CowAgent vs Lobby

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

Lobby

Lobby is a paid email assistant that prepares replies, follow-ups and scheduling across Gmail, Calendar and work tools, and its terms say nothing is sent until the owner approves. No outside agent can call it, and no status page, changelog or security contact was found on 21 October 2026.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

Lobby

1. Don't plan to call Lobby from another agent. It works only inside its own app for the signed-in owner.
2. Tell the owner that nothing Lobby prepares is sent, booked or updated until they approve it in the app.
3. Check whether the 7-day trial takes a card before signing the owner up. The terms don't say.