# QwenPaw (slim)

> Open-source personal assistant from the AgentScope team that the owner runs on their own machine or server. It answers on chat apps, runs scheduled and proactive tasks, manages a mailbox over IMAP and SMTP, and keeps memory as Markdown files.

- Full: https://www.anchorterminal.com/tools/qwenpaw.md (~8,300 tokens) · this version ~2,130 tokens · JSON https://www.anchorterminal.com/tools/qwenpaw.json · canonical https://www.anchorterminal.com/tools/qwenpaw
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 62.2/100 · rank #454 of 986 · #7 in Personal assistants · not agent-ready · confidence medium**


Assessment: Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

## Facts

- Kind: Agent harness · vendor: AgentScope · category: Personal assistants · legal entity: Qwenpaw PRIVATE LIMITED · provenance 53/100
- Local only (HTTP, stdio): pypi `qwenpaw`, oci `agentscope/qwenpaw`
- Auth: None · pricing: Free · x402: no · licence: Apache-2.0
- Probe metrics: not measured yet (probes haven't run)
- Interfaces: Web Console on 127.0.0.1:8088, terminal UI, desktop app (beta, Windows 10+ and macOS 14+), REST API at `POST /api/console/chat`, CLI, ACP (https://github.com/agentscope-ai/QwenPaw/blob/main/README.md)
- Channels: DingTalk, Feishu (Lark), iMessage (macOS), Discord, QQ, OneBot v11, WeCom, WeChat Personal, Telegram, Mattermost, MQTT, Matrix, Yuanbao, XiaoYi, Voice, SIP, Azure Bot, Slack (https://github.com/agentscope-ai/QwenPaw/blob/main/website/public/docs/channels.en.md)
- Acts unasked: Heartbeat (off by default) and cron jobs run prompts on a schedule and post replies to a channel. `/proactive` checks every 30 seconds, acts after 30 idle minutes and runs web, browser, file and shell tools with approval prompts skipped. Mail automation wakes the agent for each new message
- Approvals: `approval_level` STRICT, SMART, AUTO (default) or OFF per agent. AUTO asks only for calls a Tool Guard rule flags. MCP clients carry an allow, deny or ask policy per tool and per source, with `deny` as the default effect when no rule matches
- Accounts: One mailbox per agent over IMAP and SMTP on nine consumer domains (163.com, 126.com, yeah.net, qq.com, foxmail.com, sina.com, sina.cn, aliyun.com, gmail.com), using an authorisation code or app password with full send and receive access. No enterprise, custom-domain or Microsoft mailboxes. No calendar connector found
- Mail tools: 22 tools in the bundled qwenpawmail MCP server, 11 read-only, 9 write and 2 destructive. New driver cards use `ask`. Automatic handling may not call `delete_message` and may write only to the original sender or a contact in `CONTACTS.md`
- Credentials: Model keys in `~/.qwenpaw.secret/providers.json`, tool variables in `envs.json` and mail secrets in the workspace `credentials.yaml`, encrypted with Fernet. The master key sits in the OS keychain, or in `.master_key` with mode 0600
- Memory: Markdown files in the agent workspace (`MEMORY.md`, `memory/`, `digest/`, `mem_session/`), written by the default in-process ReMe backend every five user turns and consolidated nightly at 23:00. Deleted by removing files, `qwenpaw agents delete --remove-workspace` or `qwenpaw clean`. Optional ADBPG and PowerContext backends send memory to a remote service
- Models: Local through built-in llama.cpp, Ollama or LM Studio with no key. 21 cloud providers listed, among them DashScope, OpenAI, Azure OpenAI, Anthropic, Google Gemini, DeepSeek and OpenRouter. The chosen provider receives the conversation content
- Sandbox: Seatbelt on macOS, Bubblewrap or Landlock on Linux, AppContainer or restricted token on Windows. The whole filesystem is readable by default with writes limited to the workspace. Network is open by default, and containers fall back to `mode=none` with no isolation
- MCP client: stdio, streamable HTTP and SSE, with per-tool enable lists and access policies in `drivers/mcp/*.yaml`
- Telemetry: On by default. Version, install method, OS, Python version, CPU architecture, GPU presence and a random id go to an Alibaba Cloud Function Compute endpoint once a version. Main since 17 September 2026 also sends one event per active day. `QWENPAW_TELEMETRY_DISABLED` turns both off
- Cost: Free under Apache-2.0. Model usage is billed by the chosen provider, or nothing with a local model. The README describes a hosted deployment on AgentScope Platform as free
- Releases in 90 days: Four stable (2.0.1 on 24 July, 2.1.0 on 13 August, 2.2.0 on 3 September, 2.2.1 on 11 September 2026) and more than 20 tagged pre-releases, the latest 2.2.2-beta.4 on 30 September

- Scores: Reliability 70, Performance pending, Schema & documentation 68, Agent ergonomics 67, Security & auth 60, Payments & pricing 60, Task success pending, Maintenance & community 73, Transparency & trust 56 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as the Goose, OpenHands and Khoj dossiers are. · Schema & documentation, Harness reading, scored on what an owner or a pipeline has to read to drive it. · Agent ergonomics, Harness reading of the framework line. · Security & auth, Harness reading of the framework checklist, as for Goose and OpenHands. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, 2.2.2-beta.4 was tagged and published as a GitHub pre-release on 30 September 2026, 12 days before this check. · Transparency & trust, Apache-2.0 (30).
- Sources: 32, open questions: 12, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/qwenpaw.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/qwenpaw.svg` or a link to https://www.anchorterminal.com/tools/qwenpaw from a page on agentscope.io or one of its subdomains, or the README of github.com/agentscope-ai/QwenPaw, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `QWENPAW_TELEMETRY_DISABLED=true` before `qwenpaw init --defaults` or `qwenpaw app`. Both send usage data without asking
2. Set `approval_level` to `STRICT` or `SMART` in `agent.json`. The default `AUTO` runs every tool call no guard rule flags
3. Set `dm_policy` and `group_policy` to `allowlist` with `allow_from` on each channel. Both default to `open`
4. Set `QWENPAW_AUTH_ENABLED=true` before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on `ask` for `send_message`, `delete_message` and `delete_thread`, and turn on Mail Access Control with automatic handling

## Connect

```bash
pip install qwenpaw && qwenpaw init --defaults && qwenpaw app   # Python 3.11 to 3.13; or: docker pull agentscope/qwenpaw:latest
```

```bash
curl -X POST http://localhost:8088/api/console/chat -H "Content-Type: application/json" -H "X-Agent-Id: default" -d '{"input": [...]}'
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)