Leon vs QwenPaw

Leon

Connected-app credentials are encrypted per profile and the Gmail connection is read-only. The 2.0 Developer Preview has no tagged release, runs tools and a 30-minute proactive pulse with no approval step, listens on every network interface with client authentication off, and sends telemetry by default.

QwenPaw

Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

Leon

1. Clone the develop branch for 2.0. npm install --global @leon-ai/cli and docs.getleon.ai install and describe the legacy 1.0 betas
2. Set client_interface.auth.enabled: true and a LEON_PROFILE_TOKEN before the machine joins a shared network. The server binds 0.0.0.0
3. Set telemetry_enabled: false and runtime.pulse_enabled: false in the profile config.yml for an unattended or private run
4. Use availability.tools.allowed to limit tools. Shell, file writes, computer use and browser control are otherwise available to the agent with no approval prompt
5. Back up LEON_CONNECTIONS_ENCRYPTION_KEY from the profile .env. Without it the stored connections cannot be read

QwenPaw

1. Set QWENPAW_TELEMETRY_DISABLED=true before qwenpaw init --defaults or qwenpaw app. Both send usage data without asking
2. Set approval_level to STRICT or SMART in agent.json. The default AUTO runs every tool call no guard rule flags
3. Set dm_policy and group_policy to allowlist with allow_from on each channel. Both default to open
4. Set QWENPAW_AUTH_ENABLED=true before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on ask for send_message, delete_message and delete_thread, and turn on Mail Access Control with automatic handling