OpenClaw vs QwenPaw

OpenClaw

Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

QwenPaw

Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

OpenClaw

1. Set a session permission mode of guarded or workspace, or tools.exec.mode, before connecting mail. The default runs host commands without approval
2. Turn on agents.defaults.sandbox for any agent that reads mail, web pages or attachments. Sandboxing is off by default
3. Set tools.message.crossContext.allowAcrossProviders and allowWithinProvider to false to confine sends to the current conversation
4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny gateway, cron, sessions_spawn and sessions_send for it
5. Run openclaw security audit after setup, and treat the Gateway token as an owner credential. POST /tools/invoke accepts it with full operator access

QwenPaw

1. Set QWENPAW_TELEMETRY_DISABLED=true before qwenpaw init --defaults or qwenpaw app. Both send usage data without asking
2. Set approval_level to STRICT or SMART in agent.json. The default AUTO runs every tool call no guard rule flags
3. Set dm_policy and group_policy to allowlist with allow_from on each channel. Both default to open
4. Set QWENPAW_AUTH_ENABLED=true before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on ask for send_message, delete_message and delete_thread, and turn on Mail Access Control with automatic handling