# nanobot (slim)

> nanobot is an open-source, self-hosted personal AI agent written in Python by HKUDS. It runs as a gateway on the owner's machine and answers in a web UI, a terminal and chat apps, with tools, memory and scheduled automations.

- Full: https://www.anchorterminal.com/tools/nanobot.md (~7,450 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/tools/nanobot.json · canonical https://www.anchorterminal.com/tools/nanobot
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 62.4/100 · rank #446 of 986 · #6 in Personal assistants · not agent-ready · confidence medium**


Assessment: nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

## Facts

- Kind: Agent harness · vendor: HKUDS · category: Personal assistants · legal entity: not named · provenance 27/100
- Packages: pypi `nanobot-ai`
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: The owner's machine or server. PyPI package `nanobot-ai` for Python 3.11 or newer, a Docker image built from the repository, and a Render blueprint. No hosted service from the project was found
- Acts without asking: No per-action approval step found in the docs or source at v0.3.5. Shell (`exec`), file edits, `message` sends, web fetch and MCP tools run when the model calls them. A deny list blocks patterns such as `rm -rf` and `mkfs`
- Controls: `tools.exec.enable` false removes the shell tool. `tools.restrictToWorkspace` (default false). `tools.exec.sandbox` `bwrap` or `seatbelt` (default empty, filesystem only, no network limit). Restricted or Full Access per WebUI chat. `tools.maxSessionMessagesPerMinute` 6
- Proactive work: Scheduled automations from the `cron` tool, local triggers (`nanobot trigger`), and a heartbeat that reads `HEARTBEAT.md` every 1800 seconds by default and reports only useful results
- Channels: WebUI, terminal, Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Microsoft Teams (DM only), Mattermost, Email (IMAP and SMTP), Linear, Feishu, DingTalk, WeChat, WeCom, QQ, Napcat and Mochat
- Who can message it: Per-channel `allowFrom`. Empty denies everyone since v0.1.4.post4, and unknown senders get a pairing code the owner approves with `/pairing approve`. Slack and Mattermost DMs are open by default
- Accounts and credentials: Bot tokens and IMAP and SMTP passwords in `~/.nanobot/config.json`, in clear text unless written as `${VAR}`. MCP OAuth tokens in `auth/mcp.json` in the data directory, removed when the server is removed. WhatsApp session in `~/.nanobot/whatsapp-auth`
- Memory: `USER.md`, `SOUL.md` and `memory/MEMORY.md` in the workspace (default `~/.nanobot/workspace/`), rewritten by the Dream job every 2 hours by default and versioned with Git. Summaries in `memory/history.jsonl`, sessions in `~/.nanobot/sessions/<workspace-id>/`
- Deleting memory: Files on the owner's disk, edited or removed by the owner. `/dream-restore <sha>` rolls memory back. The WebUI deletes topics. `history.jsonl` is append-only and earlier versions stay in the workspace Git history. No one-step erase command was found
- Model providers: The owner's choice. Anthropic, OpenAI, OpenRouter, AWS Bedrock, OAuth sign-ins for OpenAI Codex, xAI Grok and GitHub Copilot, any OpenAI-compatible endpoint, or local models through Ollama, vLLM or LM Studio. Prompts go to the chosen provider
- Other outbound traffic: Web search uses DuckDuckGo by default with no key. The WebUI skills marketplace queries skills.sh and skillhub.cn. Langfuse tracing only when its environment variables are set
- MCP client: stdio, streamable HTTP and SSE, static headers or OAuth, `enabledTools` filter per server, presets such as Notion, Linear and Xmind
- Interfaces for other programs: `nanobot -m` one-shot, a Python SDK, and an OpenAI-compatible API (`/v1/chat/completions`, `/v1/models`, `/health`) on 127.0.0.1:8900, which needs `api.apiKey` when bound to all interfaces
- Cost: Free. The owner pays the model provider, or nothing with a local model. The Render blueprint needs a paid Render service for its persistent disk
- Releases: v0.3.5 on 15 September 2026 and v0.3.0 on 25 July 2026. Last commit on main 12 October 2026

- Scores: Reliability 70, Performance pending, Schema & documentation 77, Agent ergonomics 74, Security & auth 63, Payments & pricing 60, Task success pending, Maintenance & community 82, Transparency & trust 48 · negative events -6 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as for goose and Khoj. · Schema & documentation, Harness reading of the framework line, as for goose. · Agent ergonomics, Harness reading, scored on what an agent or script driving it has to supply. · Security & auth, Harness reading used for goose. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v0.3.5 was released on 15 September 2026, 27 days before this check (30). · Transparency & trust, MIT (30).
- Sources: 22, open questions: 12, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/nanobot.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/nanobot.svg` or a link to https://www.anchorterminal.com/tools/nanobot from a page on nanobot.wiki or one of its subdomains, or the README of github.com/HKUDS/nanobot, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `tools.restrictToWorkspace` to true and `tools.exec.sandbox` to `bwrap` or `seatbelt` before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep `allowFrom` narrow on every channel and never set `["*"]` on Email, which has no pairing
4. Write secrets as `${VAR}` references in `~/.nanobot/config.json`. Plain values are stored in clear text
5. Use `nanobot -m "..."` for a one-shot run, and keep `nanobot gateway` running for channels, schedules and heartbeat

## Connect

```bash
python -m pip install nanobot-ai   # or: uv tool install nanobot-ai   # then: nanobot webui
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)