ZeroClaw vs OpenClaw: Safe Defaults or the Bigger Ecosystem?

ZeroClaw and OpenClaw do the same job: a personal agent on your own hardware that you message from chat apps, with shell, browser and scheduled tasks. They disagree on defaults. OpenClaw starts open and leaves locking down to you. ZeroClaw starts locked down and lets you open it up.

Security defaults

This is the main reason to compare them.

OpenClaw’s sandboxing is off by default, and the agent can run commands on your host unless you turn on approvals. With access to email, messages and third-party skills, that leaves prompt injection and malicious skills as live risks. Our Is OpenClaw safe? guide goes through them.

ZeroClaw’s recommended Balanced risk profile is supervised: medium-risk actions need your approval, high-risk ones are blocked, file access stays inside the workspace, and tools run in an OS-level sandbox, Seatbelt on macOS and Firejail on Linux. Every tool call can carry a cryptographic receipt. A YOLO profile turns all of it off if you really want to. One caveat: its Docker sandbox backend isn’t picked automatically under the default native runtime.

Telemetry

OpenClaw checks in daily by default with your version, OS, Node.js version and CPU architecture, an install count and update reports; update.checkOnStart: false stops it. ZeroClaw’s docs say it has no telemetry, no cloud tenancy and no license server. Keys live in your config file and history in your own database.

Size, install and hardware

ZeroClaw is one Rust binary configured by one TOML file. It installs with a script, a prebuilt binary, Docker or a source build, can run as a system service, and runs on macOS, Linux, Windows, FreeBSD, Android and small boards such as a Raspberry Pi. It also drives hardware directly through GPIO on boards like the Raspberry Pi and ESP32.

OpenClaw is a TypeScript app that needs Node 24.16+ or 26.1+ (its installer provisions Node if missing). It installs with a script, npm, desktop apps, Docker or a one-click Railway deploy, and has native iOS and Android apps. The extra weight buys a lot: 142 official plugins and a large skills ecosystem.

The trade-off in setup: ZeroClaw’s quickstart command writes a working provider config, but channels and risk profiles mean editing the TOML file by hand, while OpenClaw’s desktop apps get a non-server user going faster.

Channels

ZeroClaw reaches more than 30 channels, but only Telegram, Discord, email, Matrix and WhatsApp Web come in the standard release. Slack, iMessage, Signal and others need a source build with extra features enabled. OpenClaw works in 29 channels, including WhatsApp, Telegram, iMessage, Slack, Discord and Microsoft Teams, with no rebuild. If your agent has to live in Slack or iMessage, OpenClaw is less work.

Models

Both are model-agnostic and run local models through Ollama. ZeroClaw adds fallback chains, so it can drop to a second provider when the first fails. OpenClaw lists 64 model and media providers. Either way you pay your model provider, and OpenClaw users have reported $100+ days on expensive models.

Maturity

OpenClaw is the larger project by far: 394,193 GitHub stars against ZeroClaw’s 33,269 when we checked on November 8, 2026, a nonprofit foundation behind it and very active development. ZeroClaw launched in February 2026 and was at v0.8.7 (GitHub). Both licenses are permissive: OpenClaw is MIT, ZeroClaw is MIT or Apache-2.0, your choice.

Verdict

• Run ZeroClaw if the agent will touch real accounts and you want approvals and a sandbox without configuring them, if you don’t want any telemetry, or if it’s going on a Raspberry Pi, a small VPS or a home-lab box. It’s our pick for most self-hosters who live in Telegram, Discord, WhatsApp or email.
• Run OpenClaw if you need Slack, iMessage or Teams without compiling, want phone and desktop apps, or depend on its plugin ecosystem. Turn on its sandbox and approvals, and set update.checkOnStart: false.

Still undecided? Our OpenClaw alternatives ranking puts the two side by side with the other options.