{ "data": { "a": { "slug": "nanobot", "name": "nanobot", "vendor": "HKUDS", "vendorUrl": "https://nanobot.wiki", "kind": "harness", "category": "personal-assistants", "summary": "nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.", "url": "https://www.anchorterminal.com/tools/nanobot", "markdownUrl": "https://www.anchorterminal.com/tools/nanobot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanobot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanobot.json", "repo": "https://github.com/HKUDS/nanobot", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "nanobot-ai" } ], "auth": "none", "authNotes": "No account with the project. The owner supplies model provider keys or an OAuth sign-in, and bot tokens or mailbox passwords for each channel, in `~/.nanobot/config.json`. The WebUI on localhost needs no password, and binding to all interfaces requires a token.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays the model provider, or nothing with a local model. The optional Render deployment needs a paid Render service.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 49000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://nanobot.wiki/docs/latest/getting-started/nanobot-overview", "llmsTxt": "https://nanobot.wiki/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "mit", "llms-txt", "docker", "alpha" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 446, "ranked": true, "rankOf": 986, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 48 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -6, "negativeNotes": [ "2026-09-02. GHSA-vc5v-6vwm-wf9m (critical, 9.3, no CVE). Web fetch did not block internal addresses, so cloud metadata and internal services could be read without authentication in versions before 0.3.0. Fixed in 0.3.0 of 25 July and published, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m", "2026-03-27. GHSA-4gmr-2vc8-7qh3 (CVE-2026-33654, high). A spoofed email could inject instructions through email polling with no user action, up to command execution, in 0.1.4.post5 and earlier. Fixed in 0.1.4.post6 and published, more than six months ago, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "2026-03-11. GHSA-g6cf-xjwr-pm77 (CVE-2026-31977, critical, 9.0). A sender ID containing `|` passed the `allowFrom` check in versions before 0.1.4.post4. Fixed and published, more than six months ago, -1. https://github.com/HKUDS/nanobot/security/advisories/GHSA-g6cf-xjwr-pm77", "2026-04-14 and 2026-05-24. GHSA-v5j3-4q66-58cf (CVE-2026-35589, high, 8.0), cross-site WebSocket hijacking of the WhatsApp bridge, fixed in 0.1.5, and GHSA-3f63-vcp3-hvqr (CVE-2026-48716, high, 8.7), file write through a WhatsApp document name. Both fixed and published, -1 together. https://github.com/HKUDS/nanobot/security/advisories" ], "verdict": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5", "Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back", "Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves", "Email requires SPF and DKIM results from a named receiving service since v0.3.5, and mailbox access stays off until `consentGranted` is set", "Optional `bwrap` (Linux) and `seatbelt` (macOS) sandboxes for shell commands, and an SSRF guard on web fetches and HTTP MCP connections" ], "weaknesses": [ "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none", "Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch", "SECURITY.md lists plain-text API keys in `config.json`, no rate limiting and limited security event logging as known limitations", "Version 0.3.5 with an Alpha classifier, 214 open issues and 614 open pull requests on 12 October 2026" ], "agentNotes": [ "Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default", "Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)", "Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing", "Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text", "Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 69 }, "provenanceScore": 27 }, "connect": { "install": "python -m pip install nanobot-ai # or: uv tool install nanobot-ai # then: nanobot webui", "headless": { "command": "nanobot -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanobot" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "nanobot.wiki", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/HKUDS/nanobot/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No legal entity is named. The repository belongs to the GitHub organisation HKUDS, which a published advisory title calls the Hong Kong University Data Intelligence Lab. pyproject.toml names Xubin Ren and the nanobot contributors as authors.", "nanobot.wiki has no terms or privacy page linked from its home page or llms.txt, and `/.well-known/security.txt` answered with the site's not-found page on 12 October 2026.", "SECURITY.md in the repository asks for reports through a private GitHub advisory or by email and aims to respond within 48 hours.", "There is no hosted endpoint. A gateway answers on its owner's own host." ], "score": 27 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanobot.json" }, "answer": "NanoClaw scores 68.3 (B) on agent readiness against nanobot's 62.4 (B), and leads in 4 of 7 scored categories.", "b": { "slug": "nanoclaw", "name": "NanoClaw", "vendor": "NanoCo, Inc.", "vendorUrl": "https://nanoclaw.dev", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.", "url": "https://www.anchorterminal.com/tools/nanoclaw", "markdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanoclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanoclaw.json", "repo": "https://github.com/nanocoai/nanoclaw", "license": "MIT", "transports": [], "packages": [], "auth": "none", "authNotes": "No account is needed to run it. Owners and admins are rows in a local `user_roles` table, and strangers are handled by each chat's `unknown_sender_policy` (https://docs.nanoclaw.dev/concepts/security). Model and service credentials are registered with a credential gateway on the host, OneCLI Agent Vault by default, which adds them to outbound HTTPS requests. Containers receive placeholders such as `onecli-managed` (https://docs.nanoclaw.dev/operate/credentials). Channel tokens stay in the host's `.env`. An optional free NanoClaw account, used for a prebuilt agent image and a managed Slack app, keeps its token in `~/.config/nanoclaw/account.json` with mode 0600 (https://github.com/nanocoai/nanoclaw/blob/main/README.md).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing on sale. The optional NanoClaw account, the Echo image and the managed Slack app are free of charge per the terms of 31 July 2026 (https://nanoclaw.dev/terms). The owner pays the model provider through a Claude subscription, an API key or another provider, and any service a channel or tool uses, such as Dial. Since 2.4.0 Claude groups default to Opus 5.5 (checked 2026-10-12).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 30929, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.nanoclaw.dev", "llmsTxt": "https://docs.nanoclaw.dev/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "tags": [ "open-source", "local", "free", "no-card", "docker", "llms-txt" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 68.3, "grade": "B", "agentReady": false, "rank": 229, "ranked": true, "rankOf": 986, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -5, "negativeNotes": [ "2026-10-09. Release 2026.10.0 fixed four symlink flaws through which a manipulated agent could make the host read, write or delete files outside its folders, plus an admin-command bypass, a cross-group read through `ncl` and a command injection in Mattermost setup. Fixed and described in the changelog within the week, but the advisories it links (GHSA-frvf-5rf5-89fq and seven others) were not public on 12 October 2026. -5. https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md" ], "verdict": "Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.", "bestFor": "A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.", "strengths": [ "Each session runs in a non-root Docker container with all capabilities dropped, and the project root and `.env` are never mounted", "API keys sit in a credential gateway on the host, which adds them to outbound requests, so the container holds only placeholders", "Installing packages, adding an MCP server and admitting a new chat each wait for an admin's approval, and no reachable approver means denial", "Memory is plain Markdown under `groups/\u003cfolder\u003e/memory/`, which the owner can read, edit or delete on the host", "The security page states what the design does not stop, including messages to wired chats and spending through granted credentials" ], "weaknesses": [ "The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt", "Egress lockdown is off by default, so a container can reach the internet directly unless `NANOCLAW_EGRESS_LOCKDOWN=true` is set", "The 2026.10.0 changelog links eight advisories on the repository, and on 12 October 2026 the advisories page listed none and one linked advisory returned 404", "Setup sends events to PostHog unless `NANOCLAW_NO_DIAGNOSTICS=1` is set, and the privacy policy does not mention them", "The docs say trunk has no Gmail or Google Calendar integration, while the GitHub repository description still names Gmail", "294 open issues and 750 open pull requests on 12 October 2026, and 10 of the 12 newest open issues had no reply" ], "agentNotes": [ "Install with `git clone` and `bash nanoclaw.sh`. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential", "Set `NANOCLAW_EGRESS_LOCKDOWN=true` before giving an agent credentials or an audience of strangers. The default leaves egress open", "Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree", "Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured", "On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.3 } ], "editorialScores": { "ergonomics": 70, "maintenance": 78, "payments": 60, "reliability": 78, "schema": 82, "security": 74, "transparency": 77 }, "provenanceScore": 53 }, "connect": { "install": "git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2 \u0026\u0026 cd nanoclaw-v2 \u0026\u0026 bash nanoclaw.sh" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanoclaw" }, "area": "frameworks", "provenance": { "legalEntity": "NanoCo, Inc.", "domain": "nanoclaw.dev", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/nanocoai/nanoclaw/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The terms and privacy policy at nanoclaw.dev name NanoCo, Inc. and Delaware law. Both say they cover the website and the optional account, not the software, so neither is linked and the MIT licence stands in.", "nanoclaw.dev/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md points to GitHub private vulnerability reporting.", "There is no hosted endpoint. The assistant runs on the owner's machine, and the optional account service is at portal.nanoclaw.dev, which we did not open.", "The registration date of nanoclaw.dev was not checked." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanoclaw.json" }, "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "HKUDS", "b": "NanoCo, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-15", "b": "2026-10-09", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "", "b": "", "name": "Customer content may train models" }, { "a": "", "b": "", "name": "Terms restrict automated access" }, { "a": "", "b": "", "name": "Terms restrict benchmarking" }, { "a": "", "b": "", "name": "Terms or service can change without notice" }, { "a": "", "b": "", "name": "Arbitration or class-action waiver" }, { "a": "49k stars", "b": "31k stars", "name": "Popularity" } ], "faq": [ { "answer": "NanoClaw scores 68.3 (B) on agent readiness against nanobot's 62.4 (B), and leads in 4 of 7 scored categories.", "question": "Which is better for AI agents, nanobot or NanoClaw?" }, { "answer": "Yes. nanobot is open source (MIT). NanoClaw is open source (MIT).", "question": "Are nanobot and NanoClaw open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "slug": "nanobot", "watchFor": "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking" }, { "aheadOn": [ "Reliability, 78 against 70", "Schema \u0026 documentation, 82 against 77", "Security \u0026 auth, 74 against 63", "Transparency \u0026 trust, 65 against 48" ], "also": [ "Free to start without a card" ], "goodFor": "A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.", "slug": "nanoclaw", "watchFor": "The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt" } ], "job": { "capability": "assistant.proactive", "name": "Assistant proactive" }, "others": [ { "json": "https://www.anchorterminal.com/compare/astrbot-vs-nanobot.json", "title": "AstrBot vs nanobot", "url": "https://www.anchorterminal.com/compare/astrbot-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/astrbot-vs-nanoclaw.json", "title": "AstrBot vs NanoClaw", "url": "https://www.anchorterminal.com/compare/astrbot-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/cowagent-vs-nanobot.json", "title": "CowAgent vs nanobot", "url": "https://www.anchorterminal.com/compare/cowagent-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/cowagent-vs-nanoclaw.json", "title": "CowAgent vs NanoClaw", "url": "https://www.anchorterminal.com/compare/cowagent-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/gaia-vs-nanobot.json", "title": "GAIA vs nanobot", "url": "https://www.anchorterminal.com/compare/gaia-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/gaia-vs-nanoclaw.json", "title": "GAIA vs NanoClaw", "url": "https://www.anchorterminal.com/compare/gaia-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot.json", "title": "Gemini Spark vs nanobot", "url": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanoclaw.json", "title": "Gemini Spark vs NanoClaw", "url": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/grok-bot-vs-nanobot.json", "title": "Grok Bot vs nanobot", "url": "https://www.anchorterminal.com/compare/grok-bot-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/grok-bot-vs-nanoclaw.json", "title": "Grok Bot vs NanoClaw", "url": "https://www.anchorterminal.com/compare/grok-bot-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/haven-vs-nanobot.json", "title": "Haven vs nanobot", "url": "https://www.anchorterminal.com/compare/haven-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/haven-vs-nanoclaw.json", "title": "Haven vs NanoClaw", "url": "https://www.anchorterminal.com/compare/haven-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot.json", "title": "Hermes Agent vs nanobot", "url": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanoclaw.json", "title": "Hermes Agent vs NanoClaw", "url": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/instinct-vs-nanobot.json", "title": "Instinct vs nanobot", "url": "https://www.anchorterminal.com/compare/instinct-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/instinct-vs-nanoclaw.json", "title": "Instinct vs NanoClaw", "url": "https://www.anchorterminal.com/compare/instinct-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/ironclaw-vs-nanobot.json", "title": "IronClaw vs nanobot", "url": "https://www.anchorterminal.com/compare/ironclaw-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/ironclaw-vs-nanoclaw.json", "title": "IronClaw vs NanoClaw", "url": "https://www.anchorterminal.com/compare/ironclaw-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/leon-vs-nanobot.json", "title": "Leon vs nanobot", "url": "https://www.anchorterminal.com/compare/leon-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/leon-vs-nanoclaw.json", "title": "Leon vs NanoClaw", "url": "https://www.anchorterminal.com/compare/leon-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/lindy-vs-nanobot.json", "title": "Lindy vs nanobot", "url": "https://www.anchorterminal.com/compare/lindy-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/lindy-vs-nanoclaw.json", "title": "Lindy vs NanoClaw", "url": "https://www.anchorterminal.com/compare/lindy-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-openai-dots.json", "title": "nanobot vs Dots", "url": "https://www.anchorterminal.com/compare/nanobot-vs-openai-dots" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-openclaw.json", "title": "nanobot vs OpenClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-openclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-picoclaw.json", "title": "nanobot vs PicoClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-picoclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-poke.json", "title": "nanobot vs Poke", "url": "https://www.anchorterminal.com/compare/nanobot-vs-poke" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw.json", "title": "nanobot vs QwenPaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw.json", "title": "nanobot vs ZeroClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-zo-computer.json", "title": "nanobot vs Zo Computer", "url": "https://www.anchorterminal.com/compare/nanobot-vs-zo-computer" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-openai-dots.json", "title": "NanoClaw vs Dots", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-openai-dots" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-openclaw.json", "title": "NanoClaw vs OpenClaw", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-openclaw" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-picoclaw.json", "title": "NanoClaw vs PicoClaw", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-picoclaw" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-poke.json", "title": "NanoClaw vs Poke", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-poke" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-qwenpaw.json", "title": "NanoClaw vs QwenPaw", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-qwenpaw" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-zeroclaw.json", "title": "NanoClaw vs ZeroClaw", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-zeroclaw" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-zo-computer.json", "title": "NanoClaw vs Zo Computer", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-zo-computer" } ], "scores": [ { "by": 8, "edge": "nanoclaw", "key": "reliability", "name": "Reliability", "nanobot": 70, "nanoclaw": 78, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 5, "edge": "nanoclaw", "key": "schema", "name": "Schema \u0026 documentation", "nanobot": 77, "nanoclaw": 82, "weight": 13 }, { "by": 4, "edge": "nanobot", "key": "ergonomics", "name": "Agent ergonomics", "nanobot": 74, "nanoclaw": 70, "weight": 13 }, { "by": 11, "edge": "nanoclaw", "key": "security", "name": "Security \u0026 auth", "nanobot": 63, "nanoclaw": 74, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "nanobot": 60, "nanoclaw": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 4, "edge": "nanobot", "key": "maintenance", "name": "Maintenance \u0026 community", "nanobot": 82, "nanoclaw": 78, "weight": 7 }, { "by": 17, "edge": "nanoclaw", "key": "transparency", "name": "Transparency \u0026 trust", "nanobot": 48, "nanoclaw": 65, "weight": 7 } ], "summary": "NanoClaw scores 68.3 (B) on agent readiness against nanobot's 62.4 (B), and leads in 4 of 7 scored categories. Both do assistant proactive.", "verdicts": { "nanobot": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "nanoclaw": "Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw", "json": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.md", "slim": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.min.md" }, "markdown": "NanoClaw scores 68.3 (B) on agent readiness against nanobot's 62.4 (B), and leads in 4 of 7 scored categories. Both do assistant proactive.\n\n- nanobot: grade B, 62.4/100, rank #446 of 986. Markdown https://www.anchorterminal.com/tools/nanobot.md · JSON https://www.anchorterminal.com/api/v1/tools/nanobot.json\n- NanoClaw: grade B, 68.3/100, rank #229 of 986. Markdown https://www.anchorterminal.com/tools/nanoclaw.md · JSON https://www.anchorterminal.com/api/v1/tools/nanoclaw.json\n- Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 190 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Which one, for what\n\n### nanobot (B)\n\nGood for: A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.\n\nWatch for: No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking\n\n### NanoClaw (B)\n\nGood for: A technical owner who wants an assistant on their own machine, reachable from chat apps, with container isolation and scheduled tasks, and who is willing to keep a fork.\n\nAhead on:\n- Reliability, 78 against 70\n- Schema \u0026 documentation, 82 against 77\n- Security \u0026 auth, 74 against 63\n- Transparency \u0026 trust, 65 against 48\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: The Claude provider runs with `permissionMode: 'bypassPermissions'`, so shell, file and web tools run inside the container with no prompt\n\n\n## Score by category\n\n| Category | Weight | nanobot | NanoClaw | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 70 | 78 | NanoClaw +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 82 | NanoClaw +5 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 70 | nanobot +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 74 | NanoClaw +11 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 82 | 78 | nanobot +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 48 | 65 | NanoClaw +17 |\n| Negative events | ≤15 | -6 | -5 | |\n| **Total** | | **62.4 · B** | **68.3 · B** | |\n\n## Facts side by side\n\n| Fact | nanobot | NanoClaw |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | HKUDS | NanoCo, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | MIT |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-15 | 2026-10-09 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | | |\n| Terms restrict automated access | | |\n| Terms restrict benchmarking | | |\n| Terms or service can change without notice | | |\n| Arbitration or class-action waiver | | |\n| Popularity | 49k stars | 31k stars |\n\n## Verdicts\n\n**nanobot.** nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.\n\n**NanoClaw.** Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.\n\n## Before you call either\n\n### nanobot\n\n1. Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default\n2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)\n3. Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing\n4. Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text\n5. Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat\n\n### NanoClaw\n\n1. Install with `git clone` and `bash nanoclaw.sh`. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential\n2. Set `NANOCLAW_EGRESS_LOCKDOWN=true` before giving an agent credentials or an audience of strangers. The default leaves egress open\n3. Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree\n4. Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured\n5. On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done\n\n## Questions\n\n### Which is better for AI agents, nanobot or NanoClaw?\n\nNanoClaw scores 68.3 (B) on agent readiness against nanobot's 62.4 (B), and leads in 4 of 7 scored categories.\n\n### Are nanobot and NanoClaw open source?\n\nYes. nanobot is open source (MIT). NanoClaw is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.json, and with the fewest tokens: https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"nanobot\", \"b\": \"nanoclaw\"}`. From a terminal: `anchor compare nanobot nanoclaw`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/nanobot.json and https://www.anchorterminal.com/api/v1/tools/nanoclaw.json\n\n## Other comparisons with nanobot or NanoClaw\n\n- [AstrBot vs nanobot](https://www.anchorterminal.com/compare/astrbot-vs-nanobot.md)\n- [AstrBot vs NanoClaw](https://www.anchorterminal.com/compare/astrbot-vs-nanoclaw.md)\n- [CowAgent vs nanobot](https://www.anchorterminal.com/compare/cowagent-vs-nanobot.md)\n- [CowAgent vs NanoClaw](https://www.anchorterminal.com/compare/cowagent-vs-nanoclaw.md)\n- [GAIA vs nanobot](https://www.anchorterminal.com/compare/gaia-vs-nanobot.md)\n- [GAIA vs NanoClaw](https://www.anchorterminal.com/compare/gaia-vs-nanoclaw.md)\n- [Gemini Spark vs nanobot](https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot.md)\n- [Gemini Spark vs NanoClaw](https://www.anchorterminal.com/compare/gemini-spark-vs-nanoclaw.md)\n- [Grok Bot vs nanobot](https://www.anchorterminal.com/compare/grok-bot-vs-nanobot.md)\n- [Grok Bot vs NanoClaw](https://www.anchorterminal.com/compare/grok-bot-vs-nanoclaw.md)\n- [Haven vs nanobot](https://www.anchorterminal.com/compare/haven-vs-nanobot.md)\n- [Haven vs NanoClaw](https://www.anchorterminal.com/compare/haven-vs-nanoclaw.md)\n- [Hermes Agent vs nanobot](https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot.md)\n- [Hermes Agent vs NanoClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-nanoclaw.md)\n- [Instinct vs nanobot](https://www.anchorterminal.com/compare/instinct-vs-nanobot.md)\n- [Instinct vs NanoClaw](https://www.anchorterminal.com/compare/instinct-vs-nanoclaw.md)\n- [IronClaw vs nanobot](https://www.anchorterminal.com/compare/ironclaw-vs-nanobot.md)\n- [IronClaw vs NanoClaw](https://www.anchorterminal.com/compare/ironclaw-vs-nanoclaw.md)\n- [Leon vs nanobot](https://www.anchorterminal.com/compare/leon-vs-nanobot.md)\n- [Leon vs NanoClaw](https://www.anchorterminal.com/compare/leon-vs-nanoclaw.md)\n- [Lindy vs nanobot](https://www.anchorterminal.com/compare/lindy-vs-nanobot.md)\n- [Lindy vs NanoClaw](https://www.anchorterminal.com/compare/lindy-vs-nanoclaw.md)\n- [nanobot vs Dots](https://www.anchorterminal.com/compare/nanobot-vs-openai-dots.md)\n- [nanobot vs OpenClaw](https://www.anchorterminal.com/compare/nanobot-vs-openclaw.md)\n- [nanobot vs PicoClaw](https://www.anchorterminal.com/compare/nanobot-vs-picoclaw.md)\n- [nanobot vs Poke](https://www.anchorterminal.com/compare/nanobot-vs-poke.md)\n- [nanobot vs QwenPaw](https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw.md)\n- [nanobot vs ZeroClaw](https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw.md)\n- [nanobot vs Zo Computer](https://www.anchorterminal.com/compare/nanobot-vs-zo-computer.md)\n- [NanoClaw vs Dots](https://www.anchorterminal.com/compare/nanoclaw-vs-openai-dots.md)\n- [NanoClaw vs OpenClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-openclaw.md)\n- [NanoClaw vs PicoClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-picoclaw.md)\n- [NanoClaw vs Poke](https://www.anchorterminal.com/compare/nanoclaw-vs-poke.md)\n- [NanoClaw vs QwenPaw](https://www.anchorterminal.com/compare/nanoclaw-vs-qwenpaw.md)\n- [NanoClaw vs ZeroClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-zeroclaw.md)\n- [NanoClaw vs Zo Computer](https://www.anchorterminal.com/compare/nanoclaw-vs-zo-computer.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "nanobot vs NanoClaw", "url": "" } ], "description": "NanoClaw scores 68.3 (B) to nanobot's 62.4 (B) for assistant proactive. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "nanobot B 62.4", "NanoClaw B 68.3", "scores" ], "h1": "nanobot vs NanoClaw", "image": "https://www.anchorterminal.com/assets/og/compare-nanobot-vs-nanoclaw.png", "path": "/compare/nanobot-vs-nanoclaw", "published": "2026-10-01", "section": "tools", "title": "nanobot vs NanoClaw for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw" }, "tokens": { "markdown": 2500, "slim": 480 }, "version": 1 }