QwenPaw vs Zo Computer

QwenPaw

Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

Zo Computer

Zo publishes an OpenAPI file, Markdown docs, plan prices and a named list of the providers that receive user content. One access token grants full access to the workspace, no approval step before sending or buying was found in the reviewed docs, and no status page, rate limit or SLA is published.

QwenPaw

1. Set QWENPAW_TELEMETRY_DISABLED=true before qwenpaw init --defaults or qwenpaw app. Both send usage data without asking
2. Set approval_level to STRICT or SMART in agent.json. The default AUTO runs every tool call no guard rule flags
3. Set dm_policy and group_policy to allowlist with allow_from on each channel. Both default to open
4. Set QWENPAW_AUTH_ENABLED=true before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on ask for send_message, delete_message and delete_thread, and turn on Mail Access Control with automatic handling

Zo Computer

1. Send POST https://api.zo.computer/zo/ask with Authorization: Bearer zo_sk_... and an input string. The owner creates the token under Settings > Advanced
2. Pass persona_id for a persona with a narrow tool set. The token itself carries every permission the owner has
3. Set memory_mode to off to keep workspace memory out of a request. The field is in the OpenAPI file and absent from the API guide
4. Do not retry /zo/ask blindly after a timeout. No idempotency key is documented and the request may already have sent a message
5. Append .md to any guide or reference URL for Markdown