{ "data": { "a": { "slug": "nanobot", "name": "nanobot", "vendor": "HKUDS", "vendorUrl": "https://nanobot.wiki", "kind": "harness", "category": "personal-assistants", "summary": "nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.", "url": "https://www.anchorterminal.com/tools/nanobot", "markdownUrl": "https://www.anchorterminal.com/tools/nanobot.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nanobot.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nanobot.json", "repo": "https://github.com/HKUDS/nanobot", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "nanobot-ai" } ], "auth": "none", "authNotes": "No account with the project. The owner supplies model provider keys or an OAuth sign-in, and bot tokens or mailbox passwords for each channel, in `~/.nanobot/config.json`. The WebUI on localhost needs no password, and binding to all interfaces requires a token.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy from the project. The owner pays the model provider, or nothing with a local model. The optional Render deployment needs a paid Render service.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 49000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://nanobot.wiki/docs/latest/getting-started/nanobot-overview", "llmsTxt": "https://nanobot.wiki/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "python", "mit", "llms-txt", "docker", "alpha" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 446, "ranked": true, "rankOf": 993, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 48 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": -6, "negativeNotes": [ "2026-09-02. GHSA-vc5v-6vwm-wf9m (critical, 9.3, no CVE). Web fetch did not block internal addresses, so cloud metadata and internal services could be read without authentication in versions before 0.3.0. Fixed in 0.3.0 of 25 July and published, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m", "2026-03-27. GHSA-4gmr-2vc8-7qh3 (CVE-2026-33654, high). A spoofed email could inject instructions through email polling with no user action, up to command execution, in 0.1.4.post5 and earlier. Fixed in 0.1.4.post6 and published, more than six months ago, -2. https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3", "2026-03-11. GHSA-g6cf-xjwr-pm77 (CVE-2026-31977, critical, 9.0). A sender ID containing `|` passed the `allowFrom` check in versions before 0.1.4.post4. Fixed and published, more than six months ago, -1. https://github.com/HKUDS/nanobot/security/advisories/GHSA-g6cf-xjwr-pm77", "2026-04-14 and 2026-05-24. GHSA-v5j3-4q66-58cf (CVE-2026-35589, high, 8.0), cross-site WebSocket hijacking of the WhatsApp bridge, fixed in 0.1.5, and GHSA-3f63-vcp3-hvqr (CVE-2026-48716, high, 8.7), file write through a WhatsApp document name. Both fixed and published, -1 together. https://github.com/HKUDS/nanobot/security/advisories" ], "verdict": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "strengths": [ "MIT licence, runs on the owner's machine, and no telemetry code was found in the source at v0.3.5", "Long-term memory is plain files (`USER.md`, `SOUL.md`, `memory/MEMORY.md`) versioned with Git, with `/dream-log` and `/dream-restore` to inspect and roll back", "Chat channels deny unknown senders by default since v0.1.4.post4, with pairing codes the owner approves", "Email requires SPF and DKIM results from a named receiving service since v0.3.5, and mailbox access stays off until `consentGranted` is set", "Optional `bwrap` (Linux) and `seatbelt` (macOS) sandboxes for shell commands, and an SSRF guard on web fetches and HTTP MCP connections" ], "weaknesses": [ "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking", "`tools.restrictToWorkspace` defaults to false and `tools.exec.sandbox` to empty. Neither sandbox restricts network access, and Windows has none", "Five advisories published from 11 March to 2 September 2026, two rated critical, among them an allowlist bypass and unauthenticated SSRF in web fetch", "SECURITY.md lists plain-text API keys in `config.json`, no rate limiting and limited security event logging as known limitations", "Version 0.3.5 with an Alpha classifier, 214 open issues and 614 open pull requests on 12 October 2026" ], "agentNotes": [ "Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default", "Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)", "Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing", "Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text", "Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 74, "maintenance": 82, "payments": 60, "reliability": 70, "schema": 77, "security": 63, "transparency": 69 }, "provenanceScore": 27 }, "connect": { "install": "python -m pip install nanobot-ai # or: uv tool install nanobot-ai # then: nanobot webui", "headless": { "command": "nanobot -m \"$TASK\"" } }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/nanobot" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "nanobot.wiki", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/HKUDS/nanobot/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No legal entity is named. The repository belongs to the GitHub organisation HKUDS, which a published advisory title calls the Hong Kong University Data Intelligence Lab. pyproject.toml names Xubin Ren and the nanobot contributors as authors.", "nanobot.wiki has no terms or privacy page linked from its home page or llms.txt, and `/.well-known/security.txt` answered with the site's not-found page on 12 October 2026.", "SECURITY.md in the repository asks for reports through a private GitHub advisory or by email and aims to respond within 48 hours.", "There is no hosted endpoint. A gateway answers on its owner's own host." ], "score": 27 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nanobot.json", "live": { "slug": "nanobot", "versions": [ { "registry": "github", "name": "HKUDS/nanobot", "version": "v0.3.5", "released": "2026-09-15", "seenAt": "2026-10-12T22:16:43.073576298Z" }, { "registry": "pypi", "name": "nanobot-ai", "version": "0.3.5", "released": "2026-09-15", "seenAt": "2026-10-12T22:16:42.890638532Z" } ], "githubStars": 48974, "pypiWeekly": 18972, "updatedAt": "2026-10-12T22:16:43.073576298Z" } }, "answer": "nanobot scores 62.4 (B) on agent readiness against Talorys's 28.9 (F), and leads in 4 of 7 scored categories.", "b": { "slug": "talorys", "name": "Talorys", "vendor": "Roc Yu (rociiu) and contributors", "vendorUrl": "https://github.com/rociiu/talorys", "kind": "platform", "category": "personal-assistants", "summary": "Talorys is an open-source, single-user personal AI assistant that its owner deploys into their own Cloudflare account with one command. It chats, keeps editable memories, and manages tasks, notes, projects, reminders and scheduled routines.", "url": "https://www.anchorterminal.com/tools/talorys", "markdownUrl": "https://www.anchorterminal.com/tools/talorys.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/talorys.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/talorys.json", "repo": "https://github.com/rociiu/talorys", "license": "MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms.", "transports": [], "packages": [ { "registry": "npm", "name": "create-talorys" } ], "auth": "mixed", "authNotes": "The installer signs in to Cloudflare through Wrangler's OAuth flow, or uses an API token with Workers Scripts, Pages, Workers AI and Account Settings permissions. The owner password is hashed locally with PBKDF2-SHA256 and stored as a Worker secret. The web app uses an HttpOnly session cookie, and every non-GET request needs an x-talorys-request header and a same-origin Origin (https://github.com/rociiu/talorys/blob/main/docs/security.md). There is no API key, MCP server or signup.", "pricing": "free", "pricingNotes": "Free and MIT-licensed, designed to fit the Cloudflare Workers Free plan, including a daily Workers AI allocation. On a paid Cloudflare plan, use beyond the included amounts is billed by Cloudflare (https://github.com/rociiu/talorys#7-what-is-free-and-what-may-cost-money).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No payment protocol. Talorys has no billing of its own, checked 12 October 2026.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 978, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://github.com/rociiu/talorys/tree/main/docs", "capabilities": [ "assistant.memory", "assistant.self-hosted", "memory.user", "memory.search", "tasks.create", "tasks.update", "notify.in-app" ], "tags": [ "open-source", "self-hosted", "free", "typescript", "cloudflare" ], "lastRelease": "2026-10-12", "graded": true, "disclosure": "Talorys competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 28.9, "grade": "F", "agentReady": false, "rank": 976, "ranked": true, "rankOf": 993, "categoryRank": 19, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 0, "maintenance": 83, "payments": 60, "reliability": 41, "schema": 0, "security": 8, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-12" }, "negative": 0, "verdict": "Talorys is an MIT-licensed assistant its owner deploys to their own Cloudflare account, with no telemetry, a documented threat model and code-enforced confirmation for destructive tools. It is two days old at version 0.1.5, has no mail, calendar or payment connections, and no interface for an outside agent.", "bestFor": "A single person who wants a private assistant for memory, tasks, notes and reminders on their own Cloudflare account.", "disclosure": "Talorys competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "MIT licence, and no telemetry, analytics or tracking, stated in the README and confirmed in the code.", "Destructive tools need confirmation in the owner's latest message, enforced in code, and scheduled runs get read-only tools.", "SECURITY.md with private reporting, a 3-business-day acknowledgement target and a threat model.", "Designed to fit Cloudflare's Workers Free plan, with nothing to buy from Talorys." ], "weaknesses": [ "No API key, MCP server or A2A endpoint, and the /api routes need the owner's browser session.", "First released on 10 October 2026 and still pre-1.0 at 0.1.5.", "No changelog or breaking-change notes.", "No mail, calendar, booking, payment or messaging connections in the code." ], "agentNotes": [ "Run `npx create-talorys@latest` with Node.js 22 or later and a Cloudflare login or an API token with Workers, Pages and Workers AI permissions.", "Don't script the /api routes. They need the owner's session cookie and CSRF header and aren't documented for other callers.", "Update with `npx create-talorys@latest update`. Only the latest version gets security fixes." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28.9 } ], "editorialScores": { "ergonomics": 0, "maintenance": 83, "payments": 60, "reliability": 41, "schema": 0, "security": 8, "transparency": 77 }, "provenanceScore": 27 }, "connect": { "install": "npx create-talorys@latest # Node.js 22+, signs in to Cloudflare and deploys into your account" }, "letme": { "capability": "https://letme.dev/assistant.memory", "tool": "https://letme.dev/talorys" }, "sameCompany": [ "github-mcp-server", "github-copilot-cli" ], "area": "frameworks", "provenance": { "legalEntity": "", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/rociiu/talorys/commits/main", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No company, terms of service or privacy policy. The MIT licence names The Talorys contributors, and Cloudflare's terms and privacy policy cover the hosting.", "Security reports go through GitHub private vulnerability reporting per SECURITY.md. There is no security.txt.", "There is no hosted endpoint. Each install answers on the owner's own pages.dev address.", "GitHub star count was not checked because the GitHub API was not available to us." ], "score": 27 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/talorys.json", "live": { "slug": "talorys", "versions": [ { "registry": "npm", "name": "create-talorys", "version": "0.1.5", "seenAt": "2026-10-12T22:32:28.340613655Z" } ], "githubStars": 892, "npmWeekly": 978, "updatedAt": "2026-10-12T22:32:29.267294141Z" } }, "facts": [ { "a": "Agent harness", "b": "Platform", "name": "Kind" }, { "a": "HKUDS", "b": "Roc Yu (rociiu) and contributors", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms.", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-09-15", "b": "2026-10-12", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "", "b": "", "name": "Customer content may train models" }, { "a": "", "b": "", "name": "Terms restrict automated access" }, { "a": "", "b": "", "name": "Terms restrict benchmarking" }, { "a": "", "b": "", "name": "Terms or service can change without notice" }, { "a": "", "b": "", "name": "Arbitration or class-action waiver" }, { "a": "49k stars", "b": "978 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "nanobot scores 62.4 (B) on agent readiness against Talorys's 28.9 (F), and leads in 4 of 7 scored categories.", "question": "Which is better for AI agents, nanobot or Talorys?" }, { "answer": "Yes. nanobot is open source (MIT). Talorys is open source (MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms.).", "question": "Are nanobot and Talorys open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 70 against 41", "Schema \u0026 documentation, 77 against 0", "Agent ergonomics, 74 against 0", "Security \u0026 auth, 63 against 8" ], "also": [ "No key needed to call it" ], "goodFor": "A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.", "slug": "nanobot", "watchFor": "No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking" }, { "aheadOn": null, "also": [ "No incidents deducted, where nanobot loses 6 points for them" ], "goodFor": "A single person who wants a private assistant for memory, tasks, notes and reminders on their own Cloudflare account.", "slug": "talorys", "watchFor": "No API key, MCP server or A2A endpoint, and the /api routes need the owner's browser session." } ], "job": { "capability": "assistant.memory", "name": "Assistants that remember you" }, "others": [ { "json": "https://www.anchorterminal.com/compare/astrbot-vs-nanobot.json", "title": "AstrBot vs nanobot", "url": "https://www.anchorterminal.com/compare/astrbot-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/cowagent-vs-nanobot.json", "title": "CowAgent vs nanobot", "url": "https://www.anchorterminal.com/compare/cowagent-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/gaia-vs-nanobot.json", "title": "GAIA vs nanobot", "url": "https://www.anchorterminal.com/compare/gaia-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot.json", "title": "Gemini Spark vs nanobot", "url": "https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/grok-bot-vs-nanobot.json", "title": "Grok Bot vs nanobot", "url": "https://www.anchorterminal.com/compare/grok-bot-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/haven-vs-nanobot.json", "title": "Haven vs nanobot", "url": "https://www.anchorterminal.com/compare/haven-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot.json", "title": "Hermes Agent vs nanobot", "url": "https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/instinct-vs-nanobot.json", "title": "Instinct vs nanobot", "url": "https://www.anchorterminal.com/compare/instinct-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/ironclaw-vs-nanobot.json", "title": "IronClaw vs nanobot", "url": "https://www.anchorterminal.com/compare/ironclaw-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/leon-vs-nanobot.json", "title": "Leon vs nanobot", "url": "https://www.anchorterminal.com/compare/leon-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/lindy-vs-nanobot.json", "title": "Lindy vs nanobot", "url": "https://www.anchorterminal.com/compare/lindy-vs-nanobot" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.json", "title": "nanobot vs NanoClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-openai-dots.json", "title": "nanobot vs Dots", "url": "https://www.anchorterminal.com/compare/nanobot-vs-openai-dots" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-openclaw.json", "title": "nanobot vs OpenClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-openclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-picoclaw.json", "title": "nanobot vs PicoClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-picoclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-poke.json", "title": "nanobot vs Poke", "url": "https://www.anchorterminal.com/compare/nanobot-vs-poke" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw.json", "title": "nanobot vs QwenPaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw.json", "title": "nanobot vs ZeroClaw", "url": "https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-zo-computer.json", "title": "nanobot vs Zo Computer", "url": "https://www.anchorterminal.com/compare/nanobot-vs-zo-computer" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-natura.json", "title": "nanobot vs Natura tinyNature", "url": "https://www.anchorterminal.com/compare/nanobot-vs-natura" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-pally.json", "title": "nanobot vs Pally", "url": "https://www.anchorterminal.com/compare/nanobot-vs-pally" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-tomo.json", "title": "nanobot vs Tomo", "url": "https://www.anchorterminal.com/compare/nanobot-vs-tomo" }, { "json": "https://www.anchorterminal.com/compare/nanobot-vs-wajo.json", "title": "nanobot vs Wajo (Fo)", "url": "https://www.anchorterminal.com/compare/nanobot-vs-wajo" }, { "json": "https://www.anchorterminal.com/compare/cowagent-vs-talorys.json", "title": "CowAgent vs Talorys", "url": "https://www.anchorterminal.com/compare/cowagent-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/gaia-vs-talorys.json", "title": "GAIA vs Talorys", "url": "https://www.anchorterminal.com/compare/gaia-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/gemini-spark-vs-talorys.json", "title": "Gemini Spark vs Talorys", "url": "https://www.anchorterminal.com/compare/gemini-spark-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/grok-bot-vs-talorys.json", "title": "Grok Bot vs Talorys", "url": "https://www.anchorterminal.com/compare/grok-bot-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/haven-vs-talorys.json", "title": "Haven vs Talorys", "url": "https://www.anchorterminal.com/compare/haven-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/hermes-agent-vs-talorys.json", "title": "Hermes Agent vs Talorys", "url": "https://www.anchorterminal.com/compare/hermes-agent-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/instinct-vs-talorys.json", "title": "Instinct vs Talorys", "url": "https://www.anchorterminal.com/compare/instinct-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/ironclaw-vs-talorys.json", "title": "IronClaw vs Talorys", "url": "https://www.anchorterminal.com/compare/ironclaw-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/leon-vs-talorys.json", "title": "Leon vs Talorys", "url": "https://www.anchorterminal.com/compare/leon-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/lindy-vs-talorys.json", "title": "Lindy vs Talorys", "url": "https://www.anchorterminal.com/compare/lindy-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/nanoclaw-vs-talorys.json", "title": "NanoClaw vs Talorys", "url": "https://www.anchorterminal.com/compare/nanoclaw-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/natura-vs-talorys.json", "title": "Natura tinyNature vs Talorys", "url": "https://www.anchorterminal.com/compare/natura-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/openai-dots-vs-talorys.json", "title": "Dots vs Talorys", "url": "https://www.anchorterminal.com/compare/openai-dots-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/openclaw-vs-talorys.json", "title": "OpenClaw vs Talorys", "url": "https://www.anchorterminal.com/compare/openclaw-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/pally-vs-talorys.json", "title": "Pally vs Talorys", "url": "https://www.anchorterminal.com/compare/pally-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/picoclaw-vs-talorys.json", "title": "PicoClaw vs Talorys", "url": "https://www.anchorterminal.com/compare/picoclaw-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/poke-vs-talorys.json", "title": "Poke vs Talorys", "url": "https://www.anchorterminal.com/compare/poke-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/qwenpaw-vs-talorys.json", "title": "QwenPaw vs Talorys", "url": "https://www.anchorterminal.com/compare/qwenpaw-vs-talorys" }, { "json": "https://www.anchorterminal.com/compare/talorys-vs-tomo.json", "title": "Talorys vs Tomo", "url": "https://www.anchorterminal.com/compare/talorys-vs-tomo" }, { "json": "https://www.anchorterminal.com/compare/talorys-vs-wajo.json", "title": "Talorys vs Wajo (Fo)", "url": "https://www.anchorterminal.com/compare/talorys-vs-wajo" }, { "json": "https://www.anchorterminal.com/compare/talorys-vs-zeroclaw.json", "title": "Talorys vs ZeroClaw", "url": "https://www.anchorterminal.com/compare/talorys-vs-zeroclaw" }, { "json": "https://www.anchorterminal.com/compare/talorys-vs-zo-computer.json", "title": "Talorys vs Zo Computer", "url": "https://www.anchorterminal.com/compare/talorys-vs-zo-computer" }, { "json": "https://www.anchorterminal.com/compare/astrbot-vs-talorys.json", "title": "AstrBot vs Talorys", "url": "https://www.anchorterminal.com/compare/astrbot-vs-talorys" } ], "scores": [ { "by": 29, "edge": "nanobot", "key": "reliability", "name": "Reliability", "nanobot": 70, "talorys": 41, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 77, "edge": "nanobot", "key": "schema", "name": "Schema \u0026 documentation", "nanobot": 77, "talorys": 0, "weight": 13 }, { "by": 74, "edge": "nanobot", "key": "ergonomics", "name": "Agent ergonomics", "nanobot": 74, "talorys": 0, "weight": 13 }, { "by": 55, "edge": "nanobot", "key": "security", "name": "Security \u0026 auth", "nanobot": 63, "talorys": 8, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "nanobot": 60, "talorys": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "edge": "talorys", "key": "maintenance", "name": "Maintenance \u0026 community", "nanobot": 82, "talorys": 83, "weight": 7 }, { "by": 4, "edge": "talorys", "key": "transparency", "name": "Transparency \u0026 trust", "nanobot": 48, "talorys": 52, "weight": 7 } ], "summary": "nanobot scores 62.4 (B) on agent readiness against Talorys's 28.9 (F), and leads in 4 of 7 scored categories. Both do assistants that remember you.", "verdicts": { "nanobot": "nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.", "talorys": "Talorys is an MIT-licensed assistant its owner deploys to their own Cloudflare account, with no telemetry, a documented threat model and code-enforced confirmation for destructive tools. It is two days old at version 0.1.5, has no mail, calendar or payment connections, and no interface for an outside agent." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/nanobot-vs-talorys", "json": "https://www.anchorterminal.com/compare/nanobot-vs-talorys.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/nanobot-vs-talorys.md", "slim": "https://www.anchorterminal.com/compare/nanobot-vs-talorys.min.md" }, "markdown": "nanobot scores 62.4 (B) on agent readiness against Talorys's 28.9 (F), and leads in 4 of 7 scored categories. Both do assistants that remember you.\n\n- nanobot: grade B, 62.4/100, rank #446 of 993. Markdown https://www.anchorterminal.com/tools/nanobot.md · JSON https://www.anchorterminal.com/api/v1/tools/nanobot.json\n- Talorys: grade F, 28.9/100, rank #976 of 993. Markdown https://www.anchorterminal.com/tools/talorys.md · JSON https://www.anchorterminal.com/api/v1/tools/talorys.json\n- Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 314 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Which one, for what\n\n### nanobot (B)\n\nGood for: A technical owner who wants an assistant on their own machine across many chat apps, with file-based memory and a free choice of model.\n\nAhead on:\n- Reliability, 70 against 41\n- Schema \u0026 documentation, 77 against 0\n- Agent ergonomics, 74 against 0\n- Security \u0026 auth, 63 against 8\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: No per-action approval was found in the docs or source. The agent sends messages, runs shell commands and edits files without asking\n\n### Talorys (F)\n\nGood for: A single person who wants a private assistant for memory, tasks, notes and reminders on their own Cloudflare account.\n\nAlso in its favour:\n- No incidents deducted, where nanobot loses 6 points for them\n\nWatch for: No API key, MCP server or A2A endpoint, and the /api routes need the owner's browser session.\n\n\n## Score by category\n\n| Category | Weight | nanobot | Talorys | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 70 | 41 | nanobot +29 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 0 | nanobot +77 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 0 | nanobot +74 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 8 | nanobot +55 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 82 | 83 | Talorys +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 48 | 52 | Talorys +4 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **62.4 · B** | **28.9 · F** | |\n\n## Facts side by side\n\n| Fact | nanobot | Talorys |\n| --- | --- | --- |\n| Kind | Agent harness | Platform |\n| Vendor | HKUDS | Roc Yu (rociiu) and contributors |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth or key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms. |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | no |\n| Last release | 2026-09-15 | 2026-10-12 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | | |\n| Terms restrict automated access | | |\n| Terms restrict benchmarking | | |\n| Terms or service can change without notice | | |\n| Arbitration or class-action waiver | | |\n| Popularity | 49k stars | 978 npm/wk |\n\n## Verdicts\n\n**nanobot.** nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.\n\n**Talorys.** Talorys is an MIT-licensed assistant its owner deploys to their own Cloudflare account, with no telemetry, a documented threat model and code-enforced confirmation for destructive tools. It is two days old at version 0.1.5, has no mail, calendar or payment connections, and no interface for an outside agent.\n\n## Before you call either\n\n### nanobot\n\n1. Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default\n2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)\n3. Keep `allowFrom` narrow on every channel and never set `[\"*\"]` on Email, which has no pairing\n4. Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text\n5. Use `nanobot -m \"...\"` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat\n\n### Talorys\n\n1. Run `npx create-talorys@latest` with Node.js 22 or later and a Cloudflare login or an API token with Workers, Pages and Workers AI permissions.\n2. Don't script the /api routes. They need the owner's session cookie and CSRF header and aren't documented for other callers.\n3. Update with `npx create-talorys@latest update`. Only the latest version gets security fixes.\n\n## Questions\n\n### Which is better for AI agents, nanobot or Talorys?\n\nnanobot scores 62.4 (B) on agent readiness against Talorys's 28.9 (F), and leads in 4 of 7 scored categories.\n\n### Are nanobot and Talorys open source?\n\nYes. nanobot is open source (MIT). Talorys is open source (MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms.).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/nanobot-vs-talorys.json, and with the fewest tokens: https://www.anchorterminal.com/compare/nanobot-vs-talorys.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"nanobot\", \"b\": \"talorys\"}`. From a terminal: `anchor compare nanobot talorys`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/nanobot.json and https://www.anchorterminal.com/api/v1/tools/talorys.json\n\n## Other comparisons with nanobot or Talorys\n\n- [AstrBot vs nanobot](https://www.anchorterminal.com/compare/astrbot-vs-nanobot.md)\n- [CowAgent vs nanobot](https://www.anchorterminal.com/compare/cowagent-vs-nanobot.md)\n- [GAIA vs nanobot](https://www.anchorterminal.com/compare/gaia-vs-nanobot.md)\n- [Gemini Spark vs nanobot](https://www.anchorterminal.com/compare/gemini-spark-vs-nanobot.md)\n- [Grok Bot vs nanobot](https://www.anchorterminal.com/compare/grok-bot-vs-nanobot.md)\n- [Haven vs nanobot](https://www.anchorterminal.com/compare/haven-vs-nanobot.md)\n- [Hermes Agent vs nanobot](https://www.anchorterminal.com/compare/hermes-agent-vs-nanobot.md)\n- [Instinct vs nanobot](https://www.anchorterminal.com/compare/instinct-vs-nanobot.md)\n- [IronClaw vs nanobot](https://www.anchorterminal.com/compare/ironclaw-vs-nanobot.md)\n- [Leon vs nanobot](https://www.anchorterminal.com/compare/leon-vs-nanobot.md)\n- [Lindy vs nanobot](https://www.anchorterminal.com/compare/lindy-vs-nanobot.md)\n- [nanobot vs NanoClaw](https://www.anchorterminal.com/compare/nanobot-vs-nanoclaw.md)\n- [nanobot vs Dots](https://www.anchorterminal.com/compare/nanobot-vs-openai-dots.md)\n- [nanobot vs OpenClaw](https://www.anchorterminal.com/compare/nanobot-vs-openclaw.md)\n- [nanobot vs PicoClaw](https://www.anchorterminal.com/compare/nanobot-vs-picoclaw.md)\n- [nanobot vs Poke](https://www.anchorterminal.com/compare/nanobot-vs-poke.md)\n- [nanobot vs QwenPaw](https://www.anchorterminal.com/compare/nanobot-vs-qwenpaw.md)\n- [nanobot vs ZeroClaw](https://www.anchorterminal.com/compare/nanobot-vs-zeroclaw.md)\n- [nanobot vs Zo Computer](https://www.anchorterminal.com/compare/nanobot-vs-zo-computer.md)\n- [nanobot vs Natura tinyNature](https://www.anchorterminal.com/compare/nanobot-vs-natura.md)\n- [nanobot vs Pally](https://www.anchorterminal.com/compare/nanobot-vs-pally.md)\n- [nanobot vs Tomo](https://www.anchorterminal.com/compare/nanobot-vs-tomo.md)\n- [nanobot vs Wajo (Fo)](https://www.anchorterminal.com/compare/nanobot-vs-wajo.md)\n- [CowAgent vs Talorys](https://www.anchorterminal.com/compare/cowagent-vs-talorys.md)\n- [GAIA vs Talorys](https://www.anchorterminal.com/compare/gaia-vs-talorys.md)\n- [Gemini Spark vs Talorys](https://www.anchorterminal.com/compare/gemini-spark-vs-talorys.md)\n- [Grok Bot vs Talorys](https://www.anchorterminal.com/compare/grok-bot-vs-talorys.md)\n- [Haven vs Talorys](https://www.anchorterminal.com/compare/haven-vs-talorys.md)\n- [Hermes Agent vs Talorys](https://www.anchorterminal.com/compare/hermes-agent-vs-talorys.md)\n- [Instinct vs Talorys](https://www.anchorterminal.com/compare/instinct-vs-talorys.md)\n- [IronClaw vs Talorys](https://www.anchorterminal.com/compare/ironclaw-vs-talorys.md)\n- [Leon vs Talorys](https://www.anchorterminal.com/compare/leon-vs-talorys.md)\n- [Lindy vs Talorys](https://www.anchorterminal.com/compare/lindy-vs-talorys.md)\n- [NanoClaw vs Talorys](https://www.anchorterminal.com/compare/nanoclaw-vs-talorys.md)\n- [Natura tinyNature vs Talorys](https://www.anchorterminal.com/compare/natura-vs-talorys.md)\n- [Dots vs Talorys](https://www.anchorterminal.com/compare/openai-dots-vs-talorys.md)\n- [OpenClaw vs Talorys](https://www.anchorterminal.com/compare/openclaw-vs-talorys.md)\n- [Pally vs Talorys](https://www.anchorterminal.com/compare/pally-vs-talorys.md)\n- [PicoClaw vs Talorys](https://www.anchorterminal.com/compare/picoclaw-vs-talorys.md)\n- [Poke vs Talorys](https://www.anchorterminal.com/compare/poke-vs-talorys.md)\n- [QwenPaw vs Talorys](https://www.anchorterminal.com/compare/qwenpaw-vs-talorys.md)\n- [Talorys vs Tomo](https://www.anchorterminal.com/compare/talorys-vs-tomo.md)\n- [Talorys vs Wajo (Fo)](https://www.anchorterminal.com/compare/talorys-vs-wajo.md)\n- [Talorys vs ZeroClaw](https://www.anchorterminal.com/compare/talorys-vs-zeroclaw.md)\n- [Talorys vs Zo Computer](https://www.anchorterminal.com/compare/talorys-vs-zo-computer.md)\n- [AstrBot vs Talorys](https://www.anchorterminal.com/compare/astrbot-vs-talorys.md)\n\n## Disclosure\n\n- Talorys competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "nanobot vs Talorys", "url": "" } ], "description": "nanobot scores 62.4 (B) to Talorys's 28.9 (F) for assistants that remember you. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "nanobot B 62.4", "Talorys F 28.9", "scores" ], "h1": "nanobot vs Talorys", "image": "https://www.anchorterminal.com/assets/og/compare-nanobot-vs-talorys.png", "path": "/compare/nanobot-vs-talorys", "published": "2026-10-01", "section": "tools", "title": "nanobot vs Talorys for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/compare/nanobot-vs-talorys" }, "tokens": { "markdown": 2750, "slim": 530 }, "version": 1 }