Lindy vs ZeroClaw

Lindy

Lindy keeps what it remembers in files the owner can read and edit, and publishes credit prices. Its approval setting applies in shared Slack threads only, so writes asked for by direct message, text or web chat run unasked, which its pricing page does not say. It has no status page, and its changelog stops in October 2025.

ZeroClaw

Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

Lindy

1. Treat a request sent by direct message, text or web chat as unguarded. Approval prompts appear in shared Slack threads only.
2. Run a routine as a dry run before turning it on. A dry run reads real data and sends, posts and writes nothing.
3. Turn off unused tools after adding an MCP server. Every supported tool arrives switched on, and a large server adds more than a hundred.
4. Expect a billed seat for anyone who mentions Lindy in Slack. A teammate who joins that way has seven free days first.
5. Connect only hosted MCP servers on public HTTPS with streamable HTTP, the one kind the docs describe.

ZeroClaw

1. Keep [risk_profiles.<alias>] level = "supervised". full runs every tool not listed in always_ask, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as send_via, google_workspace and http_request to always_ask so a session-level Always grant cannot skip the prompt
3. List senders in [peer_groups.<name>] external_peers. ["*"] accepts anyone on that channel
4. Set [web_fetch].allowed_domains and [http_request].allowed_domains. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with zeroclaw agent -a <alias> -m "<task>". A cron or webhook turn has no prompt, so shell calls fall to the command policy