Leon vs ZeroClaw

Leon

Connected-app credentials are encrypted per profile and the Gmail connection is read-only. The 2.0 Developer Preview has no tagged release, runs tools and a 30-minute proactive pulse with no approval step, listens on every network interface with client authentication off, and sends telemetry by default.

ZeroClaw

Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

Leon

1. Clone the develop branch for 2.0. npm install --global @leon-ai/cli and docs.getleon.ai install and describe the legacy 1.0 betas
2. Set client_interface.auth.enabled: true and a LEON_PROFILE_TOKEN before the machine joins a shared network. The server binds 0.0.0.0
3. Set telemetry_enabled: false and runtime.pulse_enabled: false in the profile config.yml for an unattended or private run
4. Use availability.tools.allowed to limit tools. Shell, file writes, computer use and browser control are otherwise available to the agent with no approval prompt
5. Back up LEON_CONNECTIONS_ENCRYPTION_KEY from the profile .env. Without it the stored connections cannot be read

ZeroClaw

1. Keep [risk_profiles.<alias>] level = "supervised". full runs every tool not listed in always_ask, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as send_via, google_workspace and http_request to always_ask so a session-level Always grant cannot skip the prompt
3. List senders in [peer_groups.<name>] external_peers. ["*"] accepts anyone on that channel
4. Set [web_fetch].allowed_domains and [http_request].allowed_domains. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with zeroclaw agent -a <alias> -m "<task>". A cron or webhook turn has no prompt, so shell calls fall to the command policy