{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/zeroclaw.json", "name": "ZeroClaw", "score": 70.2, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "zeroclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanoclaw.json", "name": "NanoClaw", "score": 68.3, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "agent.mcp-client", "assistant.accounts" ], "slug": "nanoclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/hermes-agent.json", "name": "Hermes Agent", "score": 67.9, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "hermes-agent" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/ironclaw.json", "name": "IronClaw", "score": 66.7, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "ironclaw" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nanobot.json", "name": "nanobot", "score": 62.4, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.memory", "assistant.self-hosted", "assistant.accounts", "agent.mcp-client" ], "slug": "nanobot" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/qwenpaw.json", "name": "QwenPaw", "score": 62.2, "shared": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "slug": "qwenpaw" } ], "tool": { "slug": "openclaw", "name": "OpenClaw", "vendor": "OpenClaw Foundation", "vendorUrl": "https://openclaw.ai", "kind": "harness", "category": "personal-assistants", "summary": "Open-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.", "url": "https://www.anchorterminal.com/tools/openclaw", "markdownUrl": "https://www.anchorterminal.com/tools/openclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openclaw.json", "repo": "https://github.com/openclaw/openclaw", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "openclaw" }, { "registry": "oci", "name": "ghcr.io/openclaw/openclaw" } ], "auth": "mixed", "authNotes": "No OpenClaw account exists. The owner supplies model provider API keys or signs in with a ChatGPT or Claude subscription, and adds a bot token, QR pairing or OAuth grant for each channel and account. Clients reach the Gateway with a token or password (`gateway.auth.mode`), or through a trusted proxy, and paired devices hold their own tokens. Operator scopes (`operator.read`, `operator.write`, `operator.admin` and others) apply to paired clients, but a shared-secret bearer token on `POST /tools/invoke` gets full operator access whatever scopes the caller sends (https://docs.openclaw.ai/gateway/tools-invoke-http-api; https://docs.openclaw.ai/gateway/operator-scopes).", "pricing": "free", "pricingNotes": "Free under the MIT licence, with no paid tier, hosted service or subscription. The owner pays the model provider for usage, or nothing with a local model, plus any search, speech or media API they configure (https://github.com/openclaw/openclaw; https://docs.openclaw.ai/reference/api-usage-costs).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 391800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.openclaw.ai", "llmsTxt": "https://docs.openclaw.ai/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "foundation", "llms-txt", "docker", "typescript" ], "lastRelease": "2026-10-12", "graded": true, "anchor": { "graded": true, "score": 67.1, "grade": "B", "agentReady": false, "rank": 270, "ranked": true, "rankOf": 986, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 77, "maintenance": 86, "payments": 60, "reliability": 75, "schema": 84, "security": 74, "transparency": 68 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Read with the local-software lines, as for the agent programs in the harness category. `openclaw` is on npm for Node 24.16+ or 26.1+, with install scripts, desktop apps for macOS, Windows and Linux and a GHCR image (20). The CI workflow on main showed 25 passing runs of 26 visible on 12 October 2026, the other in progress (25). 748 open issues carry the bug label among more than 5,000 open issues. The fifteen newest, all from 11 and 12 October, each had at least one comment, and nine concern failed updates from 2026.10.1 to 2026.10.2. The founder's post of 5 May 2026 describes two releases that slowed Gateways and broke installs (12 of 25). Versions are calendar-based, not semver. Each release has a changelog file with an upcoming deprecations section, and release notes list upgrade changes (9 of 15). A stable channel, an extended-stable channel and a 2.0 label exist, but the project's own maturity scorecard gives 68 per cent and the level Alpha (9 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 84, "points": 13.65, "reason": "Harness reading of the framework line, as the Goose and OpenHands dossiers use. The Gateway WebSocket protocol is defined in TypeBox with JSON Schema export, the config has a documented schema, and optional OpenAI-compatible routes exist at `/v1/chat/completions` and `/v1/responses`. No OpenAPI file was found (18 of 25). llms.txt on both sites, and every docs page is served as Markdown with a `.md` suffix (10). Docs pages carry a `read_when` list and decision tables that say which mechanism fits which job (17 of 20). Config keys, permission modes and operator scopes are enumerated with defaults (12 of 15). Config examples on most pages and a rate-limit reference with the error each limit returns. No single error reference was found (12 of 15). A changelog file and a release notes page for every release, with dated tags (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "Harness reading, scored on what an owner or pipeline driving it has to supply. Tool profiles (`minimal`, `messaging`, `coding`, `full`), tool search, Code Mode and installed-skill search keep definitions out of the prompt until needed (21 of 25). Compaction, session pruning, loop detection, a 1,800 second default exec timeout and a light-context option for heartbeat turns. No spending cap was found (15 of 20). `openclaw agent exec` for headless runs, `--json` on CLI commands, `POST /tools/invoke`, and OpenAI-compatible HTTP routes that are off by default (16 of 20). Sessions persist and resume, with documented restart recovery, retries and model failover (16 of 20). An onboarding wizard reaches a first conversation, but the runtime is Node only and the defaults are full access with no sandbox (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 74, "points": 12.95, "reason": "Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. A daily update check sends version, operating system, Node.js version and architecture, and the service records Cloudflare-derived city-level location for three months even with `DO_NOT_TRACK` set. Feature statistics are opt-in and one setting stops every request. Credentials are kept in files and SQLite under `~/.openclaw`, guarded by file permissions unless a secret provider is configured (22). Four permission modes, exec approvals bound to the resolved executable, a model reviewer, Docker and Podman sandboxes, pairing codes for unknown senders and a loopback bind exist, but the default is full access, sandboxing is off, onboarding selects the full tool profile and sends need no approval (11). A prompt-injection page, boundary markers around external content, and restricted reader agents in the mail guides. The policy does not treat prompt injection alone as a vulnerability (12). A metadata-only audit ledger, transcripts, OpenTelemetry and Prometheus export, and `openclaw security audit` (13). SECURITY.md with private reporting, an incident response plan, a public page of advisory counts, a Trail of Bits audit reported on 21 September 2026, CodeQL and npm provenance. No bounty and no security.txt (16). The advisory record is counted under deductions." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with no paid tier or hosted service to price, so 20, 20 and 20 on the last three lines. The owner pays a model provider separately, or runs a local model." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 86, "points": 7.53, "reason": "v2026.10.2 was published on 12 October 2026 (30). 13 stable tags in the 90 days before, from 2026.8.1 on 30 August to 2026.10.2, after a gap of nearly seven weeks from 2026.7.1 on 13 July (20). The fifteen newest bug reports each had a comment within a day, some of them possibly from the project's triage automation, against more than 5,000 open issues and about 3,300 open pull requests (15 of 25). Desktop, mobile, npm and container builds ship from the same releases, with a plugin SDK package. Not in the MCP registry, which does not apply to an MCP client (12 of 15). Dependency audit and CodeQL workflows, a reviewed lockfile and npm provenance attestations, with passing CI (9 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 68, "points": 5.95, "note": "editorial 82, provenance 53", "reason": "MIT (30). The telemetry page names every field sent and a three-month retention, and the storage pages list what is written to disk and where. The privacy policy covers the mobile apps, the Chrome extension and website analytics and says it does not cover the Gateway, and the Foundation's site gave no address or registration details (20 of 30). Changelogs carry an upcoming deprecations section with dated removal targets, and an extended-stable channel exists. No written support policy stating how long a release is maintained was found (15 of 20). Telemetry is documented with `openclaw telemetry show`, an off switch and `DO_NOT_TRACK`, though the daily check and its location record are on by default (17 of 20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading, scored on what an owner or pipeline driving it has to supply. Tool profiles (`minimal`, `messaging`, `coding`, `full`), tool search, Code Mode and installed-skill search keep definitions out of the prompt until needed (21 of 25). Compaction, session pruning, loop detection, a 1,800 second default exec timeout and a light-context option for heartbeat turns. No spending cap was found (15 of 20). `openclaw agent exec` for headless runs, `--json` on CLI commands, `POST /tools/invoke`, and OpenAI-compatible HTTP routes that are off by default (16 of 20). Sessions persist and resume, with documented restart recovery, retries and model failover (16 of 20). An onboarding wizard reaches a first conversation, but the runtime is Node only and the defaults are full access with no sandbox (9 of 15).", "maintenance": "v2026.10.2 was published on 12 October 2026 (30). 13 stable tags in the 90 days before, from 2026.8.1 on 30 August to 2026.10.2, after a gap of nearly seven weeks from 2026.7.1 on 13 July (20). The fifteen newest bug reports each had a comment within a day, some of them possibly from the project's triage automation, against more than 5,000 open issues and about 3,300 open pull requests (15 of 25). Desktop, mobile, npm and container builds ship from the same releases, with a plugin SDK package. Not in the MCP registry, which does not apply to an MCP client (12 of 15). Dependency audit and CodeQL workflows, a reviewed lockfile and npm provenance attestations, with passing CI (9 of 10).", "payments": "Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with no paid tier or hosted service to price, so 20, 20 and 20 on the last three lines. The owner pays a model provider separately, or runs a local model.", "reliability": "Read with the local-software lines, as for the agent programs in the harness category. `openclaw` is on npm for Node 24.16+ or 26.1+, with install scripts, desktop apps for macOS, Windows and Linux and a GHCR image (20). The CI workflow on main showed 25 passing runs of 26 visible on 12 October 2026, the other in progress (25). 748 open issues carry the bug label among more than 5,000 open issues. The fifteen newest, all from 11 and 12 October, each had at least one comment, and nine concern failed updates from 2026.10.1 to 2026.10.2. The founder's post of 5 May 2026 describes two releases that slowed Gateways and broke installs (12 of 25). Versions are calendar-based, not semver. Each release has a changelog file with an upcoming deprecations section, and release notes list upgrade changes (9 of 15). A stable channel, an extended-stable channel and a 2.0 label exist, but the project's own maturity scorecard gives 68 per cent and the level Alpha (9 of 15).", "schema": "Harness reading of the framework line, as the Goose and OpenHands dossiers use. The Gateway WebSocket protocol is defined in TypeBox with JSON Schema export, the config has a documented schema, and optional OpenAI-compatible routes exist at `/v1/chat/completions` and `/v1/responses`. No OpenAPI file was found (18 of 25). llms.txt on both sites, and every docs page is served as Markdown with a `.md` suffix (10). Docs pages carry a `read_when` list and decision tables that say which mechanism fits which job (17 of 20). Config keys, permission modes and operator scopes are enumerated with defaults (12 of 15). Config examples on most pages and a rate-limit reference with the error each limit returns. No single error reference was found (12 of 15). A changelog file and a release notes page for every release, with dated tags (15).", "security": "Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. A daily update check sends version, operating system, Node.js version and architecture, and the service records Cloudflare-derived city-level location for three months even with `DO_NOT_TRACK` set. Feature statistics are opt-in and one setting stops every request. Credentials are kept in files and SQLite under `~/.openclaw`, guarded by file permissions unless a secret provider is configured (22). Four permission modes, exec approvals bound to the resolved executable, a model reviewer, Docker and Podman sandboxes, pairing codes for unknown senders and a loopback bind exist, but the default is full access, sandboxing is off, onboarding selects the full tool profile and sends need no approval (11). A prompt-injection page, boundary markers around external content, and restricted reader agents in the mail guides. The policy does not treat prompt injection alone as a vulnerability (12). A metadata-only audit ledger, transcripts, OpenTelemetry and Prometheus export, and `openclaw security audit` (13). SECURITY.md with private reporting, an incident response plan, a public page of advisory counts, a Trail of Bits audit reported on 21 September 2026, CodeQL and npm provenance. No bounty and no security.txt (16). The advisory record is counted under deductions.", "transparency": "MIT (30). The telemetry page names every field sent and a three-month retention, and the storage pages list what is written to disk and where. The privacy policy covers the mobile apps, the Chrome extension and website analytics and says it does not cover the Gateway, and the Foundation's site gave no address or registration details (20 of 30). Changelogs carry an upcoming deprecations section with dated removal targets, and an extended-stable channel exists. No written support policy stating how long a release is maintained was found (15 of 20). Telemetry is documented with `openclaw telemetry show`, an off switch and `DO_NOT_TRACK`, though the daily check and its location record are on by default (17 of 20)." }, "sources": [ { "what": "repository README", "url": "https://github.com/openclaw/openclaw", "seen": "2026-10-12" }, { "what": "security policy (source clone, commit 30b2ef3 of 12 October 2026)", "url": "https://github.com/openclaw/openclaw/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "security status page", "url": "https://openclaw.ai/security", "seen": "2026-10-12" }, { "what": "security snapshot file linked from the status page", "url": "https://openclaw.ai/security/snapshot.json", "seen": "2026-10-12" }, { "what": "GitHub security advisories, first page", "url": "https://github.com/openclaw/openclaw/security/advisories", "seen": "2026-10-12" }, { "what": "advisory GHSA-9m4p-cqp4-jppq", "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq", "seen": "2026-10-12" }, { "what": "privacy policy for apps, extension and websites", "url": "https://openclaw.ai/privacy", "seen": "2026-10-12" }, { "what": "blog index", "url": "https://openclaw.ai/blog", "seen": "2026-10-12" }, { "what": "blog, OpenClaw Had a Rough Week", "url": "https://openclaw.ai/blog/openclaw-rough-week", "seen": "2026-10-12" }, { "what": "blog, Trail of Bits audit recap", "url": "https://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap", "seen": "2026-10-12" }, { "what": "blog, OpenClaw 2.0, Accidentally", "url": "https://openclaw.ai/blog/openclaw-2-accidentally", "seen": "2026-10-12" }, { "what": "site llms.txt", "url": "https://openclaw.ai/llms.txt", "seen": "2026-10-12" }, { "what": "docs llms.txt", "url": "https://docs.openclaw.ai/llms.txt", "seen": "2026-10-12" }, { "what": "GitHub releases", "url": "https://github.com/openclaw/openclaw/releases", "seen": "2026-10-12" }, { "what": "CI workflow runs on main", "url": "https://github.com/openclaw/openclaw/actions/workflows/ci.yml?query=branch%3Amain", "seen": "2026-10-12" }, { "what": "open issues labelled bug", "url": "https://github.com/openclaw/openclaw/issues?q=is%3Aissue+is%3Aopen+label%3Abug", "seen": "2026-10-12" }, { "what": "npm package record", "url": "https://registry.npmjs.org/openclaw/latest", "seen": "2026-10-12" }, { "what": "Foundation site", "url": "https://www.openclaw.org/", "seen": "2026-10-12" }, { "what": "permission modes (read in the source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/permission-modes.md", "seen": "2026-10-12" }, { "what": "exec tool and defaults (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/tools/exec.md", "seen": "2026-10-12" }, { "what": "tool and agent permissions (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/security/tool-permissions.md", "seen": "2026-10-12" }, { "what": "prompt injection (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/security/prompt-injection.md", "seen": "2026-10-12" }, { "what": "secrets, storage and logs (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/security/secrets-and-storage.md", "seen": "2026-10-12" }, { "what": "telemetry and update checks (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/telemetry.md", "seen": "2026-10-12" }, { "what": "memory overview and memory provenance (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/concepts/memory.md", "seen": "2026-10-12" }, { "what": "heartbeat (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/heartbeat.md", "seen": "2026-10-12" }, { "what": "standing orders (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/automation/standing-orders.md", "seen": "2026-10-12" }, { "what": "channel catalogue (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/channels/index.md", "seen": "2026-10-12" }, { "what": "MCP client guide (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/tools/mcp.md", "seen": "2026-10-12" }, { "what": "API usage and costs (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/reference/api-usage-costs.md", "seen": "2026-10-12" }, { "what": "tools invoke HTTP API and operator scopes (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/gateway/tools-invoke-http-api.md", "seen": "2026-10-12" }, { "what": "release channels (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/install/development-channels.md", "seen": "2026-10-12" }, { "what": "maturity scorecard (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/maturity/scorecard.md", "seen": "2026-10-12" }, { "what": "incident response plan (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/docs/security/incident-response.md", "seen": "2026-10-12" }, { "what": "gog skill for Google Workspace (source clone)", "url": "https://github.com/openclaw/openclaw/blob/main/skills/gog/SKILL.md", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is `harness`. The briefs define no kind for a personal assistant, and a self-hosted agent program that runs tools for its owner is closest to the harness kind used for Goose and OpenHands.", "The lead dated the OpenClaw 2.0 blog post 31 August 2026. The blog shows 30 August 2026, and the v2026.8.1 tag is dated 30 August.", "The star count is 391.8k as the repository page showed it on 12 October 2026. The exact figure in the lead was not re-read from the API.", "unchecked: the 14 critical advisories were not read one by one. Their count, and the statement that all are fixed, come from the project's own security page and snapshot file.", "unchecked: the docs were read from the repository clone at commit 30b2ef3, not from the rendered pages on docs.openclaw.ai, except robots.txt and llms.txt.", "unchecked: whether replies on new issues come from maintainers or from the project's triage automation.", "unchecked: the domain registration date, the Foundation's registration details, and the size of the default tool definitions.", "unchecked: ClawHub, the skill and plugin registry at clawhub.ai, was not read. The security page says it blocks skills marked malicious and excludes third-party skills from its status.", "No terms of service and no privacy policy covering the Gateway were found, so `provenance.terms` and `provenance.privacy` are empty.", "The -8 for the advisory record is a judgement. The count partly reflects a project that publishes every fix as an advisory, and no compromise is reported." ] }, "negative": -8, "negativeNotes": [ "2026-09-11. The project's security page and GitHub advisory list show 722 advisories published between 31 January and 11 September 2026, 14 critical, 249 high, 390 medium and 69 low, 39 with a CVE. The largest groups are Gateway auth and scopes (182) and exec, sandbox and approvals (160). The project says all 14 critical issues are fixed and disclosed and reports no known compromise of its infrastructure. Fixed and published, which decays the deduction, but the volume and the two areas affected bear directly on an assistant that holds its owner's accounts, -8. https://openclaw.ai/security; https://github.com/openclaw/openclaw/security/advisories" ], "verdict": "Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.", "bestFor": "A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.", "strengths": [ "State, memory and credentials stay under `~/.openclaw` on the owner's machine, and the project sells no hosted service or paid tier", "Memory is plain Markdown files in the workspace, and `openclaw memory forget` removes what a named session contributed", "Four session permission modes (`read-only`, `guarded`, `workspace`, `full`), exec approvals and an optional Docker or Podman tool sandbox", "Unknown direct-message senders get a pairing code by default and are ignored until the owner approves them", "Telemetry is documented field by field. Feature statistics are opt-in and `update.checkOnStart: false` stops every automatic request", "13 stable releases in the 90 days to 12 October 2026, with npm provenance attestations on the published package" ], "weaknesses": [ "Without configuration the default is full access. Host exec runs with no approval and sandboxing is off", "Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send", "722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page", "Credentials sit in files and SQLite databases under `~/.openclaw`, protected by file permissions unless the owner configures a secret provider", "The project's own maturity scorecard rates the product at 68 per cent, labelled Alpha", "The privacy policy covers the mobile apps, the Chrome extension and website analytics, and says it does not cover the Gateway" ], "agentNotes": [ "Set a session permission mode of `guarded` or `workspace`, or `tools.exec.mode`, before connecting mail. The default runs host commands without approval", "Turn on `agents.defaults.sandbox` for any agent that reads mail, web pages or attachments. Sandboxing is off by default", "Set `tools.message.crossContext.allowAcrossProviders` and `allowWithinProvider` to `false` to confine sends to the current conversation", "Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny `gateway`, `cron`, `sessions_spawn` and `sessions_send` for it", "Run `openclaw security audit` after setup, and treat the Gateway token as an owner credential. `POST /tools/invoke` accepts it with full operator access" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.1 } ], "editorialScores": { "ergonomics": 77, "maintenance": 86, "payments": 60, "reliability": 75, "schema": 84, "security": 74, "transparency": 82 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://openclaw.ai/install.sh | bash # or: npm install -g openclaw@latest --allow-scripts=openclaw \u0026\u0026 openclaw onboard --install-daemon" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/openclaw" }, "notable": [ "The README says state, memory and credentials live on the owner's hardware, prompts go to the model provider and chat platforms the owner configures, and the project has no paid tier, hosted service or token (https://github.com/openclaw/openclaw)", "Tools run on the host for the main session unless sandboxing is configured. The exec docs say no-approval host exec is the default for gateway and node, and sandboxing is off by default (https://docs.openclaw.ai/tools/exec)", "The permission modes page says that without exec settings or sandboxing the default is full access, and local onboarding sets `tools.profile` to `full` (https://docs.openclaw.ai/gateway/permission-modes; https://docs.openclaw.ai/gateway/config-tools/tool-policy)", "Agents with message-tool access can send across conversations and channel providers by default. `tools.message.crossContext.allowAcrossProviders` defaults to `true` (https://docs.openclaw.ai/gateway/security/tool-permissions)", "Heartbeat runs a periodic agent turn in the main session every 30 minutes by default, or every hour with Anthropic OAuth, and sends alerts to the owner's direct message (https://docs.openclaw.ai/gateway/heartbeat)", "Standing orders in `AGENTS.md` grant the agent permanent authority for named programmes, with approval gates written as instructions to the model, not enforced by the Gateway (https://docs.openclaw.ai/automation/standing-orders)", "The security page counts 1,799 reports filed since January 2026 and 722 fixed and published, 39 with a CVE, 14 critical, 249 high, 390 medium and 69 low, as of 11 September 2026. It reports no known compromise of the project's infrastructure or install channels, reviewed 9 September 2026 (https://openclaw.ai/security; https://openclaw.ai/security/snapshot.json)", "Trail of Bits audited the project through OpenAI's Patch the Planet initiative and filed 27 private advisories, 24 severity-rated (2 high, 16 medium, 6 low). The project says every actionable issue was repaired (https://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap, 21 September 2026)", "The founder's post of 5 May 2026 says releases 2026.4.24 and 2026.4.29 slowed Gateways, left some installs in plugin repair loops and degraded Discord, Telegram and WhatsApp channels (https://openclaw.ai/blog/openclaw-rough-week)", "Version 2026.8.1, also called OpenClaw 2.0, was tagged on 30 August 2026 after nearly seven weeks without a release. The blog says it holds about half of all pull requests ever merged (https://openclaw.ai/blog/openclaw-2-accidentally)", "A daily update check sends the version, operating system, Node.js version and CPU architecture to telemetry.openclaw.ai. Cloudflare-derived country, region, city and timezone are recorded for three months, including when `DO_NOT_TRACK` is set (https://docs.openclaw.ai/gateway/telemetry)", "Memory is Markdown in the agent workspace (`USER.md`, `MEMORY.md`, dated notes under `memory/`), and a default dreaming sweep distils daily notes into `MEMORY.md` (https://docs.openclaw.ai/concepts/memory)", "Session transcripts are stored on disk and can contain pasted secrets, file contents and command output. Log and transcript redaction is always on (https://docs.openclaw.ai/gateway/security/secrets-and-storage)", "The security policy says prompt injection without a policy, auth, approval, sandbox or tool-boundary bypass is not treated as a vulnerability, and that one Gateway is one trust boundary, not a multi-tenant one (https://github.com/openclaw/openclaw/blob/main/SECURITY.md)", "The generated maturity scorecard in the repository gives an overall score of 68 per cent with the level Alpha, quality 65 per cent and completeness 71 per cent (https://github.com/openclaw/openclaw/blob/main/docs/maturity/scorecard.md)", "The OpenClaw Foundation is described as an independent 501(c)(3) that employs the core team and signs releases. Donors named are Amazon, Lobster Computer Company, Offline Holdings, OpenAI, Red Hat and the University of Michigan (https://github.com/openclaw/openclaw)", "The link to a trust page in SECURITY.md, trust.openclaw.ai, redirects to the blog's security section (checked 2026-10-12)" ], "area": "frameworks", "details": [ { "label": "Where it runs", "value": "A Gateway process on the owner's computer or server, bound to loopback on a regular host install. Installers for macOS, Linux and Windows, an npm package for Node 24.16+ or 26.1+, desktop apps, and a container image at ghcr.io/openclaw/openclaw, which defaults to an exposed bind (https://docs.openclaw.ai/gateway/security)" }, { "label": "What it does without asking", "value": "By default host commands run with no approval, file tools have full access and the message tool can send to any configured conversation. Persistent config changes from a restricted chat session ask for approval with a card or `/approve \u003cid\u003e allow-once|deny`. Free-text replies such as yes never authorise a change (https://docs.openclaw.ai/gateway/permission-modes)" }, { "label": "Approval controls", "value": "Session permission modes `read-only`, `guarded` (a human reviews exec after an allowlist), `workspace` (a model reviews and can escalate to a human) and `full`. Per-message `/exec ask=always`. Tool allow and deny lists and profiles `minimal`, `messaging`, `coding` and `full`. Optional Docker or Podman sandbox per agent or session" }, { "label": "Accounts", "value": "Google Workspace through the bundled `gog` skill and the separate gog CLI with OAuth (Gmail, Calendar, Drive, Contacts, Sheets, Docs), Gmail Pub/Sub triggers, an IMAP plugin that reads but does not send, GitHub, and anything reachable through MCP servers, skills or the browser. Scopes are whatever the owner grants each tool" }, { "label": "Credential storage", "value": "Under `~/.openclaw`. Channel credentials in `credentials/`, model auth profiles in a per-agent SQLite database, MCP OAuth tokens in `state/openclaw.sqlite`, tokens possibly in `openclaw.json`. Recommended permissions are 700 and 600 with full-disk encryption. SecretRef providers (env, file, exec, store) and a 1Password plugin are optional (https://docs.openclaw.ai/gateway/security/secrets-and-storage)" }, { "label": "Memory", "value": "Markdown files in the workspace, default `~/.openclaw/workspace`. `USER.md` for preferences, `MEMORY.md` for long-term facts, daily notes under `memory/`, indexed for `memory_search`. Delete by editing the files or with `openclaw memory forget --agent \u003cid\u003e --session \u003cid\u003e`, which has a `--dry-run` preview" }, { "label": "Model providers", "value": "More than 60 provider pages in the docs, among them Anthropic, OpenAI, Google, Bedrock, OpenRouter, Ollama, LM Studio, llama.cpp and vLLM. Prompts and tool output go to the provider the owner configures. ChatGPT and Claude subscriptions can be used in place of API keys" }, { "label": "Channels", "value": "34 entries in the channel catalogue, among them WhatsApp, Telegram, Slack, Discord, iMessage, Signal, Microsoft Teams, Google Chat, Matrix, SMS through Twilio, LINE, WeChat and X, plus the built-in WebChat. Telephony through a voice-call plugin (https://docs.openclaw.ai/channels)" }, { "label": "Proactive work", "value": "Heartbeat turns every 30 minutes by default, scheduled automations with cron-style timing, webhooks, Gmail and IMAP triggers, and standing orders loaded from `AGENTS.md` each session" }, { "label": "Monthly cost", "value": "The software is free. The owner pays the model provider for every reply, tool call and heartbeat turn, plus any search, speech or media API configured. `/usage cost` and the Control UI show local estimates, not a provider invoice (https://docs.openclaw.ai/reference/api-usage-costs)" }, { "label": "MCP", "value": "Client over Streamable HTTP, SSE and stdio with OAuth, configured under `mcp.servers` and subject to tool policy. `openclaw mcp serve` exposes channel conversations to another MCP client over stdio (https://docs.openclaw.ai/tools/mcp)" }, { "label": "Releases", "value": "Calendar versions on four channels (stable, extended-stable, beta, dev). v2026.10.2 was published on 12 October 2026. Stable tags in the last 90 days are 2026.8.1, 8.2, 9.1 to 9.9, 10.1 and 10.2" }, { "label": "Activity", "value": "391.8k stars, 82.4k forks, more than 5,000 open issues and about 3,300 open pull requests on GitHub, with 748 open issues labelled bug (checked 2026-10-12)" } ], "provenance": { "legalEntity": "OpenClaw Foundation", "domain": "openclaw.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/openclaw/openclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The README and the `LICENSE` file name the OpenClaw Foundation, described as an independent 501(c)(3). Its site at www.openclaw.org gave no address, registration number, board or filings on the page we read.", "No terms of service were found for the software, so the MIT licence stands in.", "The privacy policy at openclaw.ai/privacy, effective 2 August 2026, covers the iOS and Android apps, the Chrome extension and website analytics, and says it does not cover the gateway, server or AI provider the owner connects. It is not linked here for that reason.", "openclaw.ai/.well-known/security.txt returned 404 on 12 October 2026. The repository has a SECURITY.md with private GitHub reporting and security@openclaw.ai.", "There is no hosted endpoint. A Gateway answers on its owner's own host. The daily update check goes to telemetry.openclaw.ai.", "The domain registration date was not looked up." ], "score": 53, "checks": [ { "check": "Legal entity named", "value": "OpenClaw Foundation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "openclaw.ai, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openclaw.json" }, "verify": { "accepts": "a page on openclaw.ai or one of its subdomains, or the README of github.com/openclaw/openclaw", "badgeUrl": "https://www.anchorterminal.com/badges/openclaw.svg", "body": { "slug": "openclaw", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/openclaw", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/openclaw\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/openclaw.svg\" alt=\"OpenClaw on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![OpenClaw on Anchor Terminal](https://www.anchorterminal.com/badges/openclaw.svg)](https://www.anchorterminal.com/tools/openclaw)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/openclaw\"\u003eOpenClaw on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/openclaw", "json": "https://www.anchorterminal.com/tools/openclaw.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/openclaw.md", "slim": "https://www.anchorterminal.com/tools/openclaw.min.md" }, "markdown": "## Overview\n\n**Grade B · 67.1/100 · rank #270 of 986 · #4 in Personal assistants · not agent-ready · confidence medium**\n\n\n## Assessment\n\nSelf-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | OpenClaw Foundation (https://openclaw.ai) |\n| Kind | Agent harness |\n| Category | Personal assistants (https://www.anchorterminal.com/categories/personal-assistants) |\n| Auth | OAuth or key · No OpenClaw account exists. The owner supplies model provider API keys or signs in with a ChatGPT or Claude subscription, and adds a bot token, QR pairing or OAuth grant for each channel and account. Clients reach the Gateway with a token or password (`gateway.auth.mode`), or through a trusted proxy, and paired devices hold their own tokens. Operator scopes (`operator.read`, `operator.write`, `operator.admin` and others) apply to paired clients, but a shared-secret bearer token on `POST /tools/invoke` gets full operator access whatever scopes the caller sends (https://docs.openclaw.ai/gateway/tools-invoke-http-api; https://docs.openclaw.ai/gateway/operator-scopes). |\n| Pricing | Free (Free · OSS) · Free under the MIT licence, with no paid tier, hosted service or subscription. The owner pays the model provider for usage, or nothing with a local model, plus any search, speech or media API they configure (https://github.com/openclaw/openclaw; https://docs.openclaw.ai/reference/api-usage-costs). |\n| x402 | No · No x402, MPP or L402 in the docs or the source (checked 2026-10-12). |\n| Licence | MIT |\n| Packages | npm: `openclaw`; oci: `ghcr.io/openclaw/openclaw` |\n| Source | https://github.com/openclaw/openclaw |\n| Docs | https://docs.openclaw.ai |\n| llms.txt | https://docs.openclaw.ai/llms.txt |\n| Last release | 2026-10-12 |\n| GitHub stars | 391,800 (as of 2026-10-12) |\n| Where it runs | A Gateway process on the owner's computer or server, bound to loopback on a regular host install. Installers for macOS, Linux and Windows, an npm package for Node 24.16+ or 26.1+, desktop apps, and a container image at ghcr.io/openclaw/openclaw, which defaults to an exposed bind (https://docs.openclaw.ai/gateway/security) |\n| What it does without asking | By default host commands run with no approval, file tools have full access and the message tool can send to any configured conversation. Persistent config changes from a restricted chat session ask for approval with a card or `/approve \u003cid\u003e allow-once\\|deny`. Free-text replies such as yes never authorise a change (https://docs.openclaw.ai/gateway/permission-modes) |\n| Approval controls | Session permission modes `read-only`, `guarded` (a human reviews exec after an allowlist), `workspace` (a model reviews and can escalate to a human) and `full`. Per-message `/exec ask=always`. Tool allow and deny lists and profiles `minimal`, `messaging`, `coding` and `full`. Optional Docker or Podman sandbox per agent or session |\n| Accounts | Google Workspace through the bundled `gog` skill and the separate gog CLI with OAuth (Gmail, Calendar, Drive, Contacts, Sheets, Docs), Gmail Pub/Sub triggers, an IMAP plugin that reads but does not send, GitHub, and anything reachable through MCP servers, skills or the browser. Scopes are whatever the owner grants each tool |\n| Credential storage | Under `~/.openclaw`. Channel credentials in `credentials/`, model auth profiles in a per-agent SQLite database, MCP OAuth tokens in `state/openclaw.sqlite`, tokens possibly in `openclaw.json`. Recommended permissions are 700 and 600 with full-disk encryption. SecretRef providers (env, file, exec, store) and a 1Password plugin are optional (https://docs.openclaw.ai/gateway/security/secrets-and-storage) |\n| Memory | Markdown files in the workspace, default `~/.openclaw/workspace`. `USER.md` for preferences, `MEMORY.md` for long-term facts, daily notes under `memory/`, indexed for `memory_search`. Delete by editing the files or with `openclaw memory forget --agent \u003cid\u003e --session \u003cid\u003e`, which has a `--dry-run` preview |\n| Model providers | More than 60 provider pages in the docs, among them Anthropic, OpenAI, Google, Bedrock, OpenRouter, Ollama, LM Studio, llama.cpp and vLLM. Prompts and tool output go to the provider the owner configures. ChatGPT and Claude subscriptions can be used in place of API keys |\n| Channels | 34 entries in the channel catalogue, among them WhatsApp, Telegram, Slack, Discord, iMessage, Signal, Microsoft Teams, Google Chat, Matrix, SMS through Twilio, LINE, WeChat and X, plus the built-in WebChat. Telephony through a voice-call plugin (https://docs.openclaw.ai/channels) |\n| Proactive work | Heartbeat turns every 30 minutes by default, scheduled automations with cron-style timing, webhooks, Gmail and IMAP triggers, and standing orders loaded from `AGENTS.md` each session |\n| Monthly cost | The software is free. The owner pays the model provider for every reply, tool call and heartbeat turn, plus any search, speech or media API configured. `/usage cost` and the Control UI show local estimates, not a provider invoice (https://docs.openclaw.ai/reference/api-usage-costs) |\n| MCP | Client over Streamable HTTP, SSE and stdio with OAuth, configured under `mcp.servers` and subject to tool policy. `openclaw mcp serve` exposes channel conversations to another MCP client over stdio (https://docs.openclaw.ai/tools/mcp) |\n| Releases | Calendar versions on four channels (stable, extended-stable, beta, dev). v2026.10.2 was published on 12 October 2026. Stable tags in the last 90 days are 2026.8.1, 8.2, 9.1 to 9.9, 10.1 and 10.2 |\n| Activity | 391.8k stars, 82.4k forks, more than 5,000 open issues and about 3,300 open pull requests on GitHub, with 748 open issues labelled bug (checked 2026-10-12) |\n| Capabilities | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client |\n| Tags | open-source, self-hosted, local, free, foundation, llms-txt, docker, typescript |\n| JSON | https://www.anchorterminal.com/api/v1/tools/openclaw.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-12 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 75 | 15.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 84 | 13.7 |\n| Agent ergonomics | 13% | 16.2 | 77 | 12.5 |\n| Security \u0026 auth | 14% | 17.5 | 74 | 12.9 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 86 | 7.5 |\n| Transparency \u0026 trust (editorial 82, provenance 53) | 7% | 8.8 | 68 | 6.0 |\n| Negative events | up to −15 | up to −15 | 2026-09-11. The project's security page and GitHub advisory list show 722 advisories published between 31 January and 11 September 2026, 14 critical, 249 high, 390 medium and 69 low, 39 with a CVE. The largest groups are Gateway auth and scopes (182) and exec, sandbox and approvals (160). The project says all 14 critical issues are fixed and disclosed and reports no known compromise of its infrastructure. Fixed and published, which decays the deduction, but the volume and the two areas affected bear directly on an assistant that holds its owner's accounts, -8. https://openclaw.ai/security; https://github.com/openclaw/openclaw/security/advisories | -8 |\n| **Total** | | | | **67.1 → B** |\n\n### Why each score\n\n- Reliability 75: Read with the local-software lines, as for the agent programs in the harness category. `openclaw` is on npm for Node 24.16+ or 26.1+, with install scripts, desktop apps for macOS, Windows and Linux and a GHCR image (20). The CI workflow on main showed 25 passing runs of 26 visible on 12 October 2026, the other in progress (25). 748 open issues carry the bug label among more than 5,000 open issues. The fifteen newest, all from 11 and 12 October, each had at least one comment, and nine concern failed updates from 2026.10.1 to 2026.10.2. The founder's post of 5 May 2026 describes two releases that slowed Gateways and broke installs (12 of 25). Versions are calendar-based, not semver. Each release has a changelog file with an upcoming deprecations section, and release notes list upgrade changes (9 of 15). A stable channel, an extended-stable channel and a 2.0 label exist, but the project's own maturity scorecard gives 68 per cent and the level Alpha (9 of 15).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 84: Harness reading of the framework line, as the Goose and OpenHands dossiers use. The Gateway WebSocket protocol is defined in TypeBox with JSON Schema export, the config has a documented schema, and optional OpenAI-compatible routes exist at `/v1/chat/completions` and `/v1/responses`. No OpenAPI file was found (18 of 25). llms.txt on both sites, and every docs page is served as Markdown with a `.md` suffix (10). Docs pages carry a `read_when` list and decision tables that say which mechanism fits which job (17 of 20). Config keys, permission modes and operator scopes are enumerated with defaults (12 of 15). Config examples on most pages and a rate-limit reference with the error each limit returns. No single error reference was found (12 of 15). A changelog file and a release notes page for every release, with dated tags (15).\n- Agent ergonomics 77: Harness reading, scored on what an owner or pipeline driving it has to supply. Tool profiles (`minimal`, `messaging`, `coding`, `full`), tool search, Code Mode and installed-skill search keep definitions out of the prompt until needed (21 of 25). Compaction, session pruning, loop detection, a 1,800 second default exec timeout and a light-context option for heartbeat turns. No spending cap was found (15 of 20). `openclaw agent exec` for headless runs, `--json` on CLI commands, `POST /tools/invoke`, and OpenAI-compatible HTTP routes that are off by default (16 of 20). Sessions persist and resume, with documented restart recovery, retries and model failover (16 of 20). An onboarding wizard reaches a first conversation, but the runtime is Node only and the defaults are full access with no sandbox (9 of 15).\n- Security \u0026 auth 74: Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. A daily update check sends version, operating system, Node.js version and architecture, and the service records Cloudflare-derived city-level location for three months even with `DO_NOT_TRACK` set. Feature statistics are opt-in and one setting stops every request. Credentials are kept in files and SQLite under `~/.openclaw`, guarded by file permissions unless a secret provider is configured (22). Four permission modes, exec approvals bound to the resolved executable, a model reviewer, Docker and Podman sandboxes, pairing codes for unknown senders and a loopback bind exist, but the default is full access, sandboxing is off, onboarding selects the full tool profile and sends need no approval (11). A prompt-injection page, boundary markers around external content, and restricted reader agents in the mail guides. The policy does not treat prompt injection alone as a vulnerability (12). A metadata-only audit ledger, transcripts, OpenTelemetry and Prometheus export, and `openclaw security audit` (13). SECURITY.md with private reporting, an incident response plan, a public page of advisory counts, a Trail of Bits audit reported on 21 September 2026, CodeQL and npm provenance. No bounty and no security.txt (16). The advisory record is counted under deductions.\n- Payments \u0026 pricing 60: Read with the self-hosted rule. No payment protocol in the docs or the source (0). Free under the MIT licence with no paid tier or hosted service to price, so 20, 20 and 20 on the last three lines. The owner pays a model provider separately, or runs a local model.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 86: v2026.10.2 was published on 12 October 2026 (30). 13 stable tags in the 90 days before, from 2026.8.1 on 30 August to 2026.10.2, after a gap of nearly seven weeks from 2026.7.1 on 13 July (20). The fifteen newest bug reports each had a comment within a day, some of them possibly from the project's triage automation, against more than 5,000 open issues and about 3,300 open pull requests (15 of 25). Desktop, mobile, npm and container builds ship from the same releases, with a plugin SDK package. Not in the MCP registry, which does not apply to an MCP client (12 of 15). Dependency audit and CodeQL workflows, a reviewed lockfile and npm provenance attestations, with passing CI (9 of 10).\n- Transparency \u0026 trust 68: MIT (30). The telemetry page names every field sent and a three-month retention, and the storage pages list what is written to disk and where. The privacy policy covers the mobile apps, the Chrome extension and website analytics and says it does not cover the Gateway, and the Foundation's site gave no address or registration details (20 of 30). Changelogs carry an upcoming deprecations section with dated removal targets, and an extended-stable channel exists. No written support policy stating how long a release is maintained was found (15 of 20). Telemetry is documented with `openclaw telemetry show`, an off switch and `DO_NOT_TRACK`, though the daily check and its location record are on by default (17 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (21 items): https://www.anchorterminal.com/fixes/openclaw.md (JSON https://www.anchorterminal.com/fixes/openclaw.json)\n\n### What we couldn't check\n\n- Kind is `harness`. The briefs define no kind for a personal assistant, and a self-hosted agent program that runs tools for its owner is closest to the harness kind used for Goose and OpenHands.\n- The lead dated the OpenClaw 2.0 blog post 31 August 2026. The blog shows 30 August 2026, and the v2026.8.1 tag is dated 30 August.\n- The star count is 391.8k as the repository page showed it on 12 October 2026. The exact figure in the lead was not re-read from the API.\n- unchecked: the 14 critical advisories were not read one by one. Their count, and the statement that all are fixed, come from the project's own security page and snapshot file.\n- unchecked: the docs were read from the repository clone at commit 30b2ef3, not from the rendered pages on docs.openclaw.ai, except robots.txt and llms.txt.\n- unchecked: whether replies on new issues come from maintainers or from the project's triage automation.\n- unchecked: the domain registration date, the Foundation's registration details, and the size of the default tool definitions.\n- unchecked: ClawHub, the skill and plugin registry at clawhub.ai, was not read. The security page says it blocks skills marked malicious and excludes third-party skills from its status.\n- No terms of service and no privacy policy covering the Gateway were found, so `provenance.terms` and `provenance.privacy` are empty.\n- The -8 for the advisory record is a judgement. The count partly reflects a project that publishes every fix as an advisory, and no compromise is reported.\n\n### Sources\n\n- repository README: \u003chttps://github.com/openclaw/openclaw\u003e (seen 2026-10-12)\n- security policy (source clone, commit 30b2ef3 of 12 October 2026): \u003chttps://github.com/openclaw/openclaw/blob/main/SECURITY.md\u003e (seen 2026-10-12)\n- security status page: \u003chttps://openclaw.ai/security\u003e (seen 2026-10-12)\n- security snapshot file linked from the status page: \u003chttps://openclaw.ai/security/snapshot.json\u003e (seen 2026-10-12)\n- GitHub security advisories, first page: \u003chttps://github.com/openclaw/openclaw/security/advisories\u003e (seen 2026-10-12)\n- advisory GHSA-9m4p-cqp4-jppq: \u003chttps://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq\u003e (seen 2026-10-12)\n- privacy policy for apps, extension and websites: \u003chttps://openclaw.ai/privacy\u003e (seen 2026-10-12)\n- blog index: \u003chttps://openclaw.ai/blog\u003e (seen 2026-10-12)\n- blog, OpenClaw Had a Rough Week: \u003chttps://openclaw.ai/blog/openclaw-rough-week\u003e (seen 2026-10-12)\n- blog, Trail of Bits audit recap: \u003chttps://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap\u003e (seen 2026-10-12)\n- blog, OpenClaw 2.0, Accidentally: \u003chttps://openclaw.ai/blog/openclaw-2-accidentally\u003e (seen 2026-10-12)\n- site llms.txt: \u003chttps://openclaw.ai/llms.txt\u003e (seen 2026-10-12)\n- docs llms.txt: \u003chttps://docs.openclaw.ai/llms.txt\u003e (seen 2026-10-12)\n- GitHub releases: \u003chttps://github.com/openclaw/openclaw/releases\u003e (seen 2026-10-12)\n- CI workflow runs on main: \u003chttps://github.com/openclaw/openclaw/actions/workflows/ci.yml?query=branch%3Amain\u003e (seen 2026-10-12)\n- open issues labelled bug: \u003chttps://github.com/openclaw/openclaw/issues?q=is%3Aissue+is%3Aopen+label%3Abug\u003e (seen 2026-10-12)\n- npm package record: \u003chttps://registry.npmjs.org/openclaw/latest\u003e (seen 2026-10-12)\n- Foundation site: \u003chttps://www.openclaw.org/\u003e (seen 2026-10-12)\n- permission modes (read in the source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/permission-modes.md\u003e (seen 2026-10-12)\n- exec tool and defaults (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/tools/exec.md\u003e (seen 2026-10-12)\n- tool and agent permissions (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/security/tool-permissions.md\u003e (seen 2026-10-12)\n- prompt injection (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/security/prompt-injection.md\u003e (seen 2026-10-12)\n- secrets, storage and logs (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/security/secrets-and-storage.md\u003e (seen 2026-10-12)\n- telemetry and update checks (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/telemetry.md\u003e (seen 2026-10-12)\n- memory overview and memory provenance (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/concepts/memory.md\u003e (seen 2026-10-12)\n- heartbeat (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/heartbeat.md\u003e (seen 2026-10-12)\n- standing orders (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/automation/standing-orders.md\u003e (seen 2026-10-12)\n- channel catalogue (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/channels/index.md\u003e (seen 2026-10-12)\n- MCP client guide (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/tools/mcp.md\u003e (seen 2026-10-12)\n- API usage and costs (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/reference/api-usage-costs.md\u003e (seen 2026-10-12)\n- tools invoke HTTP API and operator scopes (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/gateway/tools-invoke-http-api.md\u003e (seen 2026-10-12)\n- release channels (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/install/development-channels.md\u003e (seen 2026-10-12)\n- maturity scorecard (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/maturity/scorecard.md\u003e (seen 2026-10-12)\n- incident response plan (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/docs/security/incident-response.md\u003e (seen 2026-10-12)\n- gog skill for Google Workspace (source clone): \u003chttps://github.com/openclaw/openclaw/blob/main/skills/gog/SKILL.md\u003e (seen 2026-10-12)\n\n## Who's behind it (provenance 53/100, checked 2026-10-12)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | OpenClaw Foundation | 20/20 |\n| Domain age | openclaw.ai, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | nothing hosted, so the MIT licence stands in | 10/10 |\n| Privacy policy | nothing hosted, not scored | n/a |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe README and the `LICENSE` file name the OpenClaw Foundation, described as an independent 501(c)(3). Its site at www.openclaw.org gave no address, registration number, board or filings on the page we read.\n\nNo terms of service were found for the software, so the MIT licence stands in.\n\nThe privacy policy at openclaw.ai/privacy, effective 2 August 2026, covers the iOS and Android apps, the Chrome extension and website analytics, and says it does not cover the gateway, server or AI provider the owner connects. It is not linked here for that reason.\n\nopenclaw.ai/.well-known/security.txt returned 404 on 12 October 2026. The repository has a SECURITY.md with private GitHub reporting and security@openclaw.ai.\n\nThere is no hosted endpoint. A Gateway answers on its owner's own host. The daily update check goes to telemetry.openclaw.ai.\n\nThe domain registration date was not looked up.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The MIT licence stands in and the check scores in full.\n\n\n**Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored.\n\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- State, memory and credentials stay under `~/.openclaw` on the owner's machine, and the project sells no hosted service or paid tier\n- Memory is plain Markdown files in the workspace, and `openclaw memory forget` removes what a named session contributed\n- Four session permission modes (`read-only`, `guarded`, `workspace`, `full`), exec approvals and an optional Docker or Podman tool sandbox\n- Unknown direct-message senders get a pairing code by default and are ignored until the owner approves them\n- Telemetry is documented field by field. Feature statistics are opt-in and `update.checkOnStart: false` stops every automatic request\n- 13 stable releases in the 90 days to 12 October 2026, with npm provenance attestations on the published package\n\n## Weaknesses\n\n- Without configuration the default is full access. Host exec runs with no approval and sandboxing is off\n- Agents with the message tool can send across conversations and channel providers by default, with no approval step for a send\n- 722 advisories published between 31 January and 11 September 2026, 14 critical and 249 high, per the project's own security page\n- Credentials sit in files and SQLite databases under `~/.openclaw`, protected by file permissions unless the owner configures a secret provider\n- The project's own maturity scorecard rates the product at 68 per cent, labelled Alpha\n- The privacy policy covers the mobile apps, the Chrome extension and website analytics, and says it does not cover the Gateway\n\n## Before you call it (notes for agents)\n\n1. Set a session permission mode of `guarded` or `workspace`, or `tools.exec.mode`, before connecting mail. The default runs host commands without approval\n2. Turn on `agents.defaults.sandbox` for any agent that reads mail, web pages or attachments. Sandboxing is off by default\n3. Set `tools.message.crossContext.allowAcrossProviders` and `allowWithinProvider` to `false` to confine sends to the current conversation\n4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny `gateway`, `cron`, `sessions_spawn` and `sessions_send` for it\n5. Run `openclaw security audit` after setup, and treat the Gateway token as an owner credential. `POST /tools/invoke` accepts it with full operator access\n\n## Connect\n\nInstall:\n\n```bash\ncurl -fsSL https://openclaw.ai/install.sh | bash # or: npm install -g openclaw@latest --allow-scripts=openclaw \u0026\u0026 openclaw onboard --install-daemon\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| ZeroClaw | BB | 70.2 | 161 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/zeroclaw.md |\n| NanoClaw | B | 68.3 | 229 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | no | https://www.anchorterminal.com/tools/nanoclaw.md |\n| Hermes Agent | B | 67.9 | 244 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/hermes-agent.md |\n| IronClaw | B | 66.7 | 288 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/ironclaw.md |\n| nanobot | B | 62.4 | 446 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanobot.md |\n| QwenPaw | B | 62.2 | 454 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/qwenpaw.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The README says state, memory and credentials live on the owner's hardware, prompts go to the model provider and chat platforms the owner configures, and the project has no paid tier, hosted service or token (source: \u003chttps://github.com/openclaw/openclaw\u003e)\n- Tools run on the host for the main session unless sandboxing is configured. The exec docs say no-approval host exec is the default for gateway and node, and sandboxing is off by default (source: \u003chttps://docs.openclaw.ai/tools/exec\u003e)\n- The permission modes page says that without exec settings or sandboxing the default is full access, and local onboarding sets `tools.profile` to `full` (source: \u003chttps://docs.openclaw.ai/gateway/permission-modes\u003e, \u003chttps://docs.openclaw.ai/gateway/config-tools/tool-policy\u003e)\n- Agents with message-tool access can send across conversations and channel providers by default. `tools.message.crossContext.allowAcrossProviders` defaults to `true` (source: \u003chttps://docs.openclaw.ai/gateway/security/tool-permissions\u003e)\n- Heartbeat runs a periodic agent turn in the main session every 30 minutes by default, or every hour with Anthropic OAuth, and sends alerts to the owner's direct message (source: \u003chttps://docs.openclaw.ai/gateway/heartbeat\u003e)\n- Standing orders in `AGENTS.md` grant the agent permanent authority for named programmes, with approval gates written as instructions to the model, not enforced by the Gateway (source: \u003chttps://docs.openclaw.ai/automation/standing-orders\u003e)\n- The security page counts 1,799 reports filed since January 2026 and 722 fixed and published, 39 with a CVE, 14 critical, 249 high, 390 medium and 69 low, as of 11 September 2026. It reports no known compromise of the project's infrastructure or install channels, reviewed 9 September 2026 (source: \u003chttps://openclaw.ai/security\u003e, \u003chttps://openclaw.ai/security/snapshot.json\u003e)\n- Trail of Bits audited the project through OpenAI's Patch the Planet initiative and filed 27 private advisories, 24 severity-rated (2 high, 16 medium, 6 low). The project says every actionable issue was repaired (source: \u003chttps://openclaw.ai/blog/openclaw-trail-of-bits-engagement-recap, 21 September 2026\u003e)\n- The founder's post of 5 May 2026 says releases 2026.4.24 and 2026.4.29 slowed Gateways, left some installs in plugin repair loops and degraded Discord, Telegram and WhatsApp channels (source: \u003chttps://openclaw.ai/blog/openclaw-rough-week\u003e)\n- Version 2026.8.1, also called OpenClaw 2.0, was tagged on 30 August 2026 after nearly seven weeks without a release. The blog says it holds about half of all pull requests ever merged (source: \u003chttps://openclaw.ai/blog/openclaw-2-accidentally\u003e)\n- A daily update check sends the version, operating system, Node.js version and CPU architecture to telemetry.openclaw.ai. Cloudflare-derived country, region, city and timezone are recorded for three months, including when `DO_NOT_TRACK` is set (source: \u003chttps://docs.openclaw.ai/gateway/telemetry\u003e)\n- Memory is Markdown in the agent workspace (`USER.md`, `MEMORY.md`, dated notes under `memory/`), and a default dreaming sweep distils daily notes into `MEMORY.md` (source: \u003chttps://docs.openclaw.ai/concepts/memory\u003e)\n- Session transcripts are stored on disk and can contain pasted secrets, file contents and command output. Log and transcript redaction is always on (source: \u003chttps://docs.openclaw.ai/gateway/security/secrets-and-storage\u003e)\n- The security policy says prompt injection without a policy, auth, approval, sandbox or tool-boundary bypass is not treated as a vulnerability, and that one Gateway is one trust boundary, not a multi-tenant one (source: \u003chttps://github.com/openclaw/openclaw/blob/main/SECURITY.md\u003e)\n- The generated maturity scorecard in the repository gives an overall score of 68 per cent with the level Alpha, quality 65 per cent and completeness 71 per cent (source: \u003chttps://github.com/openclaw/openclaw/blob/main/docs/maturity/scorecard.md\u003e)\n- The OpenClaw Foundation is described as an independent 501(c)(3) that employs the core team and signs releases. Donors named are Amazon, Lobster Computer Company, Offline Holdings, OpenAI, Red Hat and the University of Michigan (source: \u003chttps://github.com/openclaw/openclaw\u003e)\n- The link to a trust page in SECURITY.md, trust.openclaw.ai, redirects to the blog's security section (checked 2026-10-12)\n\n- #4 of 20 in Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md\n- All 190 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md\n\n## Compare\n\n- [AstrBot vs OpenClaw](https://www.anchorterminal.com/compare/astrbot-vs-openclaw.md): C 58.8 vs B 67.1\n- [CowAgent vs OpenClaw](https://www.anchorterminal.com/compare/cowagent-vs-openclaw.md): C 58.5 vs B 67.1\n- [GAIA vs OpenClaw](https://www.anchorterminal.com/compare/gaia-vs-openclaw.md): D 49.5 vs B 67.1\n- [Gemini Spark vs OpenClaw](https://www.anchorterminal.com/compare/gemini-spark-vs-openclaw.md): F 24.5 vs B 67.1\n- [Grok Bot vs OpenClaw](https://www.anchorterminal.com/compare/grok-bot-vs-openclaw.md): E 45.2 vs B 67.1\n- [Haven vs OpenClaw](https://www.anchorterminal.com/compare/haven-vs-openclaw.md): F 22.2 vs B 67.1\n- [Hermes Agent vs OpenClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-openclaw.md): B 67.9 vs B 67.1\n- [Instinct vs OpenClaw](https://www.anchorterminal.com/compare/instinct-vs-openclaw.md): F 11.4 vs B 67.1\n- [IronClaw vs OpenClaw](https://www.anchorterminal.com/compare/ironclaw-vs-openclaw.md): B 66.7 vs B 67.1\n- [Leon vs OpenClaw](https://www.anchorterminal.com/compare/leon-vs-openclaw.md): E 41 vs B 67.1\n- [Lindy vs OpenClaw](https://www.anchorterminal.com/compare/lindy-vs-openclaw.md): F 32.3 vs B 67.1\n- [nanobot vs OpenClaw](https://www.anchorterminal.com/compare/nanobot-vs-openclaw.md): B 62.4 vs B 67.1\n- [NanoClaw vs OpenClaw](https://www.anchorterminal.com/compare/nanoclaw-vs-openclaw.md): B 68.3 vs B 67.1\n- [Dots vs OpenClaw](https://www.anchorterminal.com/compare/openai-dots-vs-openclaw.md): F 28.3 vs B 67.1\n- [OpenClaw vs PicoClaw](https://www.anchorterminal.com/compare/openclaw-vs-picoclaw.md): B 67.1 vs D 46.1\n- [OpenClaw vs Poke](https://www.anchorterminal.com/compare/openclaw-vs-poke.md): B 67.1 vs F 37.6\n- [OpenClaw vs QwenPaw](https://www.anchorterminal.com/compare/openclaw-vs-qwenpaw.md): B 67.1 vs B 62.2\n- [OpenClaw vs ZeroClaw](https://www.anchorterminal.com/compare/openclaw-vs-zeroclaw.md): B 67.1 vs BB 70.2\n- [OpenClaw vs Zo Computer](https://www.anchorterminal.com/compare/openclaw-vs-zo-computer.md): B 67.1 vs E 43.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on openclaw.ai or one of its subdomains, or the README of github.com/openclaw/openclaw. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"openclaw\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/openclaw\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/openclaw.svg\" alt=\"OpenClaw on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![OpenClaw on Anchor Terminal](https://www.anchorterminal.com/badges/openclaw.svg)](https://www.anchorterminal.com/tools/openclaw)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/openclaw\"\u003eOpenClaw on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say OpenClaw is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/openclaw-dark.png\n- Light: https://www.anchorterminal.com/assets/share/openclaw-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Personal assistants", "url": "https://www.anchorterminal.com/categories/personal-assistants" }, { "name": "OpenClaw", "url": "" } ], "description": "Open-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.", "facts": [ "rank #270 of 986", "OAuth or key auth", "0 desk reviews" ], "h1": "OpenClaw", "image": "https://www.anchorterminal.com/assets/og/tools-openclaw.png", "path": "/tools/openclaw", "published": "2026-10-01", "section": "tools", "title": "OpenClaw review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/tools/openclaw" }, "tokens": { "markdown": 8950, "slim": 2180 }, "version": 1 }