LearnHarness vs OpenClaw

LearnHarness

The in-app agent reads files but cannot change them or run commands, and a bundled skill gives other agents a documented read-only view of sessions and the knowledge graph. The project is 14 days old at 0.4.0, its file reads reach the whole home directory without approval, and it has no security policy.

OpenClaw

Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

LearnHarness

1. Use the bundled skill (skills/learnharness/SKILL.md) to read a learner's record. It needs Python 3.10 or later and writes nothing
2. Pass --format json before the subcommand, for example python3 -B scripts/graph.py --format json propositions
3. Treat stored answer keys and teacher prose as model-authored. A proposition in the graph is not evidence the learner understood it
4. Do not read auth.json, which sits one folder above the data folder and holds provider keys in plain text
5. Close the app or re-read when a stable snapshot matters. The readers do not lock files while the app writes

OpenClaw

1. Set a session permission mode of guarded or workspace, or tools.exec.mode, before connecting mail. The default runs host commands without approval
2. Turn on agents.defaults.sandbox for any agent that reads mail, web pages or attachments. Sandboxing is off by default
3. Set tools.message.crossContext.allowAcrossProviders and allowWithinProvider to false to confine sends to the current conversation
4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny gateway, cron, sessions_spawn and sessions_send for it
5. Run openclaw security audit after setup, and treat the Gateway token as an owner credential. POST /tools/invoke accepts it with full operator access