Atticus vs ZeroClaw

Atticus

Atticus runs a person's Mac by voice on their existing Claude or Devin plan, with a sandboxed safe mode and a local log of every command. It has no API, MCP server or documented command for another agent, it is five days old, and it rebuilds itself from the main branch every six hours by default.

ZeroClaw

Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

Atticus

1. Don't plan to call Atticus from another agent. It takes requests only from its own shortcut and typing box
2. If a user runs Atticus beside you, expect it to move windows and type into apps on the same Mac
3. Point a user who wants pinned versions to Settings > About & Updates to turn off self-update

ZeroClaw

1. Keep [risk_profiles.<alias>] level = "supervised". full runs every tool not listed in always_ask, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as send_via, google_workspace and http_request to always_ask so a session-level Always grant cannot skip the prompt
3. List senders in [peer_groups.<name>] external_peers. ["*"] accepts anyone on that channel
4. Set [web_fetch].allowed_domains and [http_request].allowed_domains. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with zeroclaw agent -a <alias> -m "<task>". A cron or webhook turn has no prompt, so shell calls fall to the command policy