ZeroClaw Review: The Rust OpenClaw Alternative With Safe Defaults

ZeroClaw is a personal agent runtime from ZeroClaw Labs, first released in February 2026 and at 33,269 GitHub stars when we checked on November 8, 2026. It does what OpenClaw does, an agent on your own machine that you talk to from chat apps, but it ships as one Rust binary and starts from a locked-down position instead of an open one. That second part is the reason to look at it.

What you install

There is no Node or Python stack to manage. You get a single binary, through an install script, a prebuilt Windows binary, Docker images or a source build, and you configure it with one TOML file. It runs on macOS, Linux, Windows, FreeBSD and Android, and small enough to live on a Raspberry Pi. It can also install itself as a system service, which is what you want for an agent that should keep working after you close the terminal.

The TOML file is the main cost. A zeroclaw quickstart command, per the README, picks a provider and writes a working config, but anything past that, channels and risk profiles included, means reading the docs and editing the file. If you are used to configuring servers that way it will feel normal. If you wanted a browser-first setup, PicoClaw has a WebUI launcher for it, and nanobot bundles a browser WebUI.

Safety defaults

This is where ZeroClaw differs most from OpenClaw, which leaves sandboxing off by default. ZeroClaw’s recommended risk profile, called Balanced, is supervised:

• medium-risk actions wait for your approval
• high-risk actions are blocked
• file access is limited to the agent’s workspace
• tools run inside an OS-level sandbox: Seatbelt on macOS, Firejail on Linux

You can see these settings in the risk presets source and the sandboxing docs. Every tool call can also carry a cryptographic receipt, which helps when you want to audit what the agent actually did.

Two caveats. A YOLO profile exists and switches all of this off, so “sandboxed by default” holds only while you keep the recommended profile. And the Docker sandbox backend is not picked automatically under the default native runtime; if you want container isolation rather than Seatbelt or Firejail, you set it up yourself.

Privacy and telemetry

ZeroClaw’s own docs page, You own it, says it sends no telemetry and needs no cloud account or license server. API keys live in your config file and history in your own database. Your prompts still go to whichever model provider you configure, unless you point it at a local model through Ollama. That makes it one of the few tools on our list that is sandboxed and telemetry-free out of the box; the table on this page shows the full checklist.

Models and cost

It works with Anthropic, OpenAI and about 20 other providers, any OpenAI-compatible endpoint, or local models through Ollama. Fallback chains let it switch providers when one fails, which matters for an agent running unattended overnight. The software is free under MIT or Apache-2.0 (your choice), with no hosted plan to upsell you. What you pay is the model bill, and that is entirely on you.

On a small board, the binary is the light part. The model is the heavy part, so plan where it runs: a cloud provider, or Ollama on a bigger machine on your network.

Channels: check your build

ZeroClaw advertises more than 30 channels, but they are not all in the download. Per the channels overview, the standard release includes Telegram, Discord, email, Matrix and WhatsApp Web. Slack, iMessage, Signal and several others need a fuller build compiled from source with extra features. If Slack or iMessage is the reason you want an agent, plan for a Rust toolchain and a source build.

What it does well beyond chat

Besides shell, browser, HTTP and MCP tools, ZeroClaw has hardware tools for GPIO on Raspberry Pi, ESP32 and similar boards, plus cron jobs and event-triggered procedures. That combination, a small binary on a board that can flip pins and react to MQTT or a schedule, is unusual among these agents and is a real reason to pick it for home-lab automation. A web dashboard covers chat, memory, config and cron when you don’t want to edit TOML for every change.

Who should use it

ZeroClaw fits self-hosters who want an OpenClaw-style agent but don’t want to bolt safety on afterwards, and anyone running an agent on a small server or single-board computer. It is a weaker fit if you live in Slack or iMessage and don’t want to compile from source, or if you’d rather not edit config files.

How it compares

• Against OpenClaw: OpenClaw has over ten times the GitHub stars and a desktop app, but sandboxing is off by default and it sends telemetry by default. ZeroClaw has the stricter defaults. Our ZeroClaw vs OpenClaw page goes through it side by side.
• Against PicoClaw: also a single small binary for cheap hardware, written in Go. PicoClaw’s process isolation is off by default, and the project itself warns against production use before 1.0.
• Against NanoClaw and NemoClaw: both isolate the agent in containers, which is stronger separation but means running Docker. ZeroClaw’s OS sandbox needs no container runtime.

For the wider field, see our OpenClaw alternatives and best self-hosted AI agent lists.