AstrBot vs QwenPaw

AstrBot

Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.

QwenPaw

Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

AstrBot

1. Set ASTRBOT_DISABLE_METRICS=1 before the first start. Statistics, including the hostname, are sent to tickstats.soulter.top by default
2. Set dashboard.host to 127.0.0.1 in data/cmd_config.json, or the DASHBOARD_HOST variable, unless remote access is intended. The default is 0.0.0.0
3. Create an abk_ key in Settings, OpenAPI with only the scopes needed, and send it as Authorization: Bearer or X-API-Key
4. Include username in every POST /api/v1/chat body. Without the chat:admin scope an administrator ID is rejected
5. Check Extensions, Future Tasks after asking for a schedule. One-off tasks are deleted after their run even when the run fails

QwenPaw

1. Set QWENPAW_TELEMETRY_DISABLED=true before qwenpaw init --defaults or qwenpaw app. Both send usage data without asking
2. Set approval_level to STRICT or SMART in agent.json. The default AUTO runs every tool call no guard rule flags
3. Set dm_policy and group_policy to allowlist with allow_from on each channel. Both default to open
4. Set QWENPAW_AUTH_ENABLED=true before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on ask for send_message, delete_message and delete_thread, and turn on Mail Access Control with automatic handling