# CowAgent (slim)

> CowAgent is an open-source AI assistant that its owner runs on a computer or server. It plans tasks, runs tools and skills, keeps long-term memory in local files and answers on a web console and messaging apps.

- Full: https://www.anchorterminal.com/tools/cowagent.md (~8,200 tokens) · this version ~1,980 tokens · JSON https://www.anchorterminal.com/tools/cowagent.json · canonical https://www.anchorterminal.com/tools/cowagent
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**C · 58.5/100 · rank #591 of 986 · #9 in Personal assistants · not agent-ready · confidence medium**


Assessment: MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

## Facts

- Kind: Agent harness · vendor: zhayujie · category: Personal assistants · legal entity: not named · provenance 27/100
- Local only (HTTP): oci `zhayujie/chatgpt-on-wechat`
- Auth: OAuth or key · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Runs: On the owner's computer or server. One-line installer, Docker Compose, or a desktop client for macOS and Windows. The docs state Python 3.7 to 3.13 (https://docs.cowagent.ai/guide/quick-start)
- Acts without asking: Shell commands, file writes, file sends, browser actions, scheduled tasks and MCP calls all run without a prompt in full-access mode, the default for source and Docker installs. Self-Evolution and the daily memory summary run in the background
- Approval controls: Per-session read-only, workspace-write or full-access. No per-action approval. Skill installs are previewed and confirmed in the console, and a manual run of a scheduled task asks for confirmation
- Sandbox: None. The checks are argument-level, and the docs recommend a container for strong isolation
- Channels: Web console, Telegram, Slack, Discord, WeChat, Feishu, DingTalk, WeCom Bot, WeCom App, QQ, WeChat Customer Service, WeChat Official Account
- Accounts: No built-in mail or calendar connector. Mail through the optional Agent Mail overlay (`agently-cli`), other services through MCP servers and skills. MCP OAuth with an optional `scope` field
- Credential storage: Model and channel keys in `config.json`, skill secrets in `~/.cow/.env`, MCP OAuth tokens in `~/.cow/mcp_oauth.json`, static MCP keys in `mcp.json`, mailbox credentials in `./agent-mail-data/config`. All on the owner's disk, none encrypted that we found
- Memory: `MEMORY.md`, daily files and dream diaries as Markdown under `~/cow`, sessions in a local SQLite database, an FTS5 and vector index. The console deletes a session and its messages. No memory delete route was found in the console API, so memory is removed by editing or deleting the files
- Model providers: DeepSeek (the template default), Claude, OpenAI, Gemini, MiniMax, GLM, Qwen, Kimi, Doubao, ERNIE, MiMo, LinkAI, or a custom OpenAI-compatible endpoint such as Ollama, vLLM or LocalAI. The configured provider receives the conversation, memory and tool results
- MCP client: stdio, SSE and Streamable HTTP, OAuth or static headers, hot reload. The agent may edit `mcp.json` only in a full-access session
- API: `POST /v1/chat/completions` on the web console port (9899), off until `external_api_token` is set. Text only, streaming optional
- Telemetry: None found in the Python source. A comment in the cloud client says nothing is uploaded unless `use_linkai` and a deployment id are both set. The desktop client checks for updates
- Cost: The software is free. The owner pays the model provider. The README says agent mode uses substantially more tokens than chat. LinkAI's hosted prices were not read
- Releases in 90 days: 7 (2.1.4 on 20 July 2026 to 2.2.0 on 30 September 2026)

- Scores: Reliability 84, Performance pending, Schema & documentation 67, Agent ergonomics 59, Security & auth 43, Payments & pricing 60, Task success pending, Maintenance & community 83, Transparency & trust 45 · negative events -5 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines. · Schema & documentation, Graded on the docs and on the interfaces an outside agent would use, the OpenAI-compatible endpoint, the CLI and the config. · Agent ergonomics, `agent_max_context_tokens` caps the prompt at 64,000 by default, history is compacted on a budget, a large knowledge index injects titles on… · Security & auth, The console has no password by default and listens on 127.0.0.1. `web_password` adds one shared password, and `external_api_token` is a sing… · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, Version 2.2.0 was tagged on 30 September 2026, 12 days before this check (30). · Transparency & trust, MIT (30).
- Sources: 30, open questions: 11, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts
- JSON: https://www.anchorterminal.com/api/v1/tools/cowagent.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/cowagent.svg` or a link to https://www.anchorterminal.com/tools/cowagent from a page on cowagent.ai or one of its subdomains, or the README of github.com/zhayujie/CowAgent, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `agent_permission_mode` to `workspace-write` or `read-only` before connecting any channel. Source and Docker installs default to `full-access`
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set `web_password` before changing `web_host` to `0.0.0.0`. The password is empty by default
4. Set `external_api_token` to enable `POST /v1/chat/completions`, and send `conversation_id` to keep one session. The `model` field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

## Connect

```bash
bash <(curl -fsSL https://cdn.link-ai.tech/code/cow/run.sh)   # or: curl -O https://cdn.link-ai.tech/code/cow/docker-compose.yml && docker compose up -d
```

```bash
curl http://localhost:9899/v1/chat/completions -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"model":"cowagent","conversation_id":"example-conversation","messages":[{"role":"user","content":"Hello"}]}'
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)