{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/zeroclaw.json", "name": "ZeroClaw", "score": 70.2, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "zeroclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanoclaw.json", "name": "NanoClaw", "score": 68.3, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "slug": "nanoclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/hermes-agent.json", "name": "Hermes Agent", "score": 67.9, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "hermes-agent" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/openclaw.json", "name": "OpenClaw", "score": 67.1, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "openclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/ironclaw.json", "name": "IronClaw", "score": 66.7, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "ironclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanobot.json", "name": "nanobot", "score": 62.4, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "nanobot" } ], "tool": { "slug": "cowagent", "name": "CowAgent", "vendor": "zhayujie", "vendorUrl": "https://cowagent.ai", "kind": "harness", "category": "personal-assistants", "summary": "CowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.", "url": "https://www.anchorterminal.com/tools/cowagent", "markdownUrl": "https://www.anchorterminal.com/tools/cowagent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cowagent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cowagent.json", "repo": "https://github.com/zhayujie/CowAgent", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "zhayujie/chatgpt-on-wechat" } ], "auth": "mixed", "authNotes": "No account. The web console listens on 127.0.0.1 with no password by default, and `web_password` adds a login whose session lasts 30 days. `external_api_token` is one Bearer token for the OpenAI-compatible endpoint, which stays off while the token is empty (https://docs.cowagent.ai/channels/web). Messaging channels use each platform's bot token or app secret in `config.json`. Model keys go in `config.json` or environment variables.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy to run it. The owner pays the configured model provider, or nothing with a local model behind an OpenAI-compatible endpoint. The README names LinkAI as a seller of managed hosting, and link-ai.tech did not answer on 12 October 2026, so its prices were not read.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 47400, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.cowagent.ai/intro/index", "llmsTxt": "https://docs.cowagent.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "llms-txt", "docker", "python", "openai-compatible" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 58.5, "grade": "C", "agentReady": false, "rank": 591, "ranked": true, "rankOf": 986, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 83, "payments": 60, "reliability": 84, "schema": 67, "security": 43, "transparency": 45 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 84, "points": 16.8, "reason": "Read with the local-software lines. Installs by a script and a Compose file served from cdn.link-ai.tech, a Docker image and a desktop client, with Python 3.7 to 3.13 stated in the quick start. There is no versioned package on a registry that we checked, and `pyproject.toml` describes only the CLI at version 1.0.0 (15 of 20). The Tests workflow runs pytest on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw on 12 October 2026 passed (25). 12 open issues and one open pull request, most of them feature requests. Issue #2998, a security report of 31 July, is still open (21 of 25). Dated notes for every release, with behaviour changes described inline and a setting to restore the old behaviour, but no breaking-change section, and patch-level versions carry new products such as the desktop client in 2.1.3 (8 of 15). Version 2.2.0 (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "Graded on the docs and on the interfaces an outside agent would use, the OpenAI-compatible endpoint, the CLI and the config. No OpenAPI file. The endpoint follows the chat completions shape and its additions (`conversation_id`, `tool_trace`, `cow_event`) are documented in prose (10 of 25). docs.cowagent.ai serves an llms.txt and a Markdown copy of each page (10). Each built-in tool has a page stating its purpose and uses, and the permission and MCP pages say when a mode refuses an action (13 of 20). Tool pages list parameters with types and required flags, and config tables give defaults and allowed values (10 of 15). The web channel page has curl and Python examples and documents 400, 401, 500 and 503 answers and the streaming error event (11 of 15). Release notes for every version on the docs site and on GitHub. The endpoint carries only a `/v1` prefix (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 59, "points": 9.59, "reason": "`agent_max_context_tokens` caps the prompt at 64,000 by default, history is compacted on a budget, a large knowledge index injects titles only, and on-demand MCP tool retrieval exists but is off by default (18 of 25). The endpoint returns the final message, with optional streaming and a tool trace, and nothing limits or selects the output (8 of 20). Documented status codes, a structured JSON 500 with a `timeout` code, error events inside a stream, and permission denials that name the reason (14 of 20). `conversation_id` keeps a stable session and 2.2.0 persists each step so an interrupted turn resumes, with no idempotency key or retry guidance (8 of 20). One command installs and starts it with a console on localhost, and any OpenAI client library reaches the endpoint, with no SDK of its own (11 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 43, "points": 7.53, "reason": "The console has no password by default and listens on 127.0.0.1. `web_password` adds one shared password, and `external_api_token` is a single Bearer token with no scopes. Model and MCP keys are plain text in `config.json` and `mcp.json`, while `~/.cow/.env` is closed to the `bash`, `read`, `edit` and `send` tools, with tests for the last three. No setting limits which Telegram, Slack or Discord users may message the bot (13 of 30). Three permission modes per session, with full-access the default for source and Docker installs and workspace-write for a fresh desktop install. The source says the checks are argument-level and not a sandbox. No action asks for approval, and the `bash` blocklist covers root deletion, disk wiping and power commands only (9 of 20). `web_fetch`, vision and browser navigation validate addresses against internal targets, and the agent may edit `mcp.json` only in full-access, but no guidance on injected content was found and issue #2998 is open (6 of 15). Tool calls are shown in the console, written to the session database after each step and returned as `tool_trace`, and channel credentials are masked in debug logs, with no separate audit log (9 of 15). GitHub reports no security policy, there is no security.txt, bounty or certification, one advisory is published, and release notes credit security fixes (6 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with nothing to buy, so 20, 20 and 20 on the last three lines. The README names LinkAI as a seller of managed hosting for CowAgent. link-ai.tech did not answer on 12 October 2026, so that service and its prices are unread and not scored." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "Version 2.2.0 was tagged on 30 September 2026, 12 days before this check (30). Seven tagged releases in the 90 days to 12 October (20). The maintainer merged pull requests on 12 October, the tracker holds 12 open issues and one open pull request, and the security report in #2998 has waited ten weeks with its proposed fix unmerged (20 of 25). Not an MCP server and no SDK. The Docker image, CLI and desktop client are current (7 of 15). Tests pass on master, requirements are mostly lower bounds with no lock file, and the image is built on `python:3.10-slim-bullseye` (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 45, "points": 3.94, "note": "editorial 62, provenance 27", "reason": "MIT (30). cowagent.ai links no privacy policy and no terms. The docs say where the desktop client, workspace and credentials are stored and warn that backups hold keys and conversations unencrypted, and a source comment says nothing is uploaded by default. Nothing states what the model providers receive or how to erase memory (12 of 30). The rename from chatgpt-on-wechat is announced with a redirect, and release notes are dated, with no deprecation policy (8 of 20). No telemetry was found in the Python source and the cloud client loads only when two settings are present. That is stated in a source comment and not in the docs, and the installer is fetched from LinkAI's CDN (12 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`agent_max_context_tokens` caps the prompt at 64,000 by default, history is compacted on a budget, a large knowledge index injects titles only, and on-demand MCP tool retrieval exists but is off by default (18 of 25). The endpoint returns the final message, with optional streaming and a tool trace, and nothing limits or selects the output (8 of 20). Documented status codes, a structured JSON 500 with a `timeout` code, error events inside a stream, and permission denials that name the reason (14 of 20). `conversation_id` keeps a stable session and 2.2.0 persists each step so an interrupted turn resumes, with no idempotency key or retry guidance (8 of 20). One command installs and starts it with a console on localhost, and any OpenAI client library reaches the endpoint, with no SDK of its own (11 of 15).", "maintenance": "Version 2.2.0 was tagged on 30 September 2026, 12 days before this check (30). Seven tagged releases in the 90 days to 12 October (20). The maintainer merged pull requests on 12 October, the tracker holds 12 open issues and one open pull request, and the security report in #2998 has waited ten weeks with its proposed fix unmerged (20 of 25). Not an MCP server and no SDK. The Docker image, CLI and desktop client are current (7 of 15). Tests pass on master, requirements are mostly lower bounds with no lock file, and the image is built on `python:3.10-slim-bullseye` (6 of 10).", "payments": "Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with nothing to buy, so 20, 20 and 20 on the last three lines. The README names LinkAI as a seller of managed hosting for CowAgent. link-ai.tech did not answer on 12 October 2026, so that service and its prices are unread and not scored.", "reliability": "Read with the local-software lines. Installs by a script and a Compose file served from cdn.link-ai.tech, a Docker image and a desktop client, with Python 3.7 to 3.13 stated in the quick start. There is no versioned package on a registry that we checked, and `pyproject.toml` describes only the CLI at version 1.0.0 (15 of 20). The Tests workflow runs pytest on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw on 12 October 2026 passed (25). 12 open issues and one open pull request, most of them feature requests. Issue #2998, a security report of 31 July, is still open (21 of 25). Dated notes for every release, with behaviour changes described inline and a setting to restore the old behaviour, but no breaking-change section, and patch-level versions carry new products such as the desktop client in 2.1.3 (8 of 15). Version 2.2.0 (15).", "schema": "Graded on the docs and on the interfaces an outside agent would use, the OpenAI-compatible endpoint, the CLI and the config. No OpenAPI file. The endpoint follows the chat completions shape and its additions (`conversation_id`, `tool_trace`, `cow_event`) are documented in prose (10 of 25). docs.cowagent.ai serves an llms.txt and a Markdown copy of each page (10). Each built-in tool has a page stating its purpose and uses, and the permission and MCP pages say when a mode refuses an action (13 of 20). Tool pages list parameters with types and required flags, and config tables give defaults and allowed values (10 of 15). The web channel page has curl and Python examples and documents 400, 401, 500 and 503 answers and the streaming error event (11 of 15). Release notes for every version on the docs site and on GitHub. The endpoint carries only a `/v1` prefix (13 of 15).", "security": "The console has no password by default and listens on 127.0.0.1. `web_password` adds one shared password, and `external_api_token` is a single Bearer token with no scopes. Model and MCP keys are plain text in `config.json` and `mcp.json`, while `~/.cow/.env` is closed to the `bash`, `read`, `edit` and `send` tools, with tests for the last three. No setting limits which Telegram, Slack or Discord users may message the bot (13 of 30). Three permission modes per session, with full-access the default for source and Docker installs and workspace-write for a fresh desktop install. The source says the checks are argument-level and not a sandbox. No action asks for approval, and the `bash` blocklist covers root deletion, disk wiping and power commands only (9 of 20). `web_fetch`, vision and browser navigation validate addresses against internal targets, and the agent may edit `mcp.json` only in full-access, but no guidance on injected content was found and issue #2998 is open (6 of 15). Tool calls are shown in the console, written to the session database after each step and returned as `tool_trace`, and channel credentials are masked in debug logs, with no separate audit log (9 of 15). GitHub reports no security policy, there is no security.txt, bounty or certification, one advisory is published, and release notes credit security fixes (6 of 20).", "transparency": "MIT (30). cowagent.ai links no privacy policy and no terms. The docs say where the desktop client, workspace and credentials are stored and warn that backups hold keys and conversations unencrypted, and a source comment says nothing is uploaded by default. Nothing states what the model providers receive or how to erase memory (12 of 30). The rename from chatgpt-on-wechat is announced with a redirect, and release notes are dated, with no deprecation policy (8 of 20). No telemetry was found in the Python source and the cloud client loads only when two settings are present. That is stated in a source comment and not in the docs, and the installer is fetched from LinkAI's CDN (12 of 20)." }, "sources": [ { "what": "repository README", "url": "https://github.com/zhayujie/CowAgent/blob/master/README.md", "seen": "2026-10-12" }, { "what": "repository page (stars, issue and pull request counts)", "url": "https://github.com/zhayujie/CowAgent", "seen": "2026-10-12" }, { "what": "config defaults", "url": "https://github.com/zhayujie/CowAgent/blob/master/config.py", "seen": "2026-10-12" }, { "what": "config template", "url": "https://github.com/zhayujie/CowAgent/blob/master/config-template.json", "seen": "2026-10-12" }, { "what": "permission policy source", "url": "https://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py", "seen": "2026-10-12" }, { "what": "bash tool source", "url": "https://github.com/zhayujie/CowAgent/blob/master/agent/tools/bash/bash.py", "seen": "2026-10-12" }, { "what": "cloud client source", "url": "https://github.com/zhayujie/CowAgent/blob/master/common/cloud_client.py", "seen": "2026-10-12" }, { "what": "Docker Compose file", "url": "https://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml", "seen": "2026-10-12" }, { "what": "test workflow", "url": "https://github.com/zhayujie/CowAgent/blob/master/.github/workflows/test.yml", "seen": "2026-10-12" }, { "what": "test workflow runs on master", "url": "https://github.com/zhayujie/CowAgent/actions/workflows/test.yml?query=branch%3Amaster", "seen": "2026-10-12" }, { "what": "open issues", "url": "https://github.com/zhayujie/CowAgent/issues", "seen": "2026-10-12" }, { "what": "issue #2998", "url": "https://github.com/zhayujie/CowAgent/issues/2998", "seen": "2026-10-12" }, { "what": "security overview (no policy)", "url": "https://github.com/zhayujie/CowAgent/security", "seen": "2026-10-12" }, { "what": "advisory GHSA-qwjc-xv6c-mqfx", "url": "https://github.com/zhayujie/CowAgent/security/advisories/GHSA-qwjc-xv6c-mqfx", "seen": "2026-10-12" }, { "what": "architecture and permission docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/intro/architecture.mdx", "seen": "2026-10-12" }, { "what": "web console and API docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/channels/web.mdx", "seen": "2026-10-12" }, { "what": "MCP docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/tools/mcp.mdx", "seen": "2026-10-12" }, { "what": "scheduler docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/tools/scheduler.mdx", "seen": "2026-10-12" }, { "what": "memory docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/memory/index.mdx", "seen": "2026-10-12" }, { "what": "Self-Evolution docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/memory/self-evolution.mdx", "seen": "2026-10-12" }, { "what": "Agent Mail docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/extensions/agent-mail.mdx", "seen": "2026-10-12" }, { "what": "backup docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/cli/backup.mdx", "seen": "2026-10-12" }, { "what": "desktop client docs (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/guide/desktop.mdx", "seen": "2026-10-12" }, { "what": "release notes 2.2.0 (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.2.0.mdx", "seen": "2026-10-12" }, { "what": "release notes 2.1.5 (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.1.5.mdx", "seen": "2026-10-12" }, { "what": "release notes 2.1.7 (source)", "url": "https://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.1.7.mdx", "seen": "2026-10-12" }, { "what": "docs llms.txt", "url": "https://docs.cowagent.ai/llms.txt", "seen": "2026-10-12" }, { "what": "quick start, Markdown copy", "url": "https://docs.cowagent.ai/guide/quick-start.md", "seen": "2026-10-12" }, { "what": "project home page", "url": "https://cowagent.ai/", "seen": "2026-10-12" }, { "what": "site map", "url": "https://cowagent.ai/sitemap.xml", "seen": "2026-10-12" } ], "openQuestions": [ "Kind. Recorded as `harness`, the closest kind the briefs define for agent software the owner runs, since there is no assistant kind. The README calls it an agent harness", "CowAgent is a personal assistant by the category's description, with channels, memory and unasked background work. It has no built-in mail or calendar connector, so `assistant.accounts` rests on the optional Agent Mail overlay and MCP OAuth", "Unchecked: LinkAI's hosted CowAgent, its prices, terms and privacy policy. link-ai.tech answered our robots.txt request with a connection failure twice on 12 October 2026, so the host was treated as closed", "Unchecked: whether the bot sends the owner's files to a group as issue #2998 reports. We read the source and did not run the software", "Unchecked: the installer script, the Compose file and the desktop client served from cdn.link-ai.tech and cowagent.ai/download, and whether they match the repository", "Unchecked: the desktop client's source for telemetry. The search for telemetry covered the Python source", "Unchecked: Tencent's Agent Mail service at agent.qq.com, its scopes and its terms", "Unchecked: the Docker Hub image tags and the registration date of cowagent.ai", "Whether a legal entity stands behind the project. None is named, and the enterprise contact is an address at simple-future.tech", "The advisory GHSA-qwjc-xv6c-mqfx was published 16 months after the release it names as the fix. No deduction was taken because the fix predates the last 12 months", "The star count is the 47.4k shown on the repository page on 12 October 2026" ] }, "negative": -5, "negativeNotes": [ "2026-07-31. Issue #2998 reports that a member of a Feishu group asked the bot for local files and it sent the owner's documents into the group. This is the reporter's account and we did not reproduce it. We confirmed in the master source on 12 October 2026 that group channels accept every group, that full-access is the default and that the proposed sender gating is absent. Open and unfixed, -3. https://github.com/zhayujie/CowAgent/issues/2998", "2026-07-29. Version 2.1.5 fixed a chain in which injected content led the agent to rewrite the MCP config, run arbitrary commands and take keys, and fixed the `edit` tool reaching `~/.cow/.env`. Both are described in the release notes with no advisory. Fixed and documented, -2. https://docs.cowagent.ai/releases/v2.1.5" ], "verdict": "MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.", "bestFor": "One technical owner who wants an assistant on WeChat, Feishu, DingTalk, Telegram, Slack or Discord with memory in local files and a choice of Chinese and Western model providers.", "strengths": [ "Memory is plain Markdown under `~/cow` (`MEMORY.md`, `memory/YYYY-MM-DD.md`), readable and removable by the owner", "Three permission modes per session (read-only, workspace-write, full-access), with a global default in `agent_permission_mode`", "The web console binds to 127.0.0.1 by default, and the cloud client loads only when `use_linkai` and a deployment id are both set", "Seven tagged releases between 20 July and 30 September 2026, each with dated notes in the docs", "Tests run on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw passed on 12 October 2026" ], "weaknesses": [ "Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call", "The permission checks read arguments and are not an OS sandbox, as the source says. The `bash` blocklist covers only root deletion, disk wiping and power commands", "Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master", "No setting limits which Telegram, Slack or Discord users may message the bot, and those channels reply in every group", "No SECURITY.md, security.txt, privacy policy or terms. Model keys sit in `config.json` and MCP keys in `mcp.json` as plain text" ], "agentNotes": [ "Set `agent_permission_mode` to `workspace-write` or `read-only` before connecting any channel. Source and Docker installs default to `full-access`", "Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner", "Set `web_password` before changing `web_host` to `0.0.0.0`. The password is empty by default", "Set `external_api_token` to enable `POST /v1/chat/completions`, and send `conversation_id` to keep one session. The `model` field does not select a model", "Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.5 } ], "editorialScores": { "ergonomics": 59, "maintenance": 83, "payments": 60, "reliability": 84, "schema": 67, "security": 43, "transparency": 62 }, "provenanceScore": 27 }, "connect": { "install": "bash \u003c(curl -fsSL https://cdn.link-ai.tech/code/cow/run.sh) # or: curl -O https://cdn.link-ai.tech/code/cow/docker-compose.yml \u0026\u0026 docker compose up -d", "http": "curl http://localhost:9899/v1/chat/completions -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d '{\"model\":\"cowagent\",\"conversation_id\":\"example-conversation\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}'" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/cowagent" }, "notable": [ "`agent_permission_mode` defaults to `full-access` for source and Docker installs. Only a first launch of the desktop client starts at `workspace-write` (https://github.com/zhayujie/CowAgent/blob/master/config.py; https://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml)", "The permission source says the checks are argument-level and not an OS sandbox, and that `bash` gating is best effort (https://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py)", "There is no per-action approval prompt. In read-only mode writes, browser clicks, scheduler changes and MCP tools whose names look like writes are refused. In the other two modes MCP tools run unasked (https://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py)", "Self-Evolution is on in the config template and the Compose file. After 10 idle minutes it reviews the conversation, edits memory and skill files and finishes to-dos left in the chat, with a backup for undo (https://docs.cowagent.ai/memory/self-evolution)", "A summary of each day's conversations is written at 23:55 and distilled into `MEMORY.md`, which is injected into every system prompt (https://docs.cowagent.ai/memory/deep-dream)", "Issue #2998, opened on 31 July 2026 and still open on 12 October, reports that a member of a Feishu group asked the bot for local files and it sent the owner's documents to the group. The gating its author proposed (`security_enabled`) is not in the master source (https://github.com/zhayujie/CowAgent/issues/2998)", "The Telegram, Slack, Discord and Feishu channels set the group allowlist to every group, and the config has no sender allowlist for Telegram, Slack or Discord (https://github.com/zhayujie/CowAgent/blob/master/channel/telegram/telegram_channel.py; https://github.com/zhayujie/CowAgent/blob/master/config.py)", "Version 2.1.5 of 29 July 2026 fixed a chain in which injected content led the agent to rewrite `mcp.json`, run commands and take keys, and fixed the `edit` tool reaching `~/.cow/.env`. No advisory was published for either (https://docs.cowagent.ai/releases/v2.1.5)", "One advisory is published, GHSA-qwjc-xv6c-mqfx of 28 November 2025 (moderate), code execution through the tool plugin of the 1.x line. It says 1.7.0 fixed it, a tag dated 2 August 2024, and that 2.0 and later are not affected (https://github.com/zhayujie/CowAgent/security/advisories/GHSA-qwjc-xv6c-mqfx)", "GitHub reports no security policy for the repository, and cowagent.ai answers the security.txt and llms.txt addresses with its home page (https://github.com/zhayujie/CowAgent/security)", "Mail is an optional Docker Compose overlay that installs Tencent's `agently-cli`. The mailbox credentials are stored in `./agent-mail-data/config` (https://docs.cowagent.ai/extensions/agent-mail)", "MCP OAuth tokens are kept in `~/.cow/mcp_oauth.json` and static MCP keys as plain text in `mcp.json`. Skill secrets go in `~/.cow/.env`, which the `bash` tool refuses to read (https://docs.cowagent.ai/tools/mcp; https://github.com/zhayujie/CowAgent/blob/master/agent/tools/bash/bash.py)", "The one-line installer and the Compose file are downloaded from cdn.link-ai.tech, the domain of LinkAI, which the README names as the seller of managed hosting for CowAgent (https://github.com/zhayujie/CowAgent/blob/master/README.md)", "The project was named chatgpt-on-wechat until its rename. The Docker image and the Compose service keep that name (https://github.com/zhayujie/CowAgent/blob/master/README.md; https://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml)", "The README says the agent has access to the local operating system and should be deployed only in trusted environments (https://github.com/zhayujie/CowAgent/blob/master/README.md)" ], "area": "frameworks", "details": [ { "label": "Runs", "value": "On the owner's computer or server. One-line installer, Docker Compose, or a desktop client for macOS and Windows. The docs state Python 3.7 to 3.13 (https://docs.cowagent.ai/guide/quick-start)" }, { "label": "Acts without asking", "value": "Shell commands, file writes, file sends, browser actions, scheduled tasks and MCP calls all run without a prompt in full-access mode, the default for source and Docker installs. Self-Evolution and the daily memory summary run in the background" }, { "label": "Approval controls", "value": "Per-session read-only, workspace-write or full-access. No per-action approval. Skill installs are previewed and confirmed in the console, and a manual run of a scheduled task asks for confirmation" }, { "label": "Sandbox", "value": "None. The checks are argument-level, and the docs recommend a container for strong isolation" }, { "label": "Channels", "value": "Web console, Telegram, Slack, Discord, WeChat, Feishu, DingTalk, WeCom Bot, WeCom App, QQ, WeChat Customer Service, WeChat Official Account" }, { "label": "Accounts", "value": "No built-in mail or calendar connector. Mail through the optional Agent Mail overlay (`agently-cli`), other services through MCP servers and skills. MCP OAuth with an optional `scope` field" }, { "label": "Credential storage", "value": "Model and channel keys in `config.json`, skill secrets in `~/.cow/.env`, MCP OAuth tokens in `~/.cow/mcp_oauth.json`, static MCP keys in `mcp.json`, mailbox credentials in `./agent-mail-data/config`. All on the owner's disk, none encrypted that we found" }, { "label": "Memory", "value": "`MEMORY.md`, daily files and dream diaries as Markdown under `~/cow`, sessions in a local SQLite database, an FTS5 and vector index. The console deletes a session and its messages. No memory delete route was found in the console API, so memory is removed by editing or deleting the files" }, { "label": "Model providers", "value": "DeepSeek (the template default), Claude, OpenAI, Gemini, MiniMax, GLM, Qwen, Kimi, Doubao, ERNIE, MiMo, LinkAI, or a custom OpenAI-compatible endpoint such as Ollama, vLLM or LocalAI. The configured provider receives the conversation, memory and tool results" }, { "label": "MCP client", "value": "stdio, SSE and Streamable HTTP, OAuth or static headers, hot reload. The agent may edit `mcp.json` only in a full-access session" }, { "label": "API", "value": "`POST /v1/chat/completions` on the web console port (9899), off until `external_api_token` is set. Text only, streaming optional" }, { "label": "Telemetry", "value": "None found in the Python source. A comment in the cloud client says nothing is uploaded unless `use_linkai` and a deployment id are both set. The desktop client checks for updates" }, { "label": "Cost", "value": "The software is free. The owner pays the model provider. The README says agent mode uses substantially more tokens than chat. LinkAI's hosted prices were not read" }, { "label": "Releases in 90 days", "value": "7 (2.1.4 on 20 July 2026 to 2.2.0 on 30 September 2026)" } ], "provenance": { "legalEntity": "", "domain": "cowagent.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://docs.cowagent.ai/releases/overview", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No company or legal entity is named for CowAgent. The licence names zhayujie, and the cowagent.ai footer reads Copyright 2026 CowAgent.", "The README lists sales@simple-future.tech and LinkAI (link-ai.tech) for enterprise services and managed hosting. link-ai.tech did not answer our robots.txt request on 12 October 2026, so none of its pages were read.", "cowagent.ai links no terms and no privacy policy. Its sitemap lists the home, download and blog pages only.", "cowagent.ai answers `/.well-known/security.txt` and `/llms.txt` with the home page, so neither file exists. docs.cowagent.ai serves an llms.txt.", "The registration date of cowagent.ai was not looked up." ], "score": 27, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "cowagent.ai, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cowagent.json" }, "verify": { "accepts": "a page on cowagent.ai or one of its subdomains, or the README of github.com/zhayujie/CowAgent", "badgeUrl": "https://www.anchorterminal.com/badges/cowagent.svg", "body": { "slug": "cowagent", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/cowagent", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/cowagent\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cowagent.svg\" alt=\"CowAgent on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![CowAgent on Anchor Terminal](https://www.anchorterminal.com/badges/cowagent.svg)](https://www.anchorterminal.com/tools/cowagent)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/cowagent\"\u003eCowAgent on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/cowagent", "json": "https://www.anchorterminal.com/tools/cowagent.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/cowagent.md", "slim": "https://www.anchorterminal.com/tools/cowagent.min.md" }, "markdown": "## Overview\n\n**Grade C · 58.5/100 · rank #591 of 986 · #9 in Personal assistants · not agent-ready · confidence medium**\n\n\n## Assessment\n\nMIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | zhayujie (https://cowagent.ai) |\n| Kind | Agent harness |\n| Category | Personal assistants (https://www.anchorterminal.com/categories/personal-assistants) |\n| Transport | HTTP |\n| Auth | OAuth or key · No account. The web console listens on 127.0.0.1 with no password by default, and `web_password` adds a login whose session lasts 30 days. `external_api_token` is one Bearer token for the OpenAI-compatible endpoint, which stays off while the token is empty (https://docs.cowagent.ai/channels/web). Messaging channels use each platform's bot token or app secret in `config.json`. Model keys go in `config.json` or environment variables. |\n| Pricing | Free (Free · OSS) · Free under the MIT licence, with nothing to buy to run it. The owner pays the configured model provider, or nothing with a local model behind an OpenAI-compatible endpoint. The README names LinkAI as a seller of managed hosting, and link-ai.tech did not answer on 12 October 2026, so its prices were not read. |\n| x402 | No · No x402, MPP or L402 in the docs or the source (checked 2026-10-12). |\n| Licence | MIT |\n| Packages | oci: `zhayujie/chatgpt-on-wechat` |\n| Source | https://github.com/zhayujie/CowAgent |\n| Docs | https://docs.cowagent.ai/intro/index |\n| llms.txt | https://docs.cowagent.ai/llms.txt |\n| Last release | 2026-09-30 |\n| GitHub stars | 47,400 (as of 2026-10-12) |\n| Runs | On the owner's computer or server. One-line installer, Docker Compose, or a desktop client for macOS and Windows. The docs state Python 3.7 to 3.13 (https://docs.cowagent.ai/guide/quick-start) |\n| Acts without asking | Shell commands, file writes, file sends, browser actions, scheduled tasks and MCP calls all run without a prompt in full-access mode, the default for source and Docker installs. Self-Evolution and the daily memory summary run in the background |\n| Approval controls | Per-session read-only, workspace-write or full-access. No per-action approval. Skill installs are previewed and confirmed in the console, and a manual run of a scheduled task asks for confirmation |\n| Sandbox | None. The checks are argument-level, and the docs recommend a container for strong isolation |\n| Channels | Web console, Telegram, Slack, Discord, WeChat, Feishu, DingTalk, WeCom Bot, WeCom App, QQ, WeChat Customer Service, WeChat Official Account |\n| Accounts | No built-in mail or calendar connector. Mail through the optional Agent Mail overlay (`agently-cli`), other services through MCP servers and skills. MCP OAuth with an optional `scope` field |\n| Credential storage | Model and channel keys in `config.json`, skill secrets in `~/.cow/.env`, MCP OAuth tokens in `~/.cow/mcp_oauth.json`, static MCP keys in `mcp.json`, mailbox credentials in `./agent-mail-data/config`. All on the owner's disk, none encrypted that we found |\n| Memory | `MEMORY.md`, daily files and dream diaries as Markdown under `~/cow`, sessions in a local SQLite database, an FTS5 and vector index. The console deletes a session and its messages. No memory delete route was found in the console API, so memory is removed by editing or deleting the files |\n| Model providers | DeepSeek (the template default), Claude, OpenAI, Gemini, MiniMax, GLM, Qwen, Kimi, Doubao, ERNIE, MiMo, LinkAI, or a custom OpenAI-compatible endpoint such as Ollama, vLLM or LocalAI. The configured provider receives the conversation, memory and tool results |\n| MCP client | stdio, SSE and Streamable HTTP, OAuth or static headers, hot reload. The agent may edit `mcp.json` only in a full-access session |\n| API | `POST /v1/chat/completions` on the web console port (9899), off until `external_api_token` is set. Text only, streaming optional |\n| Telemetry | None found in the Python source. A comment in the cloud client says nothing is uploaded unless `use_linkai` and a deployment id are both set. The desktop client checks for updates |\n| Cost | The software is free. The owner pays the model provider. The README says agent mode uses substantially more tokens than chat. LinkAI's hosted prices were not read |\n| Releases in 90 days | 7 (2.1.4 on 20 July 2026 to 2.2.0 on 30 September 2026) |\n| Capabilities | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts |\n| Tags | open-source, self-hosted, local, free, no-card, llms-txt, docker, python, openai-compatible |\n| JSON | https://www.anchorterminal.com/api/v1/tools/cowagent.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-12 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 84 | 16.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 67 | 10.9 |\n| Agent ergonomics | 13% | 16.2 | 59 | 9.6 |\n| Security \u0026 auth | 14% | 17.5 | 43 | 7.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 83 | 7.3 |\n| Transparency \u0026 trust (editorial 62, provenance 27) | 7% | 8.8 | 45 | 3.9 |\n| Negative events | up to −15 | up to −15 | 2026-07-31. Issue #2998 reports that a member of a Feishu group asked the bot for local files and it sent the owner's documents into the group. This is the reporter's account and we did not reproduce it. We confirmed in the master source on 12 October 2026 that group channels accept every group, that full-access is the default and that the proposed sender gating is absent. Open and unfixed, -3. https://github.com/zhayujie/CowAgent/issues/2998 2026-07-29. Version 2.1.5 fixed a chain in which injected content led the agent to rewrite the MCP config, run arbitrary commands and take keys, and fixed the `edit` tool reaching `~/.cow/.env`. Both are described in the release notes with no advisory. Fixed and documented, -2. https://docs.cowagent.ai/releases/v2.1.5 | -5 |\n| **Total** | | | | **58.5 → C** |\n\n### Why each score\n\n- Reliability 84: Read with the local-software lines. Installs by a script and a Compose file served from cdn.link-ai.tech, a Docker image and a desktop client, with Python 3.7 to 3.13 stated in the quick start. There is no versioned package on a registry that we checked, and `pyproject.toml` describes only the CLI at version 1.0.0 (15 of 20). The Tests workflow runs pytest on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw on 12 October 2026 passed (25). 12 open issues and one open pull request, most of them feature requests. Issue #2998, a security report of 31 July, is still open (21 of 25). Dated notes for every release, with behaviour changes described inline and a setting to restore the old behaviour, but no breaking-change section, and patch-level versions carry new products such as the desktop client in 2.1.3 (8 of 15). Version 2.2.0 (15).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 67: Graded on the docs and on the interfaces an outside agent would use, the OpenAI-compatible endpoint, the CLI and the config. No OpenAPI file. The endpoint follows the chat completions shape and its additions (`conversation_id`, `tool_trace`, `cow_event`) are documented in prose (10 of 25). docs.cowagent.ai serves an llms.txt and a Markdown copy of each page (10). Each built-in tool has a page stating its purpose and uses, and the permission and MCP pages say when a mode refuses an action (13 of 20). Tool pages list parameters with types and required flags, and config tables give defaults and allowed values (10 of 15). The web channel page has curl and Python examples and documents 400, 401, 500 and 503 answers and the streaming error event (11 of 15). Release notes for every version on the docs site and on GitHub. The endpoint carries only a `/v1` prefix (13 of 15).\n- Agent ergonomics 59: `agent_max_context_tokens` caps the prompt at 64,000 by default, history is compacted on a budget, a large knowledge index injects titles only, and on-demand MCP tool retrieval exists but is off by default (18 of 25). The endpoint returns the final message, with optional streaming and a tool trace, and nothing limits or selects the output (8 of 20). Documented status codes, a structured JSON 500 with a `timeout` code, error events inside a stream, and permission denials that name the reason (14 of 20). `conversation_id` keeps a stable session and 2.2.0 persists each step so an interrupted turn resumes, with no idempotency key or retry guidance (8 of 20). One command installs and starts it with a console on localhost, and any OpenAI client library reaches the endpoint, with no SDK of its own (11 of 15).\n- Security \u0026 auth 43: The console has no password by default and listens on 127.0.0.1. `web_password` adds one shared password, and `external_api_token` is a single Bearer token with no scopes. Model and MCP keys are plain text in `config.json` and `mcp.json`, while `~/.cow/.env` is closed to the `bash`, `read`, `edit` and `send` tools, with tests for the last three. No setting limits which Telegram, Slack or Discord users may message the bot (13 of 30). Three permission modes per session, with full-access the default for source and Docker installs and workspace-write for a fresh desktop install. The source says the checks are argument-level and not a sandbox. No action asks for approval, and the `bash` blocklist covers root deletion, disk wiping and power commands only (9 of 20). `web_fetch`, vision and browser navigation validate addresses against internal targets, and the agent may edit `mcp.json` only in full-access, but no guidance on injected content was found and issue #2998 is open (6 of 15). Tool calls are shown in the console, written to the session database after each step and returned as `tool_trace`, and channel credentials are masked in debug logs, with no separate audit log (9 of 15). GitHub reports no security policy, there is no security.txt, bounty or certification, one advisory is published, and release notes credit security fixes (6 of 20).\n- Payments \u0026 pricing 60: Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with nothing to buy, so 20, 20 and 20 on the last three lines. The README names LinkAI as a seller of managed hosting for CowAgent. link-ai.tech did not answer on 12 October 2026, so that service and its prices are unread and not scored.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 83: Version 2.2.0 was tagged on 30 September 2026, 12 days before this check (30). Seven tagged releases in the 90 days to 12 October (20). The maintainer merged pull requests on 12 October, the tracker holds 12 open issues and one open pull request, and the security report in #2998 has waited ten weeks with its proposed fix unmerged (20 of 25). Not an MCP server and no SDK. The Docker image, CLI and desktop client are current (7 of 15). Tests pass on master, requirements are mostly lower bounds with no lock file, and the image is built on `python:3.10-slim-bullseye` (6 of 10).\n- Transparency \u0026 trust 45: MIT (30). cowagent.ai links no privacy policy and no terms. The docs say where the desktop client, workspace and credentials are stored and warn that backups hold keys and conversations unencrypted, and a source comment says nothing is uploaded by default. Nothing states what the model providers receive or how to erase memory (12 of 30). The rename from chatgpt-on-wechat is announced with a redirect, and release notes are dated, with no deprecation policy (8 of 20). No telemetry was found in the Python source and the cloud client loads only when two settings are present. That is stated in a source comment and not in the docs, and the installer is fetched from LinkAI's CDN (12 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (24 items): https://www.anchorterminal.com/fixes/cowagent.md (JSON https://www.anchorterminal.com/fixes/cowagent.json)\n\n### What we couldn't check\n\n- Kind. Recorded as `harness`, the closest kind the briefs define for agent software the owner runs, since there is no assistant kind. The README calls it an agent harness\n- CowAgent is a personal assistant by the category's description, with channels, memory and unasked background work. It has no built-in mail or calendar connector, so `assistant.accounts` rests on the optional Agent Mail overlay and MCP OAuth\n- Unchecked: LinkAI's hosted CowAgent, its prices, terms and privacy policy. link-ai.tech answered our robots.txt request with a connection failure twice on 12 October 2026, so the host was treated as closed\n- Unchecked: whether the bot sends the owner's files to a group as issue #2998 reports. We read the source and did not run the software\n- Unchecked: the installer script, the Compose file and the desktop client served from cdn.link-ai.tech and cowagent.ai/download, and whether they match the repository\n- Unchecked: the desktop client's source for telemetry. The search for telemetry covered the Python source\n- Unchecked: Tencent's Agent Mail service at agent.qq.com, its scopes and its terms\n- Unchecked: the Docker Hub image tags and the registration date of cowagent.ai\n- Whether a legal entity stands behind the project. None is named, and the enterprise contact is an address at simple-future.tech\n- The advisory GHSA-qwjc-xv6c-mqfx was published 16 months after the release it names as the fix. No deduction was taken because the fix predates the last 12 months\n- The star count is the 47.4k shown on the repository page on 12 October 2026\n\n### Sources\n\n- repository README: \u003chttps://github.com/zhayujie/CowAgent/blob/master/README.md\u003e (seen 2026-10-12)\n- repository page (stars, issue and pull request counts): \u003chttps://github.com/zhayujie/CowAgent\u003e (seen 2026-10-12)\n- config defaults: \u003chttps://github.com/zhayujie/CowAgent/blob/master/config.py\u003e (seen 2026-10-12)\n- config template: \u003chttps://github.com/zhayujie/CowAgent/blob/master/config-template.json\u003e (seen 2026-10-12)\n- permission policy source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py\u003e (seen 2026-10-12)\n- bash tool source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/agent/tools/bash/bash.py\u003e (seen 2026-10-12)\n- cloud client source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/common/cloud_client.py\u003e (seen 2026-10-12)\n- Docker Compose file: \u003chttps://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml\u003e (seen 2026-10-12)\n- test workflow: \u003chttps://github.com/zhayujie/CowAgent/blob/master/.github/workflows/test.yml\u003e (seen 2026-10-12)\n- test workflow runs on master: \u003chttps://github.com/zhayujie/CowAgent/actions/workflows/test.yml?query=branch%3Amaster\u003e (seen 2026-10-12)\n- open issues: \u003chttps://github.com/zhayujie/CowAgent/issues\u003e (seen 2026-10-12)\n- issue #2998: \u003chttps://github.com/zhayujie/CowAgent/issues/2998\u003e (seen 2026-10-12)\n- security overview (no policy): \u003chttps://github.com/zhayujie/CowAgent/security\u003e (seen 2026-10-12)\n- advisory GHSA-qwjc-xv6c-mqfx: \u003chttps://github.com/zhayujie/CowAgent/security/advisories/GHSA-qwjc-xv6c-mqfx\u003e (seen 2026-10-12)\n- architecture and permission docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/intro/architecture.mdx\u003e (seen 2026-10-12)\n- web console and API docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/channels/web.mdx\u003e (seen 2026-10-12)\n- MCP docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/tools/mcp.mdx\u003e (seen 2026-10-12)\n- scheduler docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/tools/scheduler.mdx\u003e (seen 2026-10-12)\n- memory docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/memory/index.mdx\u003e (seen 2026-10-12)\n- Self-Evolution docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/memory/self-evolution.mdx\u003e (seen 2026-10-12)\n- Agent Mail docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/extensions/agent-mail.mdx\u003e (seen 2026-10-12)\n- backup docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/cli/backup.mdx\u003e (seen 2026-10-12)\n- desktop client docs (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/guide/desktop.mdx\u003e (seen 2026-10-12)\n- release notes 2.2.0 (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.2.0.mdx\u003e (seen 2026-10-12)\n- release notes 2.1.5 (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.1.5.mdx\u003e (seen 2026-10-12)\n- release notes 2.1.7 (source): \u003chttps://github.com/zhayujie/CowAgent/blob/master/docs/releases/v2.1.7.mdx\u003e (seen 2026-10-12)\n- docs llms.txt: \u003chttps://docs.cowagent.ai/llms.txt\u003e (seen 2026-10-12)\n- quick start, Markdown copy: \u003chttps://docs.cowagent.ai/guide/quick-start.md\u003e (seen 2026-10-12)\n- project home page: \u003chttps://cowagent.ai/\u003e (seen 2026-10-12)\n- site map: \u003chttps://cowagent.ai/sitemap.xml\u003e (seen 2026-10-12)\n\n## Who's behind it (provenance 27/100, checked 2026-10-12)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | not found | 0/20 |\n| Domain age | cowagent.ai, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | nothing hosted, so the MIT licence stands in | 10/10 |\n| Privacy policy | nothing hosted, not scored | n/a |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nNo company or legal entity is named for CowAgent. The licence names zhayujie, and the cowagent.ai footer reads Copyright 2026 CowAgent.\n\nThe README lists sales@simple-future.tech and LinkAI (link-ai.tech) for enterprise services and managed hosting. link-ai.tech did not answer our robots.txt request on 12 October 2026, so none of its pages were read.\n\ncowagent.ai links no terms and no privacy policy. Its sitemap lists the home, download and blog pages only.\n\ncowagent.ai answers `/.well-known/security.txt` and `/llms.txt` with the home page, so neither file exists. docs.cowagent.ai serves an llms.txt.\n\nThe registration date of cowagent.ai was not looked up.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The MIT licence stands in and the check scores in full.\n\n\n**Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored.\n\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Memory is plain Markdown under `~/cow` (`MEMORY.md`, `memory/YYYY-MM-DD.md`), readable and removable by the owner\n- Three permission modes per session (read-only, workspace-write, full-access), with a global default in `agent_permission_mode`\n- The web console binds to 127.0.0.1 by default, and the cloud client loads only when `use_linkai` and a deployment id are both set\n- Seven tagged releases between 20 July and 30 September 2026, each with dated notes in the docs\n- Tests run on Python 3.11 and 3.13 for every push to master, and the 15 newest master runs we saw passed on 12 October 2026\n\n## Weaknesses\n\n- Source and Docker installs default to full-access, and no mode asks the owner before a shell command, a file send or an MCP call\n- The permission checks read arguments and are not an OS sandbox, as the source says. The `bash` blocklist covers only root deletion, disk wiping and power commands\n- Issue #2998, open since 31 July 2026, reports the bot sending the owner's local documents into a Feishu group. Its fix is not on master\n- No setting limits which Telegram, Slack or Discord users may message the bot, and those channels reply in every group\n- No SECURITY.md, security.txt, privacy policy or terms. Model keys sit in `config.json` and MCP keys in `mcp.json` as plain text\n\n## Before you call it (notes for agents)\n\n1. Set `agent_permission_mode` to `workspace-write` or `read-only` before connecting any channel. Source and Docker installs default to `full-access`\n2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner\n3. Set `web_password` before changing `web_host` to `0.0.0.0`. The password is empty by default\n4. Set `external_api_token` to enable `POST /v1/chat/completions`, and send `conversation_id` to keep one session. The `model` field does not select a model\n5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation\n\n## Connect\n\nInstall:\n\n```bash\nbash \u003c(curl -fsSL https://cdn.link-ai.tech/code/cow/run.sh) # or: curl -O https://cdn.link-ai.tech/code/cow/docker-compose.yml \u0026\u0026 docker compose up -d\n```\n\nFirst request:\n\n```bash\ncurl http://localhost:9899/v1/chat/completions -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d '{\"model\":\"cowagent\",\"conversation_id\":\"example-conversation\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}'\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| ZeroClaw | BB | 70.2 | 161 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/zeroclaw.md |\n| NanoClaw | B | 68.3 | 229 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | no | https://www.anchorterminal.com/tools/nanoclaw.md |\n| Hermes Agent | B | 67.9 | 244 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/hermes-agent.md |\n| OpenClaw | B | 67.1 | 270 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/openclaw.md |\n| IronClaw | B | 66.7 | 288 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/ironclaw.md |\n| nanobot | B | 62.4 | 446 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanobot.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- `agent_permission_mode` defaults to `full-access` for source and Docker installs. Only a first launch of the desktop client starts at `workspace-write` (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/config.py\u003e, \u003chttps://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml\u003e)\n- The permission source says the checks are argument-level and not an OS sandbox, and that `bash` gating is best effort (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py\u003e)\n- There is no per-action approval prompt. In read-only mode writes, browser clicks, scheduler changes and MCP tools whose names look like writes are refused. In the other two modes MCP tools run unasked (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/agent/permission/policy.py\u003e)\n- Self-Evolution is on in the config template and the Compose file. After 10 idle minutes it reviews the conversation, edits memory and skill files and finishes to-dos left in the chat, with a backup for undo (source: \u003chttps://docs.cowagent.ai/memory/self-evolution\u003e)\n- A summary of each day's conversations is written at 23:55 and distilled into `MEMORY.md`, which is injected into every system prompt (source: \u003chttps://docs.cowagent.ai/memory/deep-dream\u003e)\n- Issue #2998, opened on 31 July 2026 and still open on 12 October, reports that a member of a Feishu group asked the bot for local files and it sent the owner's documents to the group. The gating its author proposed (`security_enabled`) is not in the master source (source: \u003chttps://github.com/zhayujie/CowAgent/issues/2998\u003e)\n- The Telegram, Slack, Discord and Feishu channels set the group allowlist to every group, and the config has no sender allowlist for Telegram, Slack or Discord (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/channel/telegram/telegram_channel.py\u003e, \u003chttps://github.com/zhayujie/CowAgent/blob/master/config.py\u003e)\n- Version 2.1.5 of 29 July 2026 fixed a chain in which injected content led the agent to rewrite `mcp.json`, run commands and take keys, and fixed the `edit` tool reaching `~/.cow/.env`. No advisory was published for either (source: \u003chttps://docs.cowagent.ai/releases/v2.1.5\u003e)\n- One advisory is published, GHSA-qwjc-xv6c-mqfx of 28 November 2025 (moderate), code execution through the tool plugin of the 1.x line. It says 1.7.0 fixed it, a tag dated 2 August 2024, and that 2.0 and later are not affected (source: \u003chttps://github.com/zhayujie/CowAgent/security/advisories/GHSA-qwjc-xv6c-mqfx\u003e)\n- GitHub reports no security policy for the repository, and cowagent.ai answers the security.txt and llms.txt addresses with its home page (source: \u003chttps://github.com/zhayujie/CowAgent/security\u003e)\n- Mail is an optional Docker Compose overlay that installs Tencent's `agently-cli`. The mailbox credentials are stored in `./agent-mail-data/config` (source: \u003chttps://docs.cowagent.ai/extensions/agent-mail\u003e)\n- MCP OAuth tokens are kept in `~/.cow/mcp_oauth.json` and static MCP keys as plain text in `mcp.json`. Skill secrets go in `~/.cow/.env`, which the `bash` tool refuses to read (source: \u003chttps://docs.cowagent.ai/tools/mcp\u003e, \u003chttps://github.com/zhayujie/CowAgent/blob/master/agent/tools/bash/bash.py\u003e)\n- The one-line installer and the Compose file are downloaded from cdn.link-ai.tech, the domain of LinkAI, which the README names as the seller of managed hosting for CowAgent (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/README.md\u003e)\n- The project was named chatgpt-on-wechat until its rename. The Docker image and the Compose service keep that name (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/README.md\u003e, \u003chttps://github.com/zhayujie/CowAgent/blob/master/docker/docker-compose.yml\u003e)\n- The README says the agent has access to the local operating system and should be deployed only in trusted environments (source: \u003chttps://github.com/zhayujie/CowAgent/blob/master/README.md\u003e)\n\n- #9 of 20 in Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 190 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Compare\n\n- [AstrBot vs CowAgent](https://www.anchorterminal.com/compare/astrbot-vs-cowagent.md): C 58.8 vs C 58.5\n- [CowAgent vs GAIA](https://www.anchorterminal.com/compare/cowagent-vs-gaia.md): C 58.5 vs D 49.5\n- [CowAgent vs Gemini Spark](https://www.anchorterminal.com/compare/cowagent-vs-gemini-spark.md): C 58.5 vs F 24.5\n- [CowAgent vs Grok Bot](https://www.anchorterminal.com/compare/cowagent-vs-grok-bot.md): C 58.5 vs E 45.2\n- [CowAgent vs Haven](https://www.anchorterminal.com/compare/cowagent-vs-haven.md): C 58.5 vs F 22.2\n- [CowAgent vs Hermes Agent](https://www.anchorterminal.com/compare/cowagent-vs-hermes-agent.md): C 58.5 vs B 67.9\n- [CowAgent vs Instinct](https://www.anchorterminal.com/compare/cowagent-vs-instinct.md): C 58.5 vs F 11.4\n- [CowAgent vs IronClaw](https://www.anchorterminal.com/compare/cowagent-vs-ironclaw.md): C 58.5 vs B 66.7\n- [CowAgent vs Leon](https://www.anchorterminal.com/compare/cowagent-vs-leon.md): C 58.5 vs E 41\n- [CowAgent vs Lindy](https://www.anchorterminal.com/compare/cowagent-vs-lindy.md): C 58.5 vs F 32.3\n- [CowAgent vs nanobot](https://www.anchorterminal.com/compare/cowagent-vs-nanobot.md): C 58.5 vs B 62.4\n- [CowAgent vs NanoClaw](https://www.anchorterminal.com/compare/cowagent-vs-nanoclaw.md): C 58.5 vs B 68.3\n- [CowAgent vs Dots](https://www.anchorterminal.com/compare/cowagent-vs-openai-dots.md): C 58.5 vs F 28.3\n- [CowAgent vs OpenClaw](https://www.anchorterminal.com/compare/cowagent-vs-openclaw.md): C 58.5 vs B 67.1\n- [CowAgent vs PicoClaw](https://www.anchorterminal.com/compare/cowagent-vs-picoclaw.md): C 58.5 vs D 46.1\n- [CowAgent vs Poke](https://www.anchorterminal.com/compare/cowagent-vs-poke.md): C 58.5 vs F 37.6\n- [CowAgent vs QwenPaw](https://www.anchorterminal.com/compare/cowagent-vs-qwenpaw.md): C 58.5 vs B 62.2\n- [CowAgent vs ZeroClaw](https://www.anchorterminal.com/compare/cowagent-vs-zeroclaw.md): C 58.5 vs BB 70.2\n- [CowAgent vs Zo Computer](https://www.anchorterminal.com/compare/cowagent-vs-zo-computer.md): C 58.5 vs E 43.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on cowagent.ai or one of its subdomains, or the README of github.com/zhayujie/CowAgent. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"cowagent\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cowagent\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cowagent.svg\" alt=\"CowAgent on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![CowAgent on Anchor Terminal](https://www.anchorterminal.com/badges/cowagent.svg)](https://www.anchorterminal.com/tools/cowagent)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cowagent\"\u003eCowAgent on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say CowAgent is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/cowagent-dark.png\n- Light: https://www.anchorterminal.com/assets/share/cowagent-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Personal assistants", "url": "https://www.anchorterminal.com/categories/personal-assistants" }, { "name": "CowAgent", "url": "" } ], "description": "CowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.", "facts": [ "rank #591 of 986", "OAuth or key auth", "0 desk reviews" ], "h1": "CowAgent", "image": "https://www.anchorterminal.com/assets/og/tools-cowagent.png", "path": "/tools/cowagent", "published": "2026-10-01", "section": "tools", "title": "CowAgent review (2026): pricing, alternatives and grade C", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/tools/cowagent" }, "tokens": { "markdown": 8200, "slim": 1980 }, "version": 1 }