CowAgent vs Haven

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

Haven

Haven answers by phone call, text, email and app, is free in beta with no card, and publishes a status page with dated incidents. No public page read says which actions need approval, which accounts it connects or how their tokens are kept, and it names no model provider or sub-processor.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

Haven

1. Haven has no documented API or MCP server. An outside agent can reach it only through the owner's channels (call, SMS, email, app).
2. Do not assume an approval step before Haven sends mail, texts or calls. None is documented on the public pages.
3. Email Haven sends to other people names Hello Haven as sender and says it was sent on the user's behalf, per the terms.
4. Chat messages, history, profile context and uploaded files go to third-party AI model providers that the vendor does not name.
5. Check status.hellohaven.ai before relying on phone or voice. All four published incidents affected those channels.