# ZeroClaw (slim)

> Open-source personal AI assistant from ZeroClaw Labs, shipped as one Rust binary the owner runs. It answers on chat, email and voice channels, calls tools and MCP servers, and keeps memory in local SQLite.

- Full: https://www.anchorterminal.com/tools/zeroclaw.md (~8,600 tokens) · this version ~2,330 tokens · JSON https://www.anchorterminal.com/tools/zeroclaw.json · canonical https://www.anchorterminal.com/tools/zeroclaw
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**BB · 70.2/100 · rank #161 of 986 · #1 in Personal assistants · agent-ready · confidence medium**


Assessment: Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

## Facts

- Kind: Agent harness · vendor: ZeroClaw Labs · category: Personal assistants · legal entity: ZeroClaw Labs · provenance 53/100
- Packages: oci `ghcr.io/zeroclaw-labs/zeroclaw`
- Auth: None · pricing: Free · x402: no · licence: MIT OR Apache-2.0
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: One Rust binary on the owner's machine, VPS or single-board computer, as a CLI, a daemon or a system service. State lives under `~/.zeroclaw/` (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/runtime-state-and-persistence.md)
- Acts without asking: By default `file_read`, `memory_recall`, `web_search_tool`, `web_fetch`, `calculator`, `glob_search`, `content_search`, `image_info`, `weather`, `tool_search` and `browser_open` run unprompted. Replies to accepted senders are sent without a prompt. Every other tool asks (https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/schema.rs)
- Approval controls: Three levels on a risk profile, `readonly`, `supervised` (default) and `full`. Per-tool `auto_approve`, `always_ask` and `excluded_tools`, a shell command allow list, optional one-time codes and `zeroclaw estop`. Prompts time out to a denial after 120 seconds (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/autonomy.md)
- Sandbox: Auto-detected. Landlock, Bubblewrap, Firejail or Docker on Linux, Seatbelt on macOS, AppContainer (experimental) on Windows. Files are confined to the workspace. Network egress stays open by default (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/sandboxing.md)
- Proactive work: Cron jobs the agent can create (`cron_add`), an optional heartbeat every 30 minutes that is off by default, and event-triggered procedures from MQTT, webhooks, cron and file changes
- Channels: The default build has ACP, webhook, email, Telegram, Discord and filesystem. Standard release builds add Git, Matrix, Lark and WhatsApp Web. Slack, Signal, LINE, Mattermost, iMessage, voice calls and others need compile-time flags. The site says 30+ (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/overview.md)
- Who can message it: Senders are checked against `[peer_groups.<name>]`. An empty set denies everyone and `"*"` accepts anyone. The gateway requires a pairing token by default (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/channels/peer-groups.md)
- Accounts: Mail by IMAP and SMTP with an app password, or Gmail push with an OAuth token. Opt-in tools for Google Workspace (through the external `gws` CLI, all 14 services unless narrowed), Microsoft 365, Notion, Jira, LinkedIn and Composio
- Credential storage: Secret fields in `config.toml` are encrypted with ChaCha20-Poly1305. The key is `~/.zeroclaw/.secret_key`, mode 0600, on the same disk. Google Workspace credentials stay with the `gws` CLI (https://github.com/zeroclaw-labs/zeroclaw/blob/master/crates/zeroclaw-config/src/secrets.rs)
- Memory: SQLite under `data/memory/` by default, with Markdown, PostgreSQL, Qdrant and Lucid as alternatives. Conversation autosave is on by default. Session history is a separate SQLite file
- Deleting memory: `memory_forget` removes one entry and `memory_purge` a namespace or session. The Markdown backend is append-only and does not delete entries. Session history, logs and the cost ledger are separate files (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/architecture/decisions/ADR-005-pluggable-memory-backends.md)
- Model providers: Anthropic, OpenAI, Gemini, Bedrock, Azure OpenAI, Ollama and any OpenAI-compatible endpoint, with the owner's key. Prompts, recalled memory and tool results go to the chosen provider. The site says 70+ providers, the README about 20 others
- Other outbound traffic: The docs state no telemetry. Web search goes to DuckDuckGo by default. The `zerorouter` provider slot defaults to the vendor's hosted beta at zerorouter.ai when chosen
- MCP client: stdio, HTTP and SSE. A server reaches an agent only through that agent's `mcp_bundles`. Tools are named `<server>__<tool>` (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/tools/mcp.md)
- Interfaces for other programs: Gateway REST and WebSocket on 127.0.0.1:42617 with an OpenAPI document at `/api/openapi.json`, ACP over stdio, and `zeroclaw agent -a <alias> -m`
- Audit: Approval events and runtime logs go to `data/state/runtime-trace.jsonl`. Command execution is not audited. Tool receipts (HMAC-SHA256) are opt-in with an in-memory key (https://github.com/zeroclaw-labs/zeroclaw/blob/master/docs/book/src/security/model.md)
- Cost: Free. The owner pays the model provider, or nothing with a local model. Daily and monthly budgets and a cost ledger are built in
- Releases in 90 days: 3 (v0.8.3 on 16 July, v0.8.4 on 2 August, v0.8.5 on 5 September 2026)

- Scores: Reliability 74, Performance pending, Schema & documentation 82, Agent ergonomics 72, Security & auth 76, Payments & pricing 60, Task success pending, Maintenance & community 80, Transparency & trust 64 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as software the owner runs. · Schema & documentation, Harness reading of the six lines, as the Goose dossier used. · Agent ergonomics, Harness reading. · Security & auth, Harness reading, with 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for au… · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v0.8.5 was released on 5 September 2026, 37 days before this check (20 of 30). · Transparency & trust, MIT or Apache-2.0, with a CLA that leaves copyright with contributors (30).
- Sources: 38, open questions: 10, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/zeroclaw.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/zeroclaw.svg` or a link to https://www.anchorterminal.com/tools/zeroclaw from a page on zeroclaw.com or one of its subdomains, or the README of github.com/zeroclaw-labs/zeroclaw, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Keep `[risk_profiles.<alias>] level = "supervised"`. `full` runs every tool not listed in `always_ask`, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as `send_via`, `google_workspace` and `http_request` to `always_ask` so a session-level Always grant cannot skip the prompt
3. List senders in `[peer_groups.<name>] external_peers`. `["*"]` accepts anyone on that channel
4. Set `[web_fetch].allowed_domains` and `[http_request].allowed_domains`. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with `zeroclaw agent -a <alias> -m "<task>"`. A cron or webhook turn has no prompt, so shell calls fall to the command policy

## Connect

```bash
curl -fsSL https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/install.sh | sh   # or: brew install zeroclaw
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |
| nanobot | B | 62.4 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/nanobot.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)