "ergonomics": 30, "maintenance": 31, "payments": 30, "reliability": 51, "schema": 42, "security": 24, "transparency": 34 }, "provenanceScore": 81 }, "connect": { "install": "npx poke@latest login", "http": "curl 'https://poke.com/api/v1/inbound/api-message' \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"message\": \"test\"}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/poke" }, "area": "frameworks", "unitPrices": [ { "item": "Pro", "unit": "month", "usd": 19, "note": "billed monthly, refilling usage allowance with no published figure" }, { "item": "Ultra", "unit": "month", "usd": 199, "note": "billed monthly, includes a monthly credit pool and Poke Human" }, { "item": "Ultra top-up credit", "unit": "credit", "usd": 1, "note": "1 credit is $1 of usage" } ], "provenance": { "legalEntity": "The Interaction Company of California Inc.", "domain": "poke.com", "domainRegistered": "1997-03-26", "endpointOnVendorDomain": true, "terms": "https://poke.com/terms", "privacy": "https://poke.com/privacy", "statusPage": "https://status.poke.com", "changelog": "https://poke.com/docs/release-notes", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The privacy notice (last updated 11 September 2026) names The Interaction Company of California Inc. and gives 169 Waverley St Apt B, Palo Alto, CA 94301 as the controller's address. The terms (last modified 17 March 2026) name The Interaction Company of California d/b/a Poke.", "Cognition announced on 23 July 2026 that The Interaction Company of California was joining it. The terms and privacy notice read on 12 October 2026 do not name Cognition.", "poke.com/.well-known/security.txt answered 404. poke.com/robots.txt also answered 404, so the host publishes no crawl rules.", "RDAP for poke.com gives a registration date of 1997-03-26 and NameCheap, Inc. as registrar.", "The API answers at poke.com/api/v1, on the vendor's domain." ], "score": 81 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/poke.json", "live": { "slug": "poke", "vendorStatus": { "page": "https://status.poke.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-12T18:57:01.261625139Z" }, "updatedAt": "2026-10-12T18:57:01.261625139Z" } }, { "slug": "lindy", "name": "Lindy", "vendor": "Crivello Corp (doing business as Lindy)", "vendorUrl": "https://www.lindy.ai", "kind": "platform", "category": "personal-assistants", "summary": "Lindy is a hosted AI assistant from Crivello Corp. Each user has a private assistant for mail, calendar and meetings, reached by Slack, iMessage, SMS, email or the web app, and a team shares a second one in Slack channels.", "url": "https://www.anchorterminal.com/tools/lindy", "markdownUrl": "https://www.anchorterminal.com/tools/lindy.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/lindy.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/lindy.json", "license": "Proprietary service under Lindy's Terms of Service. No source is published", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A person signs in with Google or Microsoft and connects mail and calendar from either, a phone number verified by code, and Slack through an app an owner or admin installs. Other tools connect by OAuth or an API key, and every action for a tool turns on at once with no scope choice in Lindy. A connection is personal until an owner or admin shares it with the workspace, after which everyone's Lindy works as that account. Saved API keys are write-only and can be rotated or revoked. No public API or key for outside callers was found in the docs.", "pricing": "paid", "pricingNotes": "$29.99 per active user a month with 3,000 credits, pooled across the workspace, and larger monthly credit amounts up to 1,750,000 for $9,999.50. Top-ups are $10 per 1,000 credits and do not expire, while monthly credits do not roll over. New accounts get $50 of credit for seven days with no card. The pricing page gives 2 to 250 credits for an everyday request and 1,000 to 2,500 for a large build. The docs name Plus, Pro and Max plans priced only inside the app, which the pricing page does not list (checked 2026-10-12).", "priceSummary": "$29.99 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the pricing page, the terms or the docs (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.lindy.ai", "llmsTxt": "https://docs.lindy.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "agent.mcp-client" ], "tags": [ "hosted", "closed-source", "paid", "free-trial", "no-card", "slack", "imessage", "sms", "email", "chrome-extension", "mcp-client", "approvals", "llms-txt", "soc2", "team" ], "lastRelease": "2025-10-21", "graded": true, "anchor": { "graded": true, "score": 32.3, "grade": "F", "agentReady": false, "rank": 968, "ranked": true, "rankOf": 986, "categoryRank": 16, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 43, "maintenance": 9, "payments": 35, "reliability": 24, "schema": 32, "security": 49, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -3, "negativeNotes": [ "2026-10-12. The pricing page and the docs pricing page answer the question of whether Lindy does anything without approval with No, and say anything with outside impact waits for approval. The integrations page says approval settings apply in shared Slack threads only, that web chat, Slack direct messages, iMessage and SMS are not guarded, and that an integration can be set to always allow writes (https://www.lindy.ai/pricing, https://docs.lindy.ai/pricing.md, https://docs.lindy.ai/integrations/overview.md). 3 points for a misleading claim." ], "verdict": "Lindy keeps what it remembers in files the owner can read and edit, and publishes credit prices. Its approval setting applies in shared Slack threads only, so writes asked for by direct message, text or web chat run unasked, which its pricing page does not say. It has no status page, and its changelog stops in October 2025.", "bestFor": "Lindy suits a person or small team that lives in Slack and Google or Microsoft mail and wants briefs, drafts, scheduling and meeting notes done on a schedule.", "strengths": [ "Memory is a set of plain files in the web app, split into Personal, Team and System scopes, which the owner can read, edit and restore by version.", "Each integration has a setting that makes Lindy ask in Slack before writing, or stops it writing with that tool at all.", "Saved API keys are write-only. The docs say a value cannot be read back in the app, through the API or by asking Lindy, and keys can be rotated or revoked.", "The privacy policy of 28 September 2026 names its processors by category, among them Anthropic, OpenAI, Perplexity AI, Pipedream, WorkOS, Twilio and Recall.ai.", "Credit prices are public. A seat is $29.99 a month with 3,000 credits, top-ups are $10 per 1,000, and new accounts get $50 of credit with no card." ], "weaknesses": [ "The integrations page says approval settings apply in shared Slack threads only. Web chat, Slack direct messages, iMessage and SMS are not covered, and reads are never covered.", "The pricing page and the docs pricing page both answer that Lindy does nothing with outside impact without approval, which the integrations page contradicts.", "No status page, uptime record or SLA was found on the site or in the docs.", "The public changelog's newest entry is dated 21 October 2025, and it describes an agent builder the current docs no longer cover.", "Deleting a memory file keeps its earlier versions, and no way to purge them or a retention period was found. The privacy policy gives no period either.", "The terms of 24 September 2026 forbid automated use of the system and use for any commercial enterprise, in a product sold to companies. This matters before any probe is run." ], "agentNotes": [ "Treat a request sent by direct message, text or web chat as unguarded. Approval prompts appear in shared Slack threads only.", "Run a routine as a dry run before turning it on. A dry run reads real data and sends, posts and writes nothing.", "Turn off unused tools after adding an MCP server. Every supported tool arrives switched on, and a large server adds more than a hundred.", "Expect a billed seat for anyone who mentions Lindy in Slack. A teammate who joins that way has seven free days first.", "Connect only hosted MCP servers on public HTTPS with streamable HTTP, the one kind the docs describe." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 32.3 } ], "editorialScores": { "ergonomics": 43, "maintenance": 9, "payments": 35, "reliability": 24, "schema": 32, "security": 49, "transparency": 36 }, "provenanceScore": 68 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/lindy" }, "area": "frameworks", "unitPrices": [ { "item": "Team seat", "unit": "seat-month", "usd": 29.99, "note": "3,000 credits a month, pooled across the workspace. Every active user is billed" }, { "item": "Top-up credit", "unit": "credit", "usd": 0.01, "note": "$10 per 1,000 credits. Top-up credits do not expire, monthly credits do not roll over" } ], "provenance": { "legalEntity": "Crivello Corp (doing business as Lindy)", "domain": "lindy.ai", "domainRegistered": "2019-05-16", "endpointOnVendorDomain": true, "terms": "https://www.lindy.ai/terms-of-service", "privacy": "https://www.lindy.ai/privacy", "statusPage": "", "changelog": "https://www.lindy.ai/changelog", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The Terms of Service, last updated 24 September 2026, name Crivello Corp, doing business as Lindy, registered in Oregon at 9450 SW Gemini Dr, Beaverton, OR 97008, and are governed by California law with binding arbitration.", "The terms cover the site and all related products and services. No separate service agreement or DPA was linked from the pages read.", "The privacy policy was last updated 28 September 2026.", "The web app and sign-in are at chat.lindy.ai.", "www.lindy.ai/.well-known/security.txt returns 404. No disclosure policy or bug bounty was found.", "No status page is linked from the site, the docs or the security page.", "RDAP gives a registration date of 2019-05-16 for lindy.ai, with NameCheap as registrar." ], "score": 68 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/lindy.json" }, { "slug": "openai-dots", "name": "Dots", "vendor": "OpenAI", "vendorUrl": "https://chatgpt.com", "kind": "platform", "category": "personal-assistants", "summary": "Dots is OpenAI's always-on agent inside ChatGPT, in beta. Each dot has a cloud computer and browser, keeps notes, works between conversations across connected apps, and answers in ChatGPT, by voice call, Slack and Teams.", "url": "https://www.anchorterminal.com/tools/openai-dots", "markdownUrl": "https://www.anchorterminal.com/tools/openai-dots.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openai-dots.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openai-dots.json", "license": "Proprietary hosted service. The governing terms were not read", "transports": [], "packages": [], "auth": "mixed", "authNotes": "A person signs in to ChatGPT on an eligible plan and creates a dot in the mobile app, desktop app or a desktop browser. No API key or other credential for outside programs was found. Apps are reached through plugins connected to the ChatGPT account, each with its own connected account and allowed actions. Website logins go through a private form to the cloud browser outside the conversation, sessions last until sign-out or expiry, and reusing a saved login needs confirmation. A local computer is connected with Allow access and removed with Revoke access. Where tokens and saved passwords are stored is not stated (https://learn.chatgpt.com/docs/dots/computers-and-apps; https://learn.chatgpt.com/docs/dots/getting-started).", "pricing": "paid", "pricingNotes": "Included with ChatGPT Pro at $100, $200 or $500 a month, Business Premium (price not found on the pages read) and Enterprise through sales. Conversations with a dot do not count towards ChatGPT usage limits. Tasks it starts in ChatGPT Work or Codex count towards those limits. The plan includes an allowance for deeper work with no figure given, extended for the first month after launch. No free tier or trial for dots was found (https://learn.chatgpt.com/docs/dots#access; https://learn.chatgpt.com/docs/pricing, checked 2026-10-12).", "priceSummary": "$100 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Dots docs, the admin guide or the pricing page (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://learn.chatgpt.com/docs/dots", "llmsTxt": "https://learn.chatgpt.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.accounts", "assistant.memory", "assistant.messaging" ], "tags": [ "hosted", "closed-source", "beta", "chatgpt", "slack", "teams", "voice", "cloud-browser", "approvals", "paid", "llms-txt" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 28.3, "grade": "F", "agentReady": false, "rank": 973, "ranked": true, "rankOf": 986, "categoryRank": 17, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 22, "maintenance": 38, "payments": 10, "reliability": 3, "schema": 41, "security": 58, "transparency": 31 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-10-12" }, "negative": 0, "verdict": "Actions that affect accounts or share information pass an automatic review, and custom rules can require approval or a hand-off. Dots is a beta on Pro plans from $100 a month, and no status page, terms, privacy policy or way to delete individual saved notes was found in the pages we could read.", "bestFor": "A ChatGPT Pro or Enterprise user who wants ongoing work tracked across mail, documents, code and Slack with approval before sends.", "strengths": [ "An automatic review checks each action that could affect accounts or share information against instructions, permissions and custom rules before it runs", "Custom rules have four settings, from acting without asking to handing the step to the owner, and app permissions can allow reading mail without sending", "Proactive research uses tools that cannot send messages, change app content or control a browser or computer, per the docs", "Website passwords are entered in a private form outside the conversation, and reusing a saved login needs the owner's confirmation", "Six docs pages with Markdown twins listed in llms.txt, and a dated release note for dots on 9 October 2026" ], "weaknesses": [ "Beta. The admin setting is labelled Use dots (Beta), access is rolling out gradually, and Teams access is an invite-only alpha", "No way to view or delete individual saved notes is documented. The admin guide's link to reset options lands on the section for deleting the whole dot", "Custom rules are described as instructions the dot tries to follow and can get wrong, and an authorised write can run without a prompt where policy allows", "Pro consumer accounts in the European Economic Area, the United Kingdom and Switzerland are excluded, and the plan's allowance for deeper work has no published figure", "No status page, service terms or privacy policy is linked from the Dots docs, and openai.com and help.openai.com refused our reader", "No API, MCP endpoint or other documented way for an outside program to message a dot was found" ], "agentNotes": [ "Say what may be sent. Asking a dot to draft replies does not permit sending them, and an action outside a stated scope needs another decision", "Stop three things separately. Pause stops the main task only, delegated tasks stop in Activity and recurring tasks in Scheduled, and completed actions are not undone", "Connect each thing separately. A messaging channel grants no access to an inbox, an app or a computer", "Sign out of websites and disconnect apps yourself when removing access. Revoking dots access or disconnecting an app does not delete information already obtained", "Keep the connected computer online with the ChatGPT app open for local work. Only one personal computer can be connected at a time" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28.3 } ], "editorialScores": { "ergonomics": 22, "maintenance": 38, "payments": 10, "reliability": 3, "schema": 41, "security": 58, "transparency": 26 }, "provenanceScore": 36 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/openai-dots" }, "area": "frameworks", "unitPrices": [ { "item": "Pro 100", "unit": "month", "usd": 100, "note": "ChatGPT Pro plan, includes dots with an allowance for deeper work that has no published figure" }, { "item": "Pro 200", "unit": "month", "usd": 200, "note": "ChatGPT Pro plan" }, { "item": "Pro 500", "unit": "month", "usd": 500, "note": "ChatGPT Pro plan" } ], "provenance": { "legalEntity": "", "domain": "chatgpt.com", "domainRegistered": "2022-11-30", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://learn.chatgpt.com/docs/whats-new", "securityTxt": "unknown", "checked": "2026-10-12", "notes": [ "No page we read names the legal entity or the documents that govern Dots. The docs footer links https://openai.com/policies, which answered 403 to our reader, so `terms` and `privacy` are left out. OpenAI's other listings here link https://openai.com/policies/services-agreement/ and https://openai.com/policies/privacy-policy/. Neither was read today, and whether the consumer Terms of Use govern Pro accounts was not established.", "No status page is linked from the Dots docs, the admin guide, the pricing page or the release notes we read.", "learn.chatgpt.com/.well-known/security.txt answered 404. chatgpt.com is closed to Anthropic agents by its robots.txt and openai.com answered 403 on the one page requested, so neither host's security.txt was requested.", "The .com registry's RDAP record gives 30 November 2022 as the registration date of chatgpt.com, registrar MarkMonitor Inc.", "learn.chatgpt.com/robots.txt answered 200 and allows every path. help.openai.com/robots.txt allows the article paths, and four linked articles answered 403 with a JavaScript check. cdn.openai.com/robots.txt answered 404." ], "score": 36 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openai-dots.json" }, { "slug": "gemini-spark", "name": "Gemini Spark", "vendor": "Google LLC", "vendorUrl": "https://gemini.google/us/overview/agent/spark/", "kind": "platform", "category": "personal-assistants", "summary": "Gemini Spark is Google's hosted personal AI agent inside the Gemini app. It runs tasks and schedules in Google's cloud across Gmail, Calendar, Drive and other connected apps for Google AI Pro and Ultra subscribers.", "url": "https://www.anchorterminal.com/tools/gemini-spark", "markdownUrl": "https://www.anchorterminal.com/tools/gemini-spark.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gemini-spark.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gemini-spark.json", "license": "Proprietary hosted service under the Google Terms of Service", "transports": [], "packages": [], "auth": "oauth", "authNotes": "No credential for an outside agent exists, because no public API was found. A person signs in to the Gemini app with a personal Google Account and needs a Google AI Pro or Ultra subscription (https://support.google.com/gemini/answer/17094507). Connected apps are off by default and are switched on in settings (https://gemini.google/us/overview/agent/spark/). Third-party and custom apps are linked to the Google Account and can be unlinked in Connected Apps settings or on the account's Linked apps page. A custom MCP server that lacks Dynamic Client Registration takes credentials the user enters (https://support.google.com/gemini/answer/17209137). Google tells users not to type sign-in or payment details into a task thread and to enter them on the web page in take control mode (https://support.google.com/gemini/answer/17094507).", "pricing": "paid", "pricingNotes": "Spark needs a Google AI Pro or Ultra subscription. US prices are $19.99 a month for Pro and $99.99 or $199.99 a month for Ultra, with Spark use counted against compute-based limits that refresh every five hours up to a weekly limit (https://gemini.google/us/subscriptions/; https://support.google.com/gemini/answer/16275805). The subscriptions page lists Spark under Ultra as first access in select countries, while the help page names Pro and Ultra. No free tier includes Spark. The page links a two-month trial offer whose terms were not read (checked 2026-10-12).", "priceSummary": "$19.99 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the pages read, and no public API to carry one (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://support.google.com/gemini/answer/17094507", "capabilities": [ "assistant.proactive", "assistant.accounts", "assistant.memory", "agent.mcp-client" ], "tags": [ "hosted", "consumer", "closed-source", "no-api", "beta", "ios", "android", "macos", "web", "browser-agent", "approvals", "mcp-client", "subscription", "trains-on-data-by-default" ], "lastRelease": "2026-05-19", "graded": true, "anchor": { "graded": true, "score": 24.5, "grade": "F", "agentReady": false, "rank": 974, "ranked": true, "rankOf": 986, "categoryRank": 18, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 9, "maintenance": 17, "payments": 10, "reliability": 14, "schema": 17, "security": 60, "transparency": 49 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Google's help pages state what Spark confirms before doing, how to delete its remote browser and code data, and the risks of prompt injection. Spark has no public API, Google calls it experimental, and it runs only with Keep Activity on, the setting under which chats are used for model training and human review.", "bestFor": "A person who already keeps mail, calendar and files in a personal Google Account and accepts Keep Activity being on.", "strengths": [ "Google says Spark asks for confirmation before sending communications, modifying data, making purchases, submitting web forms and using Sign in with Google", "Connected apps are off by default, and write actions through a custom MCP server need manual confirmation, per Google's help pages", "The help page names prompt injection, gives four examples of what an injected instruction could do, and says the safeguards do not guarantee protection", "Each task thread has a work panel listing completed and planned steps, files read or updated, schedules, and the skills and apps used", "Published limits of 15 running tasks and 50 active schedules, and plan prices of $19.99 to $199.99 a month in the US" ], "weaknesses": [ "No public API, SDK or MCP server for an outside agent was found. Spark is reached in the Gemini mobile app, the Mac app and gemini.google.com", "Google's help page calls Spark an experimental feature in early development, and the Privacy Hub calls it beta", "Spark runs only with Keep Activity on. With that setting on, Google uses activity to train generative AI models and human reviewers read some chats", "Chats already reviewed by human reviewers are kept for up to three years and are not deleted when the user deletes activity", "Google states that Gemini can perform bulk actions on private Google Tasks without confirmation", "The remote browser saves cookies holding website sign-in details for later sessions until the user deletes them or turns Spark off", "No status page or SLA for Spark was linked from the pages read, and the bug bounty site linked from Google's terms is drawn by script and was unread" ], "agentNotes": [ "Do not plan an integration against Spark. No public API or MCP server was found, and a person must hold a Google AI Pro or Ultra subscription", "Expect a confirmation request before sends, edits, purchases and web form submissions, and note that bulk changes to private Google Tasks run without one", "Delete remote browser data and remote code execution data in Gemini Spark Settings after a sensitive session. Deleting a task thread or Gemini Apps activity does not remove them", "Keep within 15 running tasks and 50 active schedules. A schedule does not run when 15 tasks are running or the usage limit is reached", "Treat every safety statement here as Google's own description. None was tested, and no message was sent to the service" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 24.5 } ], "editorialScores": { "ergonomics": 9, "maintenance": 17, "payments": 10, "reliability": 14, "schema": 17, "security": 60, "transparency": 44 }, "provenanceScore": 54 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/gemini-spark" }, "area": "frameworks", "unitPrices": [ { "item": "Google AI Pro", "unit": "month", "usd": 19.99, "note": "US price, includes Spark with 4 times the standard usage limit" }, { "item": "Google AI Ultra (5x)", "unit": "month", "usd": 99.99, "note": "US price, 5 times the Pro usage limit" }, { "item": "Google AI Ultra (20x)", "unit": "month", "usd": 199.99, "note": "US price, 20 times the Pro usage limit" } ], "provenance": { "legalEntity": "Google LLC", "domain": "gemini.google", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://policies.google.com/terms", "privacy": "https://support.google.com/gemini/answer/13594961", "statusPage": "", "changelog": "https://gemini.google/us/release-notes/", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The Gemini Apps Privacy Notice says Gemini Apps are supplied by Google Ireland Limited in the European Economic Area and Switzerland and by Google LLC everywhere else. Spark is not available in the European Economic Area or Switzerland.", "Google's service-specific terms page lists Gemini Apps under the Google Terms of Service (effective 30 July 2026), the Generative AI Prohibited Use Policy and the Gemini Apps Agentic Calling Additional Terms of Service. The Generative AI Additional Terms of Service that the subscriptions page links say they stopped applying on 22 May 2024.", "The privacy link is the Gemini Apps Privacy Hub, which holds the Gemini Apps Privacy Notice (last updated 29 June 2026) and the Spark data questions (hub last updated 24 September 2026). The notice supplements the Google Privacy Policy at policies.google.com/privacy (effective 12 October 2026).", "No status page for Gemini Apps or Spark was linked from any page read.", "The release notes are the Gemini app's. Their only entry about Spark is dated 19 May 2026.", "gemini.google/.well-known/security.txt answered 404. Google's terms link bughunters.google.com as its safety and bug testing programmes. That site's home page is drawn by script and was unread.", "gemini.google is a name under Google's own .google top-level domain. Its registration date was not looked up.", "policies.google.com/robots.txt answered 404, read as no rules. The robots.txt files of gemini.google, support.google.com and bughunters.google.com allow the pages read." ], "score": 54 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gemini-spark.json" }, { "slug": "haven", "name": "Haven", "vendor": "Hello Haven, Inc.", "vendorUrl": "https://my.hellohaven.ai", "kind": "platform", "category": "personal-assistants", "summary": "Hosted personal AI assistant from Hello Haven, Inc. that a person reaches by phone call, text message, email, web or mobile app. It keeps a memory of the user and carries out tasks for them. In beta.", "url": "https://www.anchorterminal.com/tools/haven", "markdownUrl": "https://www.anchorterminal.com/tools/haven.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/haven.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/haven.json", "license": "Proprietary service under Hello Haven's Terms of Service", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "A person signs up at my.hellohaven.ai/gethaven with an invite code and signs in at app.hellohaven.ai, or reaches Haven from their own phone number or email address. The sign-in method was not read, because the app is behind a sign-in. No API key, OAuth app or other developer credential was found. The terms say Haven connects with the user's email, calendar, cloud storage, messaging and other services, and the privacy policy says authentication credentials for connected services are shared with those providers. Provider names, scopes and where tokens are stored were not found (https://my.hellohaven.ai/terms; https://my.hellohaven.ai/privacy).", "pricing": "free", "pricingNotes": "Free during beta with full access and no card, per the plans page. The FAQ says there are no usage limits, that prices are not set, and that users will get notice before charges begin. The terms mention subscription billing through a payment processor but no price is published (https://my.hellohaven.ai/plans; https://my.hellohaven.ai/faq, checked 2026-10-12).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the site, the plans page or the terms, and no API to carry one (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://my.hellohaven.ai/faq", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory" ], "tags": [ "hosted", "closed-source", "beta", "free", "phone", "sms", "email", "voice", "ios", "android", "status-page" ], "lastRelease": "2026-09-17", "graded": true, "anchor": { "graded": true, "score": 22.2, "grade": "F", "agentReady": false, "rank": 977, "ranked": true, "rankOf": 986, "categoryRank": 19, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 6, "maintenance": 35, "payments": 30, "reliability": 35, "schema": 4, "security": 13, "transparency": 51 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-10-12" }, "negative": 0, "verdict": "Haven answers by phone call, text, email and app, is free in beta with no card, and publishes a status page with dated incidents. No public page read says which actions need approval, which accounts it connects or how their tokens are kept, and it names no model provider or sub-processor.", "bestFor": "A consumer assistant for one person who wants to phone, text or email it and have it remember them.", "strengths": [ "Free during beta with no card and no usage limits, per the plans page and FAQ (checked 12 October 2026).", "One assistant on phone call, SMS, email, voice, web and mobile app, with a published phone number and email address.", "Statuspage site with eight components, including Phone Calls, SMS Chat and Scheduled Tasks \u0026 Reminders, and four dated incidents since May 2026.", "The data page says memory can be viewed, edited, exported and wiped in the app, with deleted data leaving backups within 30 days.", "The privacy policy names Hello Haven, Inc. with a street address in Park City, Utah, and was last updated on 24 July 2026." ], "weaknesses": [ "No approval setting or list of actions that need confirmation was found on the public pages. The terms say it sends emails, SMS and calls following the user's instructions.", "Connected accounts are described only by type (email, calendar, cloud storage, messaging). No provider names, scopes or token storage statement were found.", "Model providers and sub-processors are listed by category only. The policy says the list is available on request by email.", "No API, MCP server, developer docs, changelog, security.txt or disclosure policy was found. The press release says a developer platform is planned.", "Two voice outages (23 May and 15 August 2026) were caused by billing errors with a provider, per the status page.", "The terms allow the vendor to suspend, modify or terminate the service at any time, and say continued use accepts updated terms." ], "agentNotes": [ "Haven has no documented API or MCP server. An outside agent can reach it only through the owner's channels (call, SMS, email, app).", "Do not assume an approval step before Haven sends mail, texts or calls. None is documented on the public pages.", "Email Haven sends to other people names Hello Haven as sender and says it was sent on the user's behalf, per the terms.", "Chat messages, history, profile context and uploaded files go to third-party AI model providers that the vendor does not name.", "Check status.hellohaven.ai before relying on phone or voice. All four published incidents affected those channels." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 22.2 } ], "editorialScores": { "ergonomics": 6, "maintenance": 35, "payments": 30, "reliability": 35, "schema": 4, "security": 13, "transparency": 37 }, "provenanceScore": 64 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/haven" }, "area": "frameworks", "provenance": { "legalEntity": "Hello Haven, Inc.", "domain": "hellohaven.ai", "domainRegistered": "2024-11-21", "endpointOnVendorDomain": true, "terms": "https://my.hellohaven.ai/terms", "privacy": "https://my.hellohaven.ai/privacy", "statusPage": "https://status.hellohaven.ai/", "changelog": "", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The privacy policy names Hello Haven, Inc. with a street address in Park City, Utah 84098. The terms are governed by Utah law with disputes heard in Salt Lake City.", "my.hellohaven.ai/.well-known/security.txt answered 404 on 12 October 2026. No disclosure policy was found.", "RDAP gives a registration date of 2024-11-21 for hellohaven.ai, registrar GoDaddy.com, LLC, registrant private.", "The app is at app.hellohaven.ai, linked from every page. We did not open it.", "The terms and privacy pages are drawn by script. Our reader received their text and a plain request received an empty page." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/haven.json", "live": { "slug": "haven", "vendorStatus": { "page": "https://status.hellohaven.ai", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-12T18:56:37.37398695Z" }, "updatedAt": "2026-10-12T18:56:37.37398695Z" } }, { "slug": "instinct", "name": "Instinct", "vendor": "Spear Street Technology, Inc.", "vendorUrl": "https://instinct.com", "kind": "platform", "category": "personal-assistants", "summary": "Hosted personal assistant from Spear Street Technology, Inc., trading as Instinct, that a person texts or calls. It acts in connected accounts such as Google Workspace and on websites, including purchases and bookings.", "url": "https://www.anchorterminal.com/tools/instinct", "markdownUrl": "https://www.anchorterminal.com/tools/instinct.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/instinct.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/instinct.json", "license": "Proprietary service under Instinct's Terms of Service, which grant personal use only", "transports": [], "packages": [], "auth": "mixed", "authNotes": "A person signs in at app.instinct.com with a phone number and a one-time passcode sent by text. The terms also allow an account linked to Apple, Facebook or Google. Google Workspace is connected through Google's APIs and can be revoked in settings or by asking the assistant. The owner may also give the assistant usernames and passwords for other sites. No API key, token or other credential for a program was found (https://instinct.com/legal/sms-terms.html; https://instinct.com/terms; https://instinct.com/privacy-policy).", "pricing": "paid", "pricingNotes": "No price is published. The terms say fees may apply to certain functions, are charged in US dollars to a card through a payment processor and are non-refundable. Whether any use is free was not established, and sign-up may put a person on a waiting list (https://instinct.com/terms, section 4; https://instinct.com/legal/sms-terms.html, checked 2026-10-12).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the home page, terms or privacy policy, and no API was found (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory" ], "tags": [ "hosted", "closed-source", "sms", "voice-call", "google-workspace", "computer-use", "waitlist", "no-public-pricing", "no-api", "security-txt", "trains-on-data-by-default" ], "graded": true, "anchor": { "graded": true, "score": 11.4, "grade": "F", "agentReady": false, "rank": 984, "ranked": true, "rankOf": 986, "categoryRank": 20, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 5, "maintenance": 3, "payments": 0, "reliability": 5, "schema": 3, "security": 25, "transparency": 51 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-10-12" }, "negative": 0, "verdict": "The terms and privacy policy are specific about connected accounts, model training and the risks of autonomous actions, and security.txt is valid. No price, documentation, status page, changelog or programmatic interface is published, and customer content trains AI models unless the owner opts out.", "bestFor": "A consumer assistant for one adult who wants errands done by text or phone call, such as bill disputes, gifts, groceries, appointments and travel, and who accepts that it acts and spends as their agent.", "strengths": [ "The privacy policy lists the Google Workspace products accessed and says that data is not used to train or improve AI models", "Training on customer content has an opt-out at app.instinct.com/settings, and material placed in the Vault is excluded from training", "Indexed data from connected services can be deleted at app.instinct.com/workspace, and Google access revoked in settings or by asking the assistant", "security.txt is valid until 18 February 2027 and names a contact address", "The privacy policy states the risks of unintended payments, unintended messages and misleading instructions from third parties" ], "weaknesses": [ "No price is published. The terms say fees may apply to certain functions, are charged in US dollars and are non-refundable", "No documentation, API, MCP server, status page or changelog was found on instinct.com", "Customer content trains the vendor's AI models by default, and content flagged for safety review may be used after an opt-out", "The terms appoint the assistant as the owner's agent to make purchases and accept third-party terms, and leave responsibility for every action with the owner", "The owner may hand over usernames, passwords and card details. Where they are stored is not stated", "The terms forbid bots, scrapers and benchmarking, and limit the service to personal use" ], "agentNotes": [ "Do not plan on calling Instinct from a program. No API, MCP server or key was found, and the terms forbid automation software and benchmarking", "A person signs in at app.instinct.com with a phone number and a one-time code by text, and may wait for a place when the service is at capacity", "Tell the owner to opt out of model training at app.instinct.com/settings before connecting mail or files, since training is on by default", "Disconnecting an account does not delete what was indexed from it. Delete that data at app.instinct.com/workspace", "Treat purchases and bookings as final. The terms say actions may not be reversible and that confirmation controls are not guaranteed" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 11.4 } ], "editorialScores": { "ergonomics": 5, "maintenance": 3, "payments": 0, "reliability": 5, "schema": 3, "security": 25, "transparency": 30 }, "provenanceScore": 72 }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/instinct" }, "area": "frameworks", "provenance": { "legalEntity": "Spear Street Technology, Inc. d/b/a Instinct", "domain": "instinct.com", "domainRegistered": "1997-05-20", "endpointOnVendorDomain": true, "terms": "https://instinct.com/terms", "privacy": "https://instinct.com/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-10-12", "notes": [ "The Terms of Service and Privacy Policy, both last revised 26 August 2026, name Spear Street Technology, Inc. d/b/a Instinct. No postal address is given on the pages read. The terms are governed by California law with San Francisco courts.", "The terms cover the website, its subdomains and the apps, so they govern the assistant itself and are not website-only terms. An Acceptable Use Policy (20 August 2026), SMS/Text Messaging Terms (17 August 2026) and an SMS/Text Messaging Privacy Statement (6 July 2026) supplement them.", "instinct.com/.well-known/security.txt gives Contact support@instinct.com, Expires 2027-02-18 and a Canonical line. It has no Policy line.", "RDAP at Verisign gives a registration date of 1997-05-20 for instinct.com, NameCheap, Inc. as registrar and a last change on 2 September 2026. The domain is older than the product's 2026 legal documents, so its age says little about the vendor.", "No status page and no changelog are linked from the home page, the terms or the privacy policy.", "The sign-in and the web app are at app.instinct.com, on the vendor's domain. The home page gives comms[at]instinct[dot]com as a contact." ], "score": 72 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/instinct.json" } ] }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/categories/personal-assistants", "json": "https://www.anchorterminal.com/categories/personal-assistants.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/categories/personal-assistants.md", "slim": "https://www.anchorterminal.com/categories/personal-assistants.min.md" }, "markdown": "Assistants that work for one person across their own mail, calendar, messages and files, remember them, and act without being asked each time. Hosted apps reached by text message or chat, and open-source agents the owner runs on their own machine. Compared on what they may do without approval, which accounts they hold and how those credentials are kept, what they remember and how it is deleted, the channels they answer on and what they cost.\n\n- Tools ranked: 20 · agent-ready (BB or better): 1 · accept x402: 0 · hosted endpoints: 1 · desk reviews by the panel: 0\n- JSON: https://www.anchorterminal.com/api/v1/tools.json (list) · https://www.anchorterminal.com/api/v1/rankings.json (ranked) · https://www.anchorterminal.com/api/v1/x402.json (payable) · https://www.anchorterminal.com/api/v1/capabilities.json (by capability)\n- Grades run AA, A, BB, B, C, D, E, F · methodology: https://www.anchorterminal.com/benchmark/\n\n- Shortlist and picks by need: https://www.anchorterminal.com/best/personal-assistants/index.md\n- Head-to-head comparisons (190): https://www.anchorterminal.com/compare/personal-assistants/index.md\n- Capabilities in this category: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n- https://letme.dev/assistant.proactive picks the top-graded tool in this list and says how to call it direct; calling through letme comes later (https://www.anchorterminal.com/letme/index.md)\n\n## Ranking\n\n| # | Tool | Vendor | Kind | Category | Grade | Score | Confidence | x402 | Auth | Where | Reviews | Page |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| 161 | ZeroClaw | ZeroClaw Labs | Agent harness | Assistants | BB | 70.2 | medium | no | None | local | none | https://www.anchorterminal.com/tools/zeroclaw.md |\n| 229 | NanoClaw | NanoCo, Inc. | Agent harness | Assistants | B | 68.3 | medium | no | None | local | none | https://www.anchorterminal.com/tools/nanoclaw.md |\n| 244 | Hermes Agent | Nous Research | Agent harness | Assistants | B | 67.9 | medium | no | None | local | none | https://www.anchorterminal.com/tools/hermes-agent.md |\n| 270 | OpenClaw | OpenClaw Foundation | Agent harness | Assistants | B | 67.1 | medium | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/openclaw.md |\n| 288 | IronClaw | NEAR AI | Agent harness | Assistants | B | 66.7 | medium | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/ironclaw.md |\n| 446 | nanobot | HKUDS | Agent harness | Assistants | B | 62.4 | medium | no | None | local | none | https://www.anchorterminal.com/tools/nanobot.md |\n| 454 | QwenPaw | AgentScope | Agent harness | Assistants | B | 62.2 | medium | no | None | local | none | https://www.anchorterminal.com/tools/qwenpaw.md |\n| 584 | AstrBot | AstrBotDevs | Agent harness | Assistants | C | 58.8 | medium | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/astrbot.md |\n| 591 | CowAgent | zhayujie | Agent harness | Assistants | C | 58.5 | medium | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/cowagent.md |\n| 813 | GAIA | The Experience Company | Platform | Assistants | D | 49.5 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/gaia.md |\n| 879 | PicoClaw | Sipeed | Agent harness | Assistants | D | 46.1 | medium | no | None | local | none | https://www.anchorterminal.com/tools/picoclaw.md |\n| 893 | Grok Bot | SpaceXAI and Cursor (Anysphere, Inc.) | Platform | Assistants | E | 45.2 | medium | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/grok-bot.md |\n| 911 | Zo Computer | Zo Computer Company | HTTP API | Assistants | E | 43.1 | medium | no | API key | hosted | none | https://www.anchorterminal.com/tools/zo-computer.md |\n| 934 | Leon | Louis Grenard (Leon AI) | Agent harness | Assistants | E | 41 | medium | no | None | local | none | https://www.anchorterminal.com/tools/leon.md |\n| 955 | Poke | The Interaction Company of California Inc. | Platform | Assistants | F | 37.6 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/poke.md |\n| 968 | Lindy | Crivello Corp (doing business as Lindy) | Platform | Assistants | F | 32.3 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/lindy.md |\n| 973 | Dots | OpenAI | Platform | Assistants | F | 28.3 | low | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/openai-dots.md |\n| 974 | Gemini Spark | Google LLC | Platform | Assistants | F | 24.5 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/gemini-spark.md |\n| 977 | Haven | Hello Haven, Inc. | Platform | Assistants | F | 22.2 | low | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/haven.md |\n| 984 | Instinct | Spear Street Technology, Inc. | Platform | Assistants | F | 11.4 | low | no | OAuth or key | local | none | https://www.anchorterminal.com/tools/instinct.md |\n\nScores are from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/), with Performance and Task success pending. p95 latency and context cost come from our probes, which haven't run yet.\n\n## Summaries\n\n### 161. ZeroClaw, BB (70.2)\n\nOpen-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite. Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.\n\n- Page: https://www.anchorterminal.com/tools/zeroclaw · Markdown: https://www.anchorterminal.com/tools/zeroclaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/zeroclaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client\n\n### 229. NanoClaw, B (68.3)\n\nOpen-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks. Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.\n\n- Page: https://www.anchorterminal.com/tools/nanoclaw · Markdown: https://www.anchorterminal.com/tools/nanoclaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/nanoclaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts\n\n### 244. Hermes Agent, B (67.9)\n\nOpen-source personal agent from Nous Research that the owner runs on a computer or server. It answers on messaging apps, keeps memory between sessions, runs scheduled jobs and connects to accounts, models and MCP servers the owner configures. Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.\n\n- Page: https://www.anchorterminal.com/tools/hermes-agent · Markdown: https://www.anchorterminal.com/tools/hermes-agent.md · JSON: https://www.anchorterminal.com/api/v1/tools/hermes-agent.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 270. OpenClaw, B (67.1)\n\nOpen-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence. Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.\n\n- Page: https://www.anchorterminal.com/tools/openclaw · Markdown: https://www.anchorterminal.com/tools/openclaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/openclaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 288. IronClaw, B (66.7)\n\nIronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory. Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off.\n\n- Page: https://www.anchorterminal.com/tools/ironclaw · Markdown: https://www.anchorterminal.com/tools/ironclaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/ironclaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 446. nanobot, B (62.4)\n\nnanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations. nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.\n\n- Page: https://www.anchorterminal.com/tools/nanobot · Markdown: https://www.anchorterminal.com/tools/nanobot.md · JSON: https://www.anchorterminal.com/api/v1/tools/nanobot.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client\n\n### 454. QwenPaw, B (62.2)\n\nOpen-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files. Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.\n\n- Page: https://www.anchorterminal.com/tools/qwenpaw · Markdown: https://www.anchorterminal.com/tools/qwenpaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/qwenpaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 584. AstrBot, C (58.8)\n\nAstrBot is an open-source chatbot and agent program that the owner runs and connects to messaging platforms such as QQ, Telegram, Slack, Discord, Lark and WeCom, with scheduled tasks, MCP tools, plugins and a web admin panel. Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.\n\n- Page: https://www.anchorterminal.com/tools/astrbot · Markdown: https://www.anchorterminal.com/tools/astrbot.md · JSON: https://www.anchorterminal.com/api/v1/tools/astrbot.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.self-hosted, agent.mcp-client\n\n### 591. CowAgent, C (58.5)\n\nCowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps. MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.\n\n- Page: https://www.anchorterminal.com/tools/cowagent · Markdown: https://www.anchorterminal.com/tools/cowagent.md · JSON: https://www.anchorterminal.com/api/v1/tools/cowagent.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts\n\n### 813. GAIA, D (49.5)\n\nGAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting. GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.\n\n- Page: https://www.anchorterminal.com/tools/gaia · Markdown: https://www.anchorterminal.com/tools/gaia.md · JSON: https://www.anchorterminal.com/api/v1/tools/gaia.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 879. PicoClaw, D (46.1)\n\nPicoClaw is an open-source personal AI assistant from Sipeed, a single Go binary for small Linux boards, desktops and Android, reached through chat apps. Its last commit on the main branch was on 19 August 2026. Self-hosted under the MIT licence, with 19 documented chat channels, scheduled and heartbeat tasks, and local file memory. The repository has had no commit since 19 August 2026 and no release since 3 July, and 15 CVEs are listed against it with no advisory or security policy from the project.\n\n- Page: https://www.anchorterminal.com/tools/picoclaw · Markdown: https://www.anchorterminal.com/tools/picoclaw.md · JSON: https://www.anchorterminal.com/api/v1/tools/picoclaw.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client\n\n### 893. Grok Bot, E (45.2)\n\nHosted assistant from SpaceXAI and Cursor. Named Bots work on a persistent cloud computer with a browser, files and terminal, reached from desktop and mobile apps, Slack and X, with routines that run on a schedule. Connector tokens stay on Cursor's backend and each user gets a separate microVM, with approvals, drafts and a review model before risky actions. All of a user's Bots share one computer and its sign-ins, the review model skips memory writes, and the status page shows seven major Grok Bot incidents since 3 September 2026.\n\n- Page: https://www.anchorterminal.com/tools/grok-bot · Markdown: https://www.anchorterminal.com/tools/grok-bot.md · JSON: https://www.anchorterminal.com/api/v1/tools/grok-bot.json\n- Capabilities: assistant.proactive, assistant.accounts, assistant.memory, assistant.messaging, agent.mcp-client\n\n### 911. Zo Computer, E (43.1)\n\nHosted personal assistant from Zo Computer Company that runs on a cloud Linux computer assigned to each user. It answers by web chat, SMS, email, Slack, Discord and Telegram, runs scheduled automations, and has an HTTP API and MCP endpoint. Zo publishes an OpenAPI file, Markdown docs, plan prices and a named list of the providers that receive user content. One access token grants full access to the workspace, no approval step before sending or buying was found in the reviewed docs, and no status page, rate limit or SLA is published.\n\n- Page: https://www.anchorterminal.com/tools/zo-computer · Markdown: https://www.anchorterminal.com/tools/zo-computer.md · JSON: https://www.anchorterminal.com/api/v1/tools/zo-computer.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, agent.mcp-client · endpoint: `https://api.zo.computer/mcp`\n\n### 934. Leon, E (41)\n\nOpen-source personal assistant by Louis Grenard that the owner runs on their own machine or server. The 2.0 Developer Preview adds an agent loop with tools, layered memory, computer use and a proactive pulse, reached through a web app. Connected-app credentials are encrypted per profile and the Gmail connection is read-only. The 2.0 Developer Preview has no tagged release, runs tools and a 30-minute proactive pulse with no approval step, listens on every network interface with client authentication off, and sends telemetry by default.\n\n- Page: https://www.anchorterminal.com/tools/leon · Markdown: https://www.anchorterminal.com/tools/leon.md · JSON: https://www.anchorterminal.com/api/v1/tools/leon.json\n- Capabilities: assistant.proactive, assistant.self-hosted, assistant.memory, assistant.accounts\n\n### 955. Poke, F (37.6)\n\nHosted personal assistant from The Interaction Company of California, reached by text on Apple Messages, WhatsApp, Telegram and RCS. It works across the owner's Gmail or Outlook mail, calendar, contacts and connected apps. Hosted assistant that answers in Apple Messages, WhatsApp, Telegram and RCS and acts in Gmail, Outlook, calendars and MCP servers. Plan prices and a status page are public. No approval settings, credential storage, model providers or retention periods are documented, and customer content trains models unless Maximum Privacy is selected.\n\n- Page: https://www.anchorterminal.com/tools/poke · Markdown: https://www.anchorterminal.com/tools/poke.md · JSON: https://www.anchorterminal.com/api/v1/tools/poke.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, agent.mcp-client\n\n### 968. Lindy, F (32.3)\n\nLindy is a hosted AI assistant from Crivello Corp. Each user has a private assistant for mail, calendar and meetings, reached by Slack, iMessage, SMS, email or the web app, and a team shares a second one in Slack channels. Lindy keeps what it remembers in files the owner can read and edit, and publishes credit prices. Its approval setting applies in shared Slack threads only, so writes asked for by direct message, text or web chat run unasked, which its pricing page does not say. It has no status page, and its changelog stops in October 2025.\n\n- Page: https://www.anchorterminal.com/tools/lindy · Markdown: https://www.anchorterminal.com/tools/lindy.md · JSON: https://www.anchorterminal.com/api/v1/tools/lindy.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, agent.mcp-client\n\n### 973. Dots, F (28.3)\n\nDots is OpenAI's always-on agent inside ChatGPT, in beta. Each dot has a cloud computer and browser, keeps notes, works between conversations across connected apps, and answers in ChatGPT, by voice call, Slack and Teams. Actions that affect accounts or share information pass an automatic review, and custom rules can require approval or a hand-off. Dots is a beta on Pro plans from $100 a month, and no status page, terms, privacy policy or way to delete individual saved notes was found in the pages we could read.\n\n- Page: https://www.anchorterminal.com/tools/openai-dots · Markdown: https://www.anchorterminal.com/tools/openai-dots.md · JSON: https://www.anchorterminal.com/api/v1/tools/openai-dots.json\n- Capabilities: assistant.proactive, assistant.accounts, assistant.memory, assistant.messaging\n\n### 974. Gemini Spark, F (24.5)\n\nGemini Spark is Google's hosted personal AI agent inside the Gemini app. It runs tasks and schedules in Google's cloud across Gmail, Calendar, Drive and other connected apps for Google AI Pro and Ultra subscribers. Google's help pages state what Spark confirms before doing, how to delete its remote browser and code data, and the risks of prompt injection. Spark has no public API, Google calls it experimental, and it runs only with Keep Activity on, the setting under which chats are used for model training and human review.\n\n- Page: https://www.anchorterminal.com/tools/gemini-spark · Markdown: https://www.anchorterminal.com/tools/gemini-spark.md · JSON: https://www.anchorterminal.com/api/v1/tools/gemini-spark.json\n- Capabilities: assistant.proactive, assistant.accounts, assistant.memory, agent.mcp-client\n\n### 977. Haven, F (22.2)\n\nHosted personal AI assistant from Hello Haven, Inc. that a person reaches by phone call, text message, email, web or mobile app. It keeps a memory of the user and carries out tasks for them. In beta. Haven answers by phone call, text, email and app, is free in beta with no card, and publishes a status page with dated incidents. No public page read says which actions need approval, which accounts it connects or how their tokens are kept, and it names no model provider or sub-processor.\n\n- Page: https://www.anchorterminal.com/tools/haven · Markdown: https://www.anchorterminal.com/tools/haven.md · JSON: https://www.anchorterminal.com/api/v1/tools/haven.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory\n\n### 984. Instinct, F (11.4)\n\nHosted personal assistant from Spear Street Technology, Inc., trading as Instinct, that a person texts or calls. It acts in connected accounts such as Google Workspace and on websites, including purchases and bookings. The terms and privacy policy are specific about connected accounts, model training and the risks of autonomous actions, and security.txt is valid. No price, documentation, status page, changelog or programmatic interface is published, and customer content trains AI models unless the owner opts out.\n\n- Page: https://www.anchorterminal.com/tools/instinct · Markdown: https://www.anchorterminal.com/tools/instinct.md · JSON: https://www.anchorterminal.com/api/v1/tools/instinct.json\n- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory\n\n## How we test this category\n\nIn this run, public evidence against the published checklist, with hosted assistants read as hosted services and self-hosted ones as software the owner runs. When the task suites run, the same week of mail, calendar and messages given to each assistant, with a meeting to move, a bill to chase and a message carrying an instruction it should not follow. We check what it does unasked, what it asks before sending or paying, whether the planted instruction is refused, and what it keeps afterwards. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.\n\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Personal assistants", "url": "" } ], "description": "20 personal assistants ranked by the Anchor benchmark. Leader ZeroClaw (BB). Assistants that work for one person across their own mail, calendar, messages and files, remember them, and act without being asked each time. Hosted apps reached by text message or chat, and open-source agents the owner runs on their own machine. Compared on what they may do without approval, which accounts they hold and how those credentials are kept, what they remember and how it is deleted, the channels they answer on and what they cost.", "facts": [ "ZeroClaw BB", "NanoClaw B", "Hermes Agent B" ], "h1": "AI personal assistants that act for one person", "image": "https://www.anchorterminal.com/assets/og/categories-personal-assistants.png", "path": "/categories/personal-assistants", "published": "", "section": "tools", "title": "AI personal assistants that act for one person, ranked", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/categories/personal-assistants" }, "tokens": { "markdown": 6000, "slim": 780 }, "version": 1 }