{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/zeroclaw.json", "name": "ZeroClaw", "score": 70.2, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "zeroclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanoclaw.json", "name": "NanoClaw", "score": 68.3, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "slug": "nanoclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/hermes-agent.json", "name": "Hermes Agent", "score": 67.9, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "hermes-agent" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/openclaw.json", "name": "OpenClaw", "score": 67.1, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "openclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/ironclaw.json", "name": "IronClaw", "score": 66.7, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "ironclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanobot.json", "name": "nanobot", "score": 62.4, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "nanobot" } ], "tool": { "slug": "gaia", "name": "GAIA", "vendor": "The Experience Company", "vendorUrl": "https://heygaia.io", "kind": "platform", "category": "personal-assistants", "summary": "GAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting.", "url": "https://www.anchorterminal.com/tools/gaia", "markdownUrl": "https://www.anchorterminal.com/tools/gaia.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gaia.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gaia.json", "repo": "https://github.com/theexperiencecompany/gaia", "license": "PolyForm-Noncommercial-1.0.0", "transports": [], "packages": [ { "registry": "npm", "name": "@heygaia/cli" } ], "auth": "oauth", "authNotes": "People sign in to the hosted app in a browser, and the backend uses WorkOS for sign-in. Integrations connect by OAuth on the provider's consent screen, through Composio for built-in ones, and Gmail asks for the `gmail.modify` scope. Custom MCP servers take no auth, a bearer token or OAuth 2.1 with PKCE and dynamic client registration, with tokens Fernet-encrypted in PostgreSQL. Bot users link a chat identity with `/auth`. No API key for outside callers was found (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py; https://docs.heygaia.io/guides/adding-mcp-integrations).", "pricing": "paid", "pricingNotes": "Pro is $30 a month on the pricing page, the only plan shown there, and its FAQ says GAIA is a paid product. The README and docs also describe a Free plan with daily caps and an Enterprise plan by contact, so whether a new account can use the hosted service without paying was not established. Payments run through Dodo Payments. Self-hosting is free for noncommercial use, plus model usage and a WorkOS account (https://heygaia.io/pricing; https://docs.heygaia.io/guides/usage-subscription; checked 2026-10-12).", "priceSummary": "$30 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the backend source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 308, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.heygaia.io", "llmsTxt": "https://docs.heygaia.io/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "hosted", "source-available", "noncommercial-licence", "self-hosted", "messaging", "imessage", "whatsapp", "telegram", "slack", "discord", "gmail", "mcp-client", "status-page", "llms-txt", "approval-off-by-default" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 49.5, "grade": "D", "agentReady": false, "rank": 813, "ranked": true, "rankOf": 986, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 78, "payments": 20, "reliability": 67, "schema": 51, "security": 54, "transparency": 60 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 67, "points": 13.4, "reason": "Graded as the hosted service at heygaia.io, which the README recommends, with the hosted lines. A BetterStack status page lists the backend, the web app and four bots with a year of history (20). It lists no incident in the 90 days to 12 October 2026. The last entries are a Discord bot outage of 6 to 9 May and maintenance of 16 to 19 April, and we did not open the previous-incidents list (25). The docs give daily and monthly caps for Free and Pro, while the 26 August notes say Pro runs on cost-based limits with no figure (10). The docs say a limit is reported in the conversation with its reset time, and no retry guidance was found (5). An SLA is named only as part of Enterprise, with no terms published (0). The web app and bots carry no beta label, the desktop and mobile apps do, and every component is below 1.0 (7)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 51, "points": 8.29, "reason": "GAIA has no public API, so this is read on what a person or an agent can learn about the product from its docs and source. In production the backend turns off its OpenAPI document, and the generated schema sits only in the repository (5 of 25). llms.txt on heygaia.io and docs.heygaia.io, with Markdown copies of every docs page (10). The guides say what each feature is for, and ARCHITECTURE.md maps every service and file, but no page lists which actions run without approval (12 of 20). The custom MCP form and the workflow builder have typed fields, and tools are otherwise chosen by the assistant (6 of 15). Guides carry examples and no page documents errors (7 of 15). Dated release notes and a tag for each component, though the notes stop at 26 August while tags exist for 13 and 14 September (11 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 54, "points": 8.78, "reason": "Read on what the owner has to supply and manage. A comms agent delegates to an executor and to one subagent per integration, each scoped to its own tools, and tools are found by retrieval instead of loading every definition (18 of 25). Usage caps and notification settings exist, with no control over reply length found (8 of 20). Limit messages name the limit and its reset time, and other errors are not documented (8 of 20). An approval ledger records decisions, declined calls are remembered, and MCP `destructiveHint` is honoured as an escalation only (12 of 20). Connecting an account starts jobs with no setup and there is a CLI, but there is no SDK and the default approval mode runs everything (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 54, "points": 9.45, "reason": "Sign-in runs through WorkOS and integrations connect by OAuth on the provider's consent screen, with custom MCP tokens Fernet-encrypted in PostgreSQL and disconnect revoking access. Gmail takes the single broad `gmail.modify` scope and Composio, a third party, holds the built-in connections (22 of 30). Three approval modes, per-tool overrides and forced approval for adding an MCP server, pairing a device or disconnecting an account, but the source default is `always_allow`, commented as nothing gated (9 of 20). In Auto mode the judge trusts only the user's quoted words, fences untrusted text with a random marker and fails towards asking. That protection is off in the default mode and no guidance for owners was found (9 of 15). The chat shows each tool call and approvals are kept in a ledger, while audit logs are listed for Enterprise only (7 of 15). SECURITY.md promises a reply in 48 hours and coordinated disclosure, and the repository runs gitleaks and semgrep. No security.txt, bounty, certification or published advisory was found (7 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "Scored on the hosted service. No payment protocol (0). The pricing page shows one plan, Pro at $30 a month, with usage limits it does not state (10). A no-card free tier takes half marks, because the README and docs describe a Free plan while the pricing page says GAIA is a paid product, and we did not sign up to see which holds (10). Access needs a person to sign up in a browser, and self-hosting needs a WorkOS account and model keys (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "reason": "The last tagged releases are `api-v0.24.0`, `web-v0.25.0` and `desktop-v0.7.1` of 14 September 2026, 28 days before this check (30). Three sets of tags in 90 days, on 26 August, 13 September and 14 September (20). 91 commits on master in the 30 days to 12 October. The 40 open items are mostly the team's own pull requests, the few open bug reports each have one comment, and the site names Discord, WhatsApp and email support with a 24 to 48 hour reply claim we did not test (15 of 25). No SDK and no MCP registry entry. `@heygaia/cli` 0.6.0 on npm matches the `cli-v0.6.0` tag (8 of 15). Dependabot and lockfiles are in place, but Quality Checks, Release Please and Deploy Web failed on the latest push to master on 12 October (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "note": "editorial 50, provenance 70", "reason": "The full source is public under PolyForm Noncommercial 1.0.0, which is not an OSI licence and bars business use without an enterprise licence (20 of 30). The privacy policy of 7 August 2026 gives retention periods, Google Limited Use terms and a 72-hour breach notice, but it conflicts with the pricing page FAQ on sharing with model providers, allows submitted content to be used to improve the service, and gives a contact address on another domain. No DPA was found (14 of 30). The terms promise 30 days' notice before the service or a paid feature is discontinued, and no deprecation policy for single integrations or tools was found (10 of 20). The policy names categories of processor and no company or data location. The source and docs name OpenRouter, Google, Composio, WorkOS, E2B, Dodo Payments, PostHog and Sentry as integrations (6 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read on what the owner has to supply and manage. A comms agent delegates to an executor and to one subagent per integration, each scoped to its own tools, and tools are found by retrieval instead of loading every definition (18 of 25). Usage caps and notification settings exist, with no control over reply length found (8 of 20). Limit messages name the limit and its reset time, and other errors are not documented (8 of 20). An approval ledger records decisions, declined calls are remembered, and MCP `destructiveHint` is honoured as an escalation only (12 of 20). Connecting an account starts jobs with no setup and there is a CLI, but there is no SDK and the default approval mode runs everything (8 of 15).", "maintenance": "The last tagged releases are `api-v0.24.0`, `web-v0.25.0` and `desktop-v0.7.1` of 14 September 2026, 28 days before this check (30). Three sets of tags in 90 days, on 26 August, 13 September and 14 September (20). 91 commits on master in the 30 days to 12 October. The 40 open items are mostly the team's own pull requests, the few open bug reports each have one comment, and the site names Discord, WhatsApp and email support with a 24 to 48 hour reply claim we did not test (15 of 25). No SDK and no MCP registry entry. `@heygaia/cli` 0.6.0 on npm matches the `cli-v0.6.0` tag (8 of 15). Dependabot and lockfiles are in place, but Quality Checks, Release Please and Deploy Web failed on the latest push to master on 12 October (5 of 10).", "payments": "Scored on the hosted service. No payment protocol (0). The pricing page shows one plan, Pro at $30 a month, with usage limits it does not state (10). A no-card free tier takes half marks, because the README and docs describe a Free plan while the pricing page says GAIA is a paid product, and we did not sign up to see which holds (10). Access needs a person to sign up in a browser, and self-hosting needs a WorkOS account and model keys (0).", "reliability": "Graded as the hosted service at heygaia.io, which the README recommends, with the hosted lines. A BetterStack status page lists the backend, the web app and four bots with a year of history (20). It lists no incident in the 90 days to 12 October 2026. The last entries are a Discord bot outage of 6 to 9 May and maintenance of 16 to 19 April, and we did not open the previous-incidents list (25). The docs give daily and monthly caps for Free and Pro, while the 26 August notes say Pro runs on cost-based limits with no figure (10). The docs say a limit is reported in the conversation with its reset time, and no retry guidance was found (5). An SLA is named only as part of Enterprise, with no terms published (0). The web app and bots carry no beta label, the desktop and mobile apps do, and every component is below 1.0 (7).", "schema": "GAIA has no public API, so this is read on what a person or an agent can learn about the product from its docs and source. In production the backend turns off its OpenAPI document, and the generated schema sits only in the repository (5 of 25). llms.txt on heygaia.io and docs.heygaia.io, with Markdown copies of every docs page (10). The guides say what each feature is for, and ARCHITECTURE.md maps every service and file, but no page lists which actions run without approval (12 of 20). The custom MCP form and the workflow builder have typed fields, and tools are otherwise chosen by the assistant (6 of 15). Guides carry examples and no page documents errors (7 of 15). Dated release notes and a tag for each component, though the notes stop at 26 August while tags exist for 13 and 14 September (11 of 15).", "security": "Sign-in runs through WorkOS and integrations connect by OAuth on the provider's consent screen, with custom MCP tokens Fernet-encrypted in PostgreSQL and disconnect revoking access. Gmail takes the single broad `gmail.modify` scope and Composio, a third party, holds the built-in connections (22 of 30). Three approval modes, per-tool overrides and forced approval for adding an MCP server, pairing a device or disconnecting an account, but the source default is `always_allow`, commented as nothing gated (9 of 20). In Auto mode the judge trusts only the user's quoted words, fences untrusted text with a random marker and fails towards asking. That protection is off in the default mode and no guidance for owners was found (9 of 15). The chat shows each tool call and approvals are kept in a ledger, while audit logs are listed for Enterprise only (7 of 15). SECURITY.md promises a reply in 48 hours and coordinated disclosure, and the repository runs gitleaks and semgrep. No security.txt, bounty, certification or published advisory was found (7 of 20).", "transparency": "The full source is public under PolyForm Noncommercial 1.0.0, which is not an OSI licence and bars business use without an enterprise licence (20 of 30). The privacy policy of 7 August 2026 gives retention periods, Google Limited Use terms and a 72-hour breach notice, but it conflicts with the pricing page FAQ on sharing with model providers, allows submitted content to be used to improve the service, and gives a contact address on another domain. No DPA was found (14 of 30). The terms promise 30 days' notice before the service or a paid feature is discontinued, and no deprecation policy for single integrations or tools was found (10 of 20). The policy names categories of processor and no company or data location. The source and docs name OpenRouter, Google, Composio, WorkOS, E2B, Dodo Payments, PostHog and Sentry as integrations (6 of 20)." }, "sources": [ { "what": "robots.txt, read first", "url": "https://heygaia.io/robots.txt", "seen": "2026-10-12" }, { "what": "home page", "url": "https://heygaia.io/", "seen": "2026-10-12" }, { "what": "pricing page and its FAQ", "url": "https://heygaia.io/pricing", "seen": "2026-10-12" }, { "what": "Terms of Service, effective 14 August 2026", "url": "https://heygaia.io/terms", "seen": "2026-10-12" }, { "what": "privacy policy, effective 7 August 2026", "url": "https://heygaia.io/privacy", "seen": "2026-10-12" }, { "what": "security.txt, returned 404", "url": "https://heygaia.io/.well-known/security.txt", "seen": "2026-10-12" }, { "what": "status page", "url": "https://status.heygaia.io", "seen": "2026-10-12" }, { "what": "docs llms.txt", "url": "https://docs.heygaia.io/llms.txt", "seen": "2026-10-12" }, { "what": "repository README, licence and tags, from a shallow clone at commit 3726cec", "url": "https://github.com/theexperiencecompany/gaia", "seen": "2026-10-12" }, { "what": "security policy", "url": "https://github.com/theexperiencecompany/gaia/blob/master/.github/SECURITY.md", "seen": "2026-10-12" }, { "what": "approval default and modes", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py", "seen": "2026-10-12" }, { "what": "approval policy and forced-ask tools", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/policy.py", "seen": "2026-10-12" }, { "what": "tool risk classification", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/classification.py", "seen": "2026-10-12" }, { "what": "Gmail gated tools", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil_destructive_tools.py", "seen": "2026-10-12" }, { "what": "integration definitions and scopes", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py", "seen": "2026-10-12" }, { "what": "MCP token storage", "url": "https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/mcp/mcp_token_store.py", "seen": "2026-10-12" }, { "what": "architecture document, memory and model layers", "url": "https://github.com/theexperiencecompany/gaia/blob/master/ARCHITECTURE.md", "seen": "2026-10-12" }, { "what": "memory guide, read from the docs source", "url": "https://docs.heygaia.io/guides/memory", "seen": "2026-10-12" }, { "what": "usage and subscription guide, read from the docs source", "url": "https://docs.heygaia.io/guides/usage-subscription", "seen": "2026-10-12" }, { "what": "self-hosting overview and environment variables, read from the docs source", "url": "https://docs.heygaia.io/self-hosting/overview", "seen": "2026-10-12" }, { "what": "release notes, read from the docs source", "url": "https://docs.heygaia.io/release-notes", "seen": "2026-10-12" }, { "what": "repository metadata, stars and open items (GitHub API)", "url": "https://api.github.com/repos/theexperiencecompany/gaia", "seen": "2026-10-12" }, { "what": "published security advisories, none (GitHub API)", "url": "https://github.com/theexperiencecompany/gaia/security/advisories", "seen": "2026-10-12" }, { "what": "workflow runs on master (GitHub API)", "url": "https://api.github.com/repos/theexperiencecompany/gaia/actions/runs?branch=master", "seen": "2026-10-12" }, { "what": "CLI package, version 0.6.0", "url": "https://registry.npmjs.org/@heygaia%2Fcli/latest", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is `platform`, the kind the brief gives a web, desktop or phone app, because the hosted assistant has no public API. It was graded as a hosted service with `metrics.kind` remote, since the README recommends the cloud and prices are published for it. The self-hosted route is recorded as facts and not scored.", "The default approval mode was read from source at `api-v0.24.0` and master. Whether the hosted service sets another default for new accounts was not checked, because we did not create an account.", "Whether a new hosted account can still use a Free plan. The README and docs say yes and the pricing page says GAIA is a paid product.", "The Terms of Service forbid using automated systems, including robots, spiders or data mining tools, to access the Service. Recorded as a fact with no deduction. It matters before any probe is run.", "unchecked: the status page's previous-incidents list, so the 90-day record rests on the main status page.", "unchecked: the domain registration date for heygaia.io.", "unchecked: which companies process data for the hosted service and where. The privacy policy names none, and the names here come from the source and self-hosting docs.", "unchecked: how account deletion works in the app. The privacy policy routes deletion requests through email, and it gives a heygaia.so address.", "unchecked: reply times on Discord, WhatsApp and email support.", "The docs guides were read from the repository's docs folder, not from docs.heygaia.io pages. Only llms.txt and robots.txt were fetched from that host." ] }, "negative": -5, "negativeNotes": [ "-3. The release notes of 26 August 2026 say GAIA pauses and asks before a tool that deletes, sends or overwrites, the privacy policy (7 August 2026) says destructive actions require explicit approval, and the pricing page says anything outward-facing waits for the owner's OK. The source at `api-v0.24.0` (14 September 2026) and on master sets the default mode to `always_allow`, commented as nothing gated until flipped after launch. Read from source, not from a live account. https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py", "-2. The pricing page FAQ, read on 12 October 2026, says GAIA never shares data with model providers. Section 3.1 of the privacy policy says content, files and data from connected accounts are shared with third-party AI model providers. https://heygaia.io/pricing and https://heygaia.io/privacy" ], "verdict": "GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.", "bestFor": "It suits one person who wants mail triage, meeting briefs, todos and scheduled workflows from one assistant reachable on WhatsApp, Telegram, Slack, Discord or iMessage, and who wants to read the source.", "strengths": [ "The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.", "Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.", "Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control.", "A BetterStack status page covers the API, web app and four bots, and lists no incident in the 90 days to 12 October 2026.", "Three sets of tagged releases in the 90 days to 12 October 2026, the latest on 14 September, with 91 commits on master in the last 30 days." ], "weaknesses": [ "The default approval mode in the source is `always_allow`, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval.", "The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.", "The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product.", "Gmail connects with the `gmail.modify` scope, and built-in integrations run through Composio, so a third party holds those OAuth connections.", "No security.txt, bug bounty, certification, subprocessor list or DPA was found, and self-hosting needs a WorkOS account and five data services.", "The Terms of Service forbid automated systems accessing the Service. Recorded as a fact, and it matters before any probe is run." ], "agentNotes": [ "Set Settings \u003e Approvals to Always ask or Auto before connecting mail. The default in the source runs every action, including send and delete, without asking.", "Expect no public API on the hosted service. The backend turns off its OpenAPI document in production, so reach GAIA through its apps, bots or CLI.", "Check the plan before relying on the hosted service. The README and docs describe a Free plan, and the pricing page says GAIA is a paid product.", "For self-hosting, prepare Docker, Node.js 20, a WorkOS account and a model key first, and confirm the use is noncommercial under the licence.", "Add outside tools as MCP servers by URL on the Integrations page. GAIA asks before adding a server in every approval mode." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49.5 } ], "editorialScores": { "ergonomics": 54, "maintenance": 78, "payments": 20, "reliability": 67, "schema": 51, "security": 54, "transparency": 50 }, "provenanceScore": 70 }, "connect": { "install": "npm install -g @heygaia/cli \u0026\u0026 gaia init # choose Self-Host (Docker), then open http://localhost:3000" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/gaia" }, "notable": [ "The default approval mode is `always_allow`. The source comment reads that the default stays `always_allow` (HIL off, nothing gated) until it is flipped after launch. Read at tag `api-v0.24.0` and on master of 12 October 2026 (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py)", "The release notes of 26 August 2026 say GAIA now pauses and asks before a tool that deletes, sends or overwrites, and the privacy policy says certain destructive actions require explicit approval. Neither states the default (https://docs.heygaia.io/release-notes; https://heygaia.io/privacy)", "The pricing page FAQ says GAIA never shares data with model providers. Section 3.1 of the privacy policy, effective 7 August 2026, says content is shared with third-party AI model providers (https://heygaia.io/pricing; https://heygaia.io/privacy)", "The licence changed from PolyForm Strict to PolyForm Noncommercial 1.0.0 in the release of 26 August 2026. GitHub reports the licence as Other (https://docs.heygaia.io/release-notes; https://github.com/theexperiencecompany/gaia/blob/master/LICENSE.md)", "The privacy policy says content submitted to the Service may be used to improve services and products, and that content from connected accounts is not (https://heygaia.io/privacy)", "The Terms of Service, effective 14 August 2026, name The Experience Company, Inc., a Delaware corporation, forbid automated systems accessing the Service, and promise 30 days' notice before the service or a paid feature is discontinued (https://heygaia.io/terms)", "Self-hosting lists `WORKOS_API_KEY` as always required for sign-in. A pull request adding local auth for self-hosting (#1091) was open on 12 October 2026 (https://docs.heygaia.io/configuration/environment-variables; https://github.com/theexperiencecompany/gaia/pull/1091)", "In production the backend sets `openapi_url`, `docs_url` and `redoc_url` to none, so the hosted API publishes no contract (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/core/app_factory.py)", "In Auto mode a judge model decides from the user's own words only, must quote them, and fails towards asking. It calls `typesafe/jev-1.13` through OpenRouter (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/intent.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil.py)", "The status page lists maintenance from 16 to 19 April 2026 and a Discord bot outage from 6 to 9 May 2026, and shows 99.923 per cent uptime for the backend (https://status.heygaia.io)", "On 12 October 2026 the Quality Checks, Release Please and Deploy Web workflows failed on the latest push to master, read from the GitHub API (https://api.github.com/repos/theexperiencecompany/gaia/actions/runs?branch=master)", "The docs give Free and Pro daily caps, such as 200 and 3,000 chat messages a day, and say yearly billing saves 25 per cent. The README says yearly billing gives two months free (https://docs.heygaia.io/guides/usage-subscription; https://github.com/theexperiencecompany/gaia)" ], "area": "frameworks", "details": [ { "label": "Where it runs", "value": "Hosted at heygaia.io, which the README recommends, or self-hosted with Docker through `@heygaia/cli` (web, FastAPI backend, PostgreSQL, MongoDB, Redis, ChromaDB, RabbitMQ and JuiceFS). Self-hosting is for noncommercial use and business use needs an enterprise licence (https://github.com/theexperiencecompany/gaia; https://docs.heygaia.io/self-hosting/overview)" }, { "label": "Channels", "value": "Web, desktop app (beta) and mobile app (beta), plus iMessage (Pro plan), WhatsApp, Telegram, Slack and Discord bots on one account, and voice calls (https://github.com/theexperiencecompany/gaia)" }, { "label": "Acts without asking", "value": "Connecting Gmail or Calendar starts scheduled jobs with no setup. The README says the daily inbox job saves reply drafts and never sends. Approval modes are Allow always, Always ask and Auto, with per-tool overrides. The source default is `always_allow` (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/web/src/features/settings/components/HilApprovalMode.tsx)" }, { "label": "Gated actions", "value": "In Always ask and Auto, a curated list per integration is gated. For Gmail it is send, send draft, reply, forward, delete message or thread, batch delete, and removing a label or filter. Tools from custom MCP servers are classed by a model once, and a server's `destructiveHint` can add a gate but not remove one (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil_destructive_tools.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/classification.py)" }, { "label": "Accounts and credentials", "value": "40 integration definitions in the source and a claim of 50 or more on the site. Built-in ones such as Gmail connect by OAuth through Composio, and Gmail asks for `gmail.modify`. Custom MCP server tokens are Fernet-encrypted in PostgreSQL. Disconnecting revokes access, per the docs (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/mcp/mcp_token_store.py)" }, { "label": "Memory", "value": "Facts, a daily journal, four documents (`user.md`, `memory.md`, `people.md`, `agenda.md`) and a graph, learned from conversations without being asked. Stored in PostgreSQL, with ChromaDB for retrieval and Markdown copies on JuiceFS. Each item can be edited or deleted and Clear all removes everything. The README lists 50 saved memories on Free (https://docs.heygaia.io/guides/memory; https://github.com/theexperiencecompany/gaia/blob/master/ARCHITECTURE.md)" }, { "label": "Model providers", "value": "The hosted service picks the models. The privacy policy says message content, files and data from connected accounts are shared with third-party model providers, which it does not name. The source calls models through OpenRouter and Google Gemini, and the 26 August 2026 notes name DeepSeek V4 Flash as the default (https://heygaia.io/privacy; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/agents/llm/client.py)" }, { "label": "Price", "value": "Pro $30 a month on the pricing page. The README adds Free at $0 and Enterprise by contact, while the pricing page FAQ says GAIA is a paid product. Self-hosting is free for noncommercial use, plus model usage (https://heygaia.io/pricing; https://github.com/theexperiencecompany/gaia)" }, { "label": "Advisories", "value": "None published on the repository on 12 October 2026. SECURITY.md asks for reports by email and promises a reply within 48 hours (https://github.com/theexperiencecompany/gaia/security/advisories; https://github.com/theexperiencecompany/gaia/blob/master/.github/SECURITY.md)" } ], "unitPrices": [ { "item": "Pro", "unit": "month", "usd": 30, "note": "billed monthly, with usage limits the pricing page does not state" } ], "provenance": { "legalEntity": "The Experience Company, Inc.", "domain": "heygaia.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://heygaia.io/terms", "privacy": "https://heygaia.io/privacy", "statusPage": "https://status.heygaia.io", "changelog": "https://docs.heygaia.io/release-notes", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The Terms of Service (effective 14 August 2026) name The Experience Company, Inc., a Delaware corporation. Neither the terms nor the privacy policy gives a postal address.", "The privacy policy (effective 7 August 2026) gives support@heygaia.so as its contact, a different domain from heygaia.io, where the README's security and contact addresses sit.", "heygaia.io/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md gives an email address for reports.", "The status page lists api.heygaia.io as the backend. We sent nothing to that host.", "heygaia.io's robots.txt allows every path and names ClaudeBot, Claude-Web and anthropic-ai with Allow. docs.heygaia.io carries Content-Signal ai-input=yes. status.heygaia.io returned an empty robots.txt.", "The domain's registration date was not looked up." ], "score": 70, "checks": [ { "check": "Legal entity named", "value": "The Experience Company, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "heygaia.io, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "heygaia.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.heygaia.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://heygaia.io/terms", "state": "read", "readAt": "2026-10-12", "statedDate": "2026-08-14", "words": 3161, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective Date: August 14, 2026", "says": "Last updated 2026-08-14" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement is governed by the laws of the State of Delaware, United States, without regard to its conflict of law principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "COMPANY'S TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID TO COMPANY FOR THE SERVICE DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM AND (B) ONE HUNDRED UNITED STATES DOLLARS (USD $100).", "says": "Capped at the greater of USD $100 and the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Company may throttle, suspend, or reduce access where usage materially exceeds normal individual use or is inconsistent with your plan." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Company reserves the right to modify this Agreement at any time by posting revised terms on the Service.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "IF YOU DO NOT AGREE TO THESE TERMS, YOU MAY NOT ACCESS OR USE THE SERVICE." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Using automated systems, including robots, spiders, or data mining tools, to access or collect information from the Service;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "A third-party provider may change or withdraw access at any time, which may remove functionality from the Service without notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Either party may terminate this Agreement at any time with or without cause." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "SECTION 18 CONTAINS A BINDING ARBITRATION AGREEMENT AND A CLASS ACTION WAIVER." } ], "notes": [ { "date": "2026-10-08", "text": "The approval step for actions classed as destructive is on a best-efforts basis and is not guaranteed to catch every consequential action.", "quote": "This safeguard is provided on a best-efforts basis and is not guaranteed to catch every consequential action;" }, { "date": "2026-10-08", "text": "Free plans of the hosted service are for personal, non-commercial use only.", "quote": "Hosted Service, free plans: Personal, non-commercial use only;" }, { "date": "2026-10-08", "text": "Fees can change on 30 days' prior written notice, with the new price applying from the next renewal.", "quote": "Company reserves the right to change fees upon thirty (30) days' prior written notice. Price changes take effect at your next renewal, and you may cancel before then;" } ] }, { "kind": "privacy", "url": "https://heygaia.io/privacy", "state": "read", "readAt": "2026-10-12", "statedDate": "2026-08-07", "words": 2774, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective Date: August 7, 2026", "says": "Last updated 2026-08-07" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We collect several categories of personal information about you through various means:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Usage data: Typically retained for up to 24 months for analytics and improvement purposes;", "says": "Names a period of 24 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "To generate responses, we share content you submit with third-party AI model providers who process it on our behalf." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell, rent, or lease your personal information to third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Right to know what personal information is collected and how it is used;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Standard contractual clauses approved by relevant data protection authorities;", "says": "Relies on standard contractual clauses" } ], "notes": [ { "date": "2026-10-08", "text": "Content submitted to the service may be used to improve services and products, while content from connected third-party integrations is not used for that.", "quote": "We may use content you submit to the Service to improve our services and products. We do not use content from your connected third-party integrations (including emails, calendar events, contacts, and other data retrieved from accounts you connect) to improve our services." }, { "date": "2026-10-08", "text": "People at the vendor do not read Google user data except with consent for specific messages, for security or legal need, or once it is aggregated and anonymised.", "quote": "We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized for internal operations;" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gaia.json", "live": { "slug": "gaia", "vendorStatus": { "page": "https://status.heygaia.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-12T17:28:08.466725732Z" }, "updatedAt": "2026-10-12T17:28:08.466725732Z" } }, "verify": { "accepts": "a page on heygaia.io or one of its subdomains, or the README of github.com/theexperiencecompany/gaia", "badgeUrl": "https://www.anchorterminal.com/badges/gaia.svg", "body": { "slug": "gaia", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/gaia", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/gaia\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/gaia.svg\" alt=\"GAIA on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![GAIA on Anchor Terminal](https://www.anchorterminal.com/badges/gaia.svg)](https://www.anchorterminal.com/tools/gaia)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/gaia\"\u003eGAIA on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/gaia", "json": "https://www.anchorterminal.com/tools/gaia.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/gaia.md", "slim": "https://www.anchorterminal.com/tools/gaia.min.md" }, "markdown": "## Overview\n\n**Grade D · 49.5/100 · rank #813 of 986 · #10 in Personal assistants · not agent-ready · confidence medium**\n\n\n## Assessment\n\nGAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | The Experience Company (https://heygaia.io) |\n| Kind | Platform |\n| Category | Personal assistants (https://www.anchorterminal.com/categories/personal-assistants) |\n| Auth | OAuth · People sign in to the hosted app in a browser, and the backend uses WorkOS for sign-in. Integrations connect by OAuth on the provider's consent screen, through Composio for built-in ones, and Gmail asks for the `gmail.modify` scope. Custom MCP servers take no auth, a bearer token or OAuth 2.1 with PKCE and dynamic client registration, with tokens Fernet-encrypted in PostgreSQL. Bot users link a chat identity with `/auth`. No API key for outside callers was found (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py; https://docs.heygaia.io/guides/adding-mcp-integrations). |\n| Pricing | Paid ($30 / mo) · Pro is $30 a month on the pricing page, the only plan shown there, and its FAQ says GAIA is a paid product. The README and docs also describe a Free plan with daily caps and an Enterprise plan by contact, so whether a new account can use the hosted service without paying was not established. Payments run through Dodo Payments. Self-hosting is free for noncommercial use, plus model usage and a WorkOS account (https://heygaia.io/pricing; https://docs.heygaia.io/guides/usage-subscription; checked 2026-10-12). |\n| x402 | No · No x402, MPP or L402 in the docs or the backend source (checked 2026-10-12). |\n| Licence | PolyForm-Noncommercial-1.0.0 |\n| Packages | npm: `@heygaia/cli` |\n| Source | https://github.com/theexperiencecompany/gaia |\n| Docs | https://docs.heygaia.io |\n| llms.txt | https://docs.heygaia.io/llms.txt |\n| Last release | 2026-09-14 |\n| GitHub stars | 308 (as of 2026-10-12) |\n| Where it runs | Hosted at heygaia.io, which the README recommends, or self-hosted with Docker through `@heygaia/cli` (web, FastAPI backend, PostgreSQL, MongoDB, Redis, ChromaDB, RabbitMQ and JuiceFS). Self-hosting is for noncommercial use and business use needs an enterprise licence (https://github.com/theexperiencecompany/gaia; https://docs.heygaia.io/self-hosting/overview) |\n| Channels | Web, desktop app (beta) and mobile app (beta), plus iMessage (Pro plan), WhatsApp, Telegram, Slack and Discord bots on one account, and voice calls (https://github.com/theexperiencecompany/gaia) |\n| Acts without asking | Connecting Gmail or Calendar starts scheduled jobs with no setup. The README says the daily inbox job saves reply drafts and never sends. Approval modes are Allow always, Always ask and Auto, with per-tool overrides. The source default is `always_allow` (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/web/src/features/settings/components/HilApprovalMode.tsx) |\n| Gated actions | In Always ask and Auto, a curated list per integration is gated. For Gmail it is send, send draft, reply, forward, delete message or thread, batch delete, and removing a label or filter. Tools from custom MCP servers are classed by a model once, and a server's `destructiveHint` can add a gate but not remove one (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil_destructive_tools.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/classification.py) |\n| Accounts and credentials | 40 integration definitions in the source and a claim of 50 or more on the site. Built-in ones such as Gmail connect by OAuth through Composio, and Gmail asks for `gmail.modify`. Custom MCP server tokens are Fernet-encrypted in PostgreSQL. Disconnecting revokes access, per the docs (https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/mcp/mcp_token_store.py) |\n| Memory | Facts, a daily journal, four documents (`user.md`, `memory.md`, `people.md`, `agenda.md`) and a graph, learned from conversations without being asked. Stored in PostgreSQL, with ChromaDB for retrieval and Markdown copies on JuiceFS. Each item can be edited or deleted and Clear all removes everything. The README lists 50 saved memories on Free (https://docs.heygaia.io/guides/memory; https://github.com/theexperiencecompany/gaia/blob/master/ARCHITECTURE.md) |\n| Model providers | The hosted service picks the models. The privacy policy says message content, files and data from connected accounts are shared with third-party model providers, which it does not name. The source calls models through OpenRouter and Google Gemini, and the 26 August 2026 notes name DeepSeek V4 Flash as the default (https://heygaia.io/privacy; https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/agents/llm/client.py) |\n| Price | Pro $30 a month on the pricing page. The README adds Free at $0 and Enterprise by contact, while the pricing page FAQ says GAIA is a paid product. Self-hosting is free for noncommercial use, plus model usage (https://heygaia.io/pricing; https://github.com/theexperiencecompany/gaia) |\n| Advisories | None published on the repository on 12 October 2026. SECURITY.md asks for reports by email and promises a reply within 48 hours (https://github.com/theexperiencecompany/gaia/security/advisories; https://github.com/theexperiencecompany/gaia/blob/master/.github/SECURITY.md) |\n| Capabilities | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client |\n| Tags | hosted, source-available, noncommercial-licence, self-hosted, messaging, imessage, whatsapp, telegram, slack, discord, gmail, mcp-client, status-page, llms-txt, approval-off-by-default |\n| JSON | https://www.anchorterminal.com/api/v1/tools/gaia.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-12 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 67 | 13.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 51 | 8.3 |\n| Agent ergonomics | 13% | 16.2 | 54 | 8.8 |\n| Security \u0026 auth | 14% | 17.5 | 54 | 9.4 |\n| Payments \u0026 pricing | 10% | 12.5 | 20 | 2.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 78 | 6.8 |\n| Transparency \u0026 trust (editorial 50, provenance 70) | 7% | 8.8 | 60 | 5.2 |\n| Negative events | up to −15 | up to −15 | -3. The release notes of 26 August 2026 say GAIA pauses and asks before a tool that deletes, sends or overwrites, the privacy policy (7 August 2026) says destructive actions require explicit approval, and the pricing page says anything outward-facing waits for the owner's OK. The source at `api-v0.24.0` (14 September 2026) and on master sets the default mode to `always_allow`, commented as nothing gated until flipped after launch. Read from source, not from a live account. https://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py -2. The pricing page FAQ, read on 12 October 2026, says GAIA never shares data with model providers. Section 3.1 of the privacy policy says content, files and data from connected accounts are shared with third-party AI model providers. https://heygaia.io/pricing and https://heygaia.io/privacy | -5 |\n| **Total** | | | | **49.5 → D** |\n\n### Why each score\n\n- Reliability 67: Graded as the hosted service at heygaia.io, which the README recommends, with the hosted lines. A BetterStack status page lists the backend, the web app and four bots with a year of history (20). It lists no incident in the 90 days to 12 October 2026. The last entries are a Discord bot outage of 6 to 9 May and maintenance of 16 to 19 April, and we did not open the previous-incidents list (25). The docs give daily and monthly caps for Free and Pro, while the 26 August notes say Pro runs on cost-based limits with no figure (10). The docs say a limit is reported in the conversation with its reset time, and no retry guidance was found (5). An SLA is named only as part of Enterprise, with no terms published (0). The web app and bots carry no beta label, the desktop and mobile apps do, and every component is below 1.0 (7).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 51: GAIA has no public API, so this is read on what a person or an agent can learn about the product from its docs and source. In production the backend turns off its OpenAPI document, and the generated schema sits only in the repository (5 of 25). llms.txt on heygaia.io and docs.heygaia.io, with Markdown copies of every docs page (10). The guides say what each feature is for, and ARCHITECTURE.md maps every service and file, but no page lists which actions run without approval (12 of 20). The custom MCP form and the workflow builder have typed fields, and tools are otherwise chosen by the assistant (6 of 15). Guides carry examples and no page documents errors (7 of 15). Dated release notes and a tag for each component, though the notes stop at 26 August while tags exist for 13 and 14 September (11 of 15).\n- Agent ergonomics 54: Read on what the owner has to supply and manage. A comms agent delegates to an executor and to one subagent per integration, each scoped to its own tools, and tools are found by retrieval instead of loading every definition (18 of 25). Usage caps and notification settings exist, with no control over reply length found (8 of 20). Limit messages name the limit and its reset time, and other errors are not documented (8 of 20). An approval ledger records decisions, declined calls are remembered, and MCP `destructiveHint` is honoured as an escalation only (12 of 20). Connecting an account starts jobs with no setup and there is a CLI, but there is no SDK and the default approval mode runs everything (8 of 15).\n- Security \u0026 auth 54: Sign-in runs through WorkOS and integrations connect by OAuth on the provider's consent screen, with custom MCP tokens Fernet-encrypted in PostgreSQL and disconnect revoking access. Gmail takes the single broad `gmail.modify` scope and Composio, a third party, holds the built-in connections (22 of 30). Three approval modes, per-tool overrides and forced approval for adding an MCP server, pairing a device or disconnecting an account, but the source default is `always_allow`, commented as nothing gated (9 of 20). In Auto mode the judge trusts only the user's quoted words, fences untrusted text with a random marker and fails towards asking. That protection is off in the default mode and no guidance for owners was found (9 of 15). The chat shows each tool call and approvals are kept in a ledger, while audit logs are listed for Enterprise only (7 of 15). SECURITY.md promises a reply in 48 hours and coordinated disclosure, and the repository runs gitleaks and semgrep. No security.txt, bounty, certification or published advisory was found (7 of 20).\n- Payments \u0026 pricing 20: Scored on the hosted service. No payment protocol (0). The pricing page shows one plan, Pro at $30 a month, with usage limits it does not state (10). A no-card free tier takes half marks, because the README and docs describe a Free plan while the pricing page says GAIA is a paid product, and we did not sign up to see which holds (10). Access needs a person to sign up in a browser, and self-hosting needs a WorkOS account and model keys (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 78: The last tagged releases are `api-v0.24.0`, `web-v0.25.0` and `desktop-v0.7.1` of 14 September 2026, 28 days before this check (30). Three sets of tags in 90 days, on 26 August, 13 September and 14 September (20). 91 commits on master in the 30 days to 12 October. The 40 open items are mostly the team's own pull requests, the few open bug reports each have one comment, and the site names Discord, WhatsApp and email support with a 24 to 48 hour reply claim we did not test (15 of 25). No SDK and no MCP registry entry. `@heygaia/cli` 0.6.0 on npm matches the `cli-v0.6.0` tag (8 of 15). Dependabot and lockfiles are in place, but Quality Checks, Release Please and Deploy Web failed on the latest push to master on 12 October (5 of 10).\n- Transparency \u0026 trust 60: The full source is public under PolyForm Noncommercial 1.0.0, which is not an OSI licence and bars business use without an enterprise licence (20 of 30). The privacy policy of 7 August 2026 gives retention periods, Google Limited Use terms and a 72-hour breach notice, but it conflicts with the pricing page FAQ on sharing with model providers, allows submitted content to be used to improve the service, and gives a contact address on another domain. No DPA was found (14 of 30). The terms promise 30 days' notice before the service or a paid feature is discontinued, and no deprecation policy for single integrations or tools was found (10 of 20). The policy names categories of processor and no company or data location. The source and docs name OpenRouter, Google, Composio, WorkOS, E2B, Dodo Payments, PostHog and Sentry as integrations (6 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (22 items): https://www.anchorterminal.com/fixes/gaia.md (JSON https://www.anchorterminal.com/fixes/gaia.json)\n\n### What we couldn't check\n\n- Kind is `platform`, the kind the brief gives a web, desktop or phone app, because the hosted assistant has no public API. It was graded as a hosted service with `metrics.kind` remote, since the README recommends the cloud and prices are published for it. The self-hosted route is recorded as facts and not scored.\n- The default approval mode was read from source at `api-v0.24.0` and master. Whether the hosted service sets another default for new accounts was not checked, because we did not create an account.\n- Whether a new hosted account can still use a Free plan. The README and docs say yes and the pricing page says GAIA is a paid product.\n- The Terms of Service forbid using automated systems, including robots, spiders or data mining tools, to access the Service. Recorded as a fact with no deduction. It matters before any probe is run.\n- unchecked: the status page's previous-incidents list, so the 90-day record rests on the main status page.\n- unchecked: the domain registration date for heygaia.io.\n- unchecked: which companies process data for the hosted service and where. The privacy policy names none, and the names here come from the source and self-hosting docs.\n- unchecked: how account deletion works in the app. The privacy policy routes deletion requests through email, and it gives a heygaia.so address.\n- unchecked: reply times on Discord, WhatsApp and email support.\n- The docs guides were read from the repository's docs folder, not from docs.heygaia.io pages. Only llms.txt and robots.txt were fetched from that host.\n\n### Sources\n\n- robots.txt, read first: \u003chttps://heygaia.io/robots.txt\u003e (seen 2026-10-12)\n- home page: \u003chttps://heygaia.io/\u003e (seen 2026-10-12)\n- pricing page and its FAQ: \u003chttps://heygaia.io/pricing\u003e (seen 2026-10-12)\n- Terms of Service, effective 14 August 2026: \u003chttps://heygaia.io/terms\u003e (seen 2026-10-12)\n- privacy policy, effective 7 August 2026: \u003chttps://heygaia.io/privacy\u003e (seen 2026-10-12)\n- security.txt, returned 404: \u003chttps://heygaia.io/.well-known/security.txt\u003e (seen 2026-10-12)\n- status page: \u003chttps://status.heygaia.io\u003e (seen 2026-10-12)\n- docs llms.txt: \u003chttps://docs.heygaia.io/llms.txt\u003e (seen 2026-10-12)\n- repository README, licence and tags, from a shallow clone at commit 3726cec: \u003chttps://github.com/theexperiencecompany/gaia\u003e (seen 2026-10-12)\n- security policy: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/.github/SECURITY.md\u003e (seen 2026-10-12)\n- approval default and modes: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py\u003e (seen 2026-10-12)\n- approval policy and forced-ask tools: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/policy.py\u003e (seen 2026-10-12)\n- tool risk classification: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/classification.py\u003e (seen 2026-10-12)\n- Gmail gated tools: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil_destructive_tools.py\u003e (seen 2026-10-12)\n- integration definitions and scopes: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/config/oauth_config.py\u003e (seen 2026-10-12)\n- MCP token storage: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/mcp/mcp_token_store.py\u003e (seen 2026-10-12)\n- architecture document, memory and model layers: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/ARCHITECTURE.md\u003e (seen 2026-10-12)\n- memory guide, read from the docs source: \u003chttps://docs.heygaia.io/guides/memory\u003e (seen 2026-10-12)\n- usage and subscription guide, read from the docs source: \u003chttps://docs.heygaia.io/guides/usage-subscription\u003e (seen 2026-10-12)\n- self-hosting overview and environment variables, read from the docs source: \u003chttps://docs.heygaia.io/self-hosting/overview\u003e (seen 2026-10-12)\n- release notes, read from the docs source: \u003chttps://docs.heygaia.io/release-notes\u003e (seen 2026-10-12)\n- repository metadata, stars and open items (GitHub API): \u003chttps://api.github.com/repos/theexperiencecompany/gaia\u003e (seen 2026-10-12)\n- published security advisories, none (GitHub API): \u003chttps://github.com/theexperiencecompany/gaia/security/advisories\u003e (seen 2026-10-12)\n- workflow runs on master (GitHub API): \u003chttps://api.github.com/repos/theexperiencecompany/gaia/actions/runs?branch=master\u003e (seen 2026-10-12)\n- CLI package, version 0.6.0: \u003chttps://registry.npmjs.org/@heygaia%2Fcli/latest\u003e (seen 2026-10-12)\n\n## Who's behind it (provenance 70/100, checked 2026-10-12)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | The Experience Company, Inc. | 20/20 |\n| Domain age | heygaia.io, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | heygaia.io | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points | 5.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.heygaia.io | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe Terms of Service (effective 14 August 2026) name The Experience Company, Inc., a Delaware corporation. Neither the terms nor the privacy policy gives a postal address.\n\nThe privacy policy (effective 7 August 2026) gives support@heygaia.so as its contact, a different domain from heygaia.io, where the README's security and contact addresses sit.\n\nheygaia.io/.well-known/security.txt returned 404 on 12 October 2026. The repository's SECURITY.md gives an email address for reports.\n\nThe status page lists api.heygaia.io as the backend. We sent nothing to that host.\n\nheygaia.io's robots.txt allows every path and names ClaudeBot, Claude-Web and anthropic-ai with Allow. docs.heygaia.io carries Content-Signal ai-input=yes. status.heygaia.io returned an empty robots.txt.\n\nThe domain's registration date was not looked up.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://heygaia.io/terms), read 2026-10-12, dated 2026-08-14, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Using automated systems, including robots, spiders, or data mining tools, to access or collect information from the Service;\"\n- To know. Says the terms or the service can change without notice (costs points). \"A third-party provider may change or withdraw access at any time, which may remove functionality from the Service without notice.\"\n- To know. Says access can be ended without notice or for any reason. \"Either party may terminate this Agreement at any time with or without cause.\"\n- To know. Requires arbitration or waives class actions. \"SECTION 18 CONTAINS A BINDING ARBITRATION AGREEMENT AND A CLASS ACTION WAIVER.\"\n- Gives the date it was last updated. Last updated 2026-08-14.\n- Names the governing law or courts. The law of the State of Delaware.\n- States a limit on its liability. Capped at the greater of USD $100 and the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Changes are posted, with no other notice named.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). The approval step for actions classed as destructive is on a best-efforts basis and is not guaranteed to catch every consequential action. \"This safeguard is provided on a best-efforts basis and is not guaranteed to catch every consequential action;\"\n- Also in the text (2026-10-08). Free plans of the hosted service are for personal, non-commercial use only. \"Hosted Service, free plans: Personal, non-commercial use only;\"\n- Also in the text (2026-10-08). Fees can change on 30 days' prior written notice, with the new price applying from the next renewal. \"Company reserves the right to change fees upon thirty (30) days' prior written notice. Price changes take effect at your next renewal, and you may cancel before then;\"\n\n**Privacy policy** (https://heygaia.io/privacy), read 2026-10-12, dated 2026-08-07, states 8 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-08-07.\n- Says how long data is kept. Names a period of 24 months.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). Content submitted to the service may be used to improve services and products, while content from connected third-party integrations is not used for that. \"We may use content you submit to the Service to improve our services and products. We do not use content from your connected third-party integrations (including emails, calendar events, contacts, and other data retrieved from accounts you connect) to improve our services.\"\n- Also in the text (2026-10-08). People at the vendor do not read Google user data except with consent for specific messages, for security or legal need, or once it is aggregated and anonymised. \"We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized for internal operations;\"\n\n## Live (updated 2026-10-12 17:28 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/gaia.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Pro | $30 | per month (plan) | billed monthly, with usage limits the pricing page does not state |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- The whole product is in a public repository under PolyForm Noncommercial 1.0.0, including the approval gate, memory engine and five messaging bots.\n- Approval settings have three modes and per-tool overrides, and adding an MCP server, pairing a device or disconnecting an account asks in every mode.\n- Memory is visible in Settings as facts, a journal, four documents and a graph, and each item can be edited or deleted, with a clear-all control.\n- A BetterStack status page covers the API, web app and four bots, and lists no incident in the 90 days to 12 October 2026.\n- Three sets of tagged releases in the 90 days to 12 October 2026, the latest on 14 September, with 91 commits on master in the last 30 days.\n\n## Weaknesses\n\n- The default approval mode in the source is `always_allow`, commented as nothing gated, while the privacy policy and the 26 August release notes say destructive actions wait for approval.\n- The pricing page FAQ says data is never shared with model providers. The privacy policy says content, including data from connected accounts, is shared with them.\n- The README lists a Free plan at $0 forever, while the pricing page shows only Pro and says GAIA is a paid product.\n- Gmail connects with the `gmail.modify` scope, and built-in integrations run through Composio, so a third party holds those OAuth connections.\n- No security.txt, bug bounty, certification, subprocessor list or DPA was found, and self-hosting needs a WorkOS account and five data services.\n- The Terms of Service forbid automated systems accessing the Service. Recorded as a fact, and it matters before any probe is run.\n\n## Before you call it (notes for agents)\n\n1. Set Settings \u003e Approvals to Always ask or Auto before connecting mail. The default in the source runs every action, including send and delete, without asking.\n2. Expect no public API on the hosted service. The backend turns off its OpenAPI document in production, so reach GAIA through its apps, bots or CLI.\n3. Check the plan before relying on the hosted service. The README and docs describe a Free plan, and the pricing page says GAIA is a paid product.\n4. For self-hosting, prepare Docker, Node.js 20, a WorkOS account and a model key first, and confirm the use is noncommercial under the licence.\n5. Add outside tools as MCP servers by URL on the Integrations page. GAIA asks before adding a server in every approval mode.\n\n## Connect\n\nInstall:\n\n```bash\nnpm install -g @heygaia/cli \u0026\u0026 gaia init # choose Self-Host (Docker), then open http://localhost:3000\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| ZeroClaw | BB | 70.2 | 161 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/zeroclaw.md |\n| NanoClaw | B | 68.3 | 229 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | no | https://www.anchorterminal.com/tools/nanoclaw.md |\n| Hermes Agent | B | 67.9 | 244 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/hermes-agent.md |\n| OpenClaw | B | 67.1 | 270 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/openclaw.md |\n| IronClaw | B | 66.7 | 288 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/ironclaw.md |\n| nanobot | B | 62.4 | 446 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanobot.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The default approval mode is `always_allow`. The source comment reads that the default stays `always_allow` (HIL off, nothing gated) until it is flipped after launch. Read at tag `api-v0.24.0` and on master of 12 October 2026 (source: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/models/hil_models.py\u003e)\n- The release notes of 26 August 2026 say GAIA now pauses and asks before a tool that deletes, sends or overwrites, and the privacy policy says certain destructive actions require explicit approval. Neither states the default (source: \u003chttps://docs.heygaia.io/release-notes\u003e, \u003chttps://heygaia.io/privacy\u003e)\n- The pricing page FAQ says GAIA never shares data with model providers. Section 3.1 of the privacy policy, effective 7 August 2026, says content is shared with third-party AI model providers (source: \u003chttps://heygaia.io/pricing\u003e, \u003chttps://heygaia.io/privacy\u003e)\n- The licence changed from PolyForm Strict to PolyForm Noncommercial 1.0.0 in the release of 26 August 2026. GitHub reports the licence as Other (source: \u003chttps://docs.heygaia.io/release-notes\u003e, \u003chttps://github.com/theexperiencecompany/gaia/blob/master/LICENSE.md\u003e)\n- The privacy policy says content submitted to the Service may be used to improve services and products, and that content from connected accounts is not (source: \u003chttps://heygaia.io/privacy\u003e)\n- The Terms of Service, effective 14 August 2026, name The Experience Company, Inc., a Delaware corporation, forbid automated systems accessing the Service, and promise 30 days' notice before the service or a paid feature is discontinued (source: \u003chttps://heygaia.io/terms\u003e)\n- Self-hosting lists `WORKOS_API_KEY` as always required for sign-in. A pull request adding local auth for self-hosting (#1091) was open on 12 October 2026 (source: \u003chttps://docs.heygaia.io/configuration/environment-variables\u003e, \u003chttps://github.com/theexperiencecompany/gaia/pull/1091\u003e)\n- In production the backend sets `openapi_url`, `docs_url` and `redoc_url` to none, so the hosted API publishes no contract (source: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/core/app_factory.py\u003e)\n- In Auto mode a judge model decides from the user's own words only, must quote them, and fails towards asking. It calls `typesafe/jev-1.13` through OpenRouter (source: \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/services/hil/intent.py\u003e, \u003chttps://github.com/theexperiencecompany/gaia/blob/master/apps/api/app/constants/hil.py\u003e)\n- The status page lists maintenance from 16 to 19 April 2026 and a Discord bot outage from 6 to 9 May 2026, and shows 99.923 per cent uptime for the backend (source: \u003chttps://status.heygaia.io\u003e)\n- On 12 October 2026 the Quality Checks, Release Please and Deploy Web workflows failed on the latest push to master, read from the GitHub API (source: \u003chttps://api.github.com/repos/theexperiencecompany/gaia/actions/runs?branch=master\u003e)\n- The docs give Free and Pro daily caps, such as 200 and 3,000 chat messages a day, and say yearly billing saves 25 per cent. The README says yearly billing gives two months free (source: \u003chttps://docs.heygaia.io/guides/usage-subscription\u003e, \u003chttps://github.com/theexperiencecompany/gaia\u003e)\n\n- #10 of 20 in Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 190 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Compare\n\n- [AstrBot vs GAIA](https://www.anchorterminal.com/compare/astrbot-vs-gaia.md): C 58.8 vs D 49.5\n- [CowAgent vs GAIA](https://www.anchorterminal.com/compare/cowagent-vs-gaia.md): C 58.5 vs D 49.5\n- [GAIA vs Gemini Spark](https://www.anchorterminal.com/compare/gaia-vs-gemini-spark.md): D 49.5 vs F 24.5\n- [GAIA vs Grok Bot](https://www.anchorterminal.com/compare/gaia-vs-grok-bot.md): D 49.5 vs E 45.2\n- [GAIA vs Haven](https://www.anchorterminal.com/compare/gaia-vs-haven.md): D 49.5 vs F 22.2\n- [GAIA vs Hermes Agent](https://www.anchorterminal.com/compare/gaia-vs-hermes-agent.md): D 49.5 vs B 67.9\n- [GAIA vs Instinct](https://www.anchorterminal.com/compare/gaia-vs-instinct.md): D 49.5 vs F 11.4\n- [GAIA vs IronClaw](https://www.anchorterminal.com/compare/gaia-vs-ironclaw.md): D 49.5 vs B 66.7\n- [GAIA vs Leon](https://www.anchorterminal.com/compare/gaia-vs-leon.md): D 49.5 vs E 41\n- [GAIA vs Lindy](https://www.anchorterminal.com/compare/gaia-vs-lindy.md): D 49.5 vs F 32.3\n- [GAIA vs nanobot](https://www.anchorterminal.com/compare/gaia-vs-nanobot.md): D 49.5 vs B 62.4\n- [GAIA vs NanoClaw](https://www.anchorterminal.com/compare/gaia-vs-nanoclaw.md): D 49.5 vs B 68.3\n- [GAIA vs Dots](https://www.anchorterminal.com/compare/gaia-vs-openai-dots.md): D 49.5 vs F 28.3\n- [GAIA vs OpenClaw](https://www.anchorterminal.com/compare/gaia-vs-openclaw.md): D 49.5 vs B 67.1\n- [GAIA vs PicoClaw](https://www.anchorterminal.com/compare/gaia-vs-picoclaw.md): D 49.5 vs D 46.1\n- [GAIA vs Poke](https://www.anchorterminal.com/compare/gaia-vs-poke.md): D 49.5 vs F 37.6\n- [GAIA vs QwenPaw](https://www.anchorterminal.com/compare/gaia-vs-qwenpaw.md): D 49.5 vs B 62.2\n- [GAIA vs ZeroClaw](https://www.anchorterminal.com/compare/gaia-vs-zeroclaw.md): D 49.5 vs BB 70.2\n- [GAIA vs Zo Computer](https://www.anchorterminal.com/compare/gaia-vs-zo-computer.md): D 49.5 vs E 43.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on heygaia.io or one of its subdomains, or the README of github.com/theexperiencecompany/gaia. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"gaia\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/gaia\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/gaia.svg\" alt=\"GAIA on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![GAIA on Anchor Terminal](https://www.anchorterminal.com/badges/gaia.svg)](https://www.anchorterminal.com/tools/gaia)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/gaia\"\u003eGAIA on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say GAIA is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/gaia-dark.png\n- Light: https://www.anchorterminal.com/assets/share/gaia-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Personal assistants", "url": "https://www.anchorterminal.com/categories/personal-assistants" }, { "name": "GAIA", "url": "" } ], "description": "GAIA is a personal AI assistant from The Experience Company for email, calendar, todos and scheduled workflows. It runs as a hosted service at heygaia.io with messaging bots, and its source is published for noncommercial self-hosting.", "facts": [ "rank #813 of 986", "OAuth auth", "0 desk reviews" ], "h1": "GAIA", "image": "https://www.anchorterminal.com/assets/og/tools-gaia.png", "path": "/tools/gaia", "published": "2026-10-01", "section": "tools", "title": "GAIA review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/tools/gaia" }, "tokens": { "markdown": 9200, "slim": 2180 }, "version": 1 }