PersonalClaw

A self-hosted personal AI agent — an agentic operating system for one person.

Chat, autonomous goal loops, long-term memory, a knowledge base, skills, scheduled automation, and channel integrations — all behind one gateway process and one web dashboard you own. Local-first, provider-agnostic, zero telemetry, MIT.

Website · Core · Apps · Docs · Latest release · Discussions

_{The dashboard — one home for tasks, active work, and context-aware suggestions. Dark theme shown; PersonalClaw ships light and dark.}

PersonalClaw runs AI agents that accomplish your work with a rich, user-assembled set of capabilities. Every vendor — model providers, search, speech, channels, agent runtimes — is a removable app, so nothing ties you to a single LLM vendor or service. All state lives under one ~/.personalclaw home on your machine; the system degrades gracefully to local-only and never requires the network for core operation.

It is deliberately single-user and self-hosted: your conversations, memory, and knowledge never leave your machine unless you wire up a remote provider app. There is no telemetry — not as a setting, but as an architectural choice.

flowchart TB
    U["👤 You — dashboard · CLI · channels"] --> GW["🦞 Gateway (one process)"]
    subgraph core["Provider-agnostic core"]
        GW --> CHAT["Agentic Chat"]
        GW --> LOOP["Goal Loops"]
        GW --> AUTO["Automation · Triggers · Inbox"]
        CHAT & LOOP & AUTO --> ENG["Context Engine · Approvals · Guardrails"]
        ENG --> MEM["Memory"]
        ENG --> KN["Knowledge"]
        ENG --> SK["Skills"]
    end
    ENG --> APPS["App Platform (permission-gated, scanner-gated)"]
    APPS --> P1["Model providers"]
    APPS --> P2["Search · Speech · Local models"]
    APPS --> P3["Channels · Agent runtimes (ACP)"]
    APPS -. "removable, sandboxed" .-> EXT[("Your vendors & tools")]

Start with PersonalClaw. It is the only source of product truth: the apps repo follows it, and the website projects released core state — it never advertises ahead of a real release. Everything else in this org exists because core points at it.

Four exemplar apps, one per provider contract, each installable through the Store from its own git URL and each listed in the registry. They are deliberately tiny and heavily commented — the README of each is a lesson in the contract it implements.

The full contract is in the app creation guide, and personalclaw app new --type <kind> scaffolds a working app in one command.

Tool approval modes, a shell-command denylist, an egress guard with allow/deny host policy, a tamper-evident (HMAC) security event log, app-scoped tokens, and honest labeling of the one permission it can't technically enforce. Controls are enforced at the point of execution, not merely requested in a prompt — the threat model maps each to the OWASP Agentic Top-10 with code citations and states the limitations plainly.

_{Chat · goal loops · knowledge · memory — the full showcase (every screen, light and dark) lives in the core repo.}

Install with one command — every path installs the same release artifact, and you don't need to install Python or Node yourself:

uv tool install personalclaw && personalclaw setup     # recommended — uv brings Python 3.12

Or use the bootstrap one-liner (installs uv if it's missing, then the above):

curl -fsSL https://personalclaw.dev/install | sh

Then start the gateway and open the dashboard at http://localhost:10000:

personalclaw gateway

Install a model-provider app from the Store, add your API key under Settings → Providers, and bind a chat model under Settings → Models. Full walkthrough in Getting started. Also available via pipx, pip (into an existing Python 3.12+ venv), Docker Compose, or a git checkout for development.

Which version you just installed, what changed in it, and its SBOM and provenance attestations are all on the latest release; the running history is in the changelog.

_{The Store — 69 first-party apps, each installed through a quarantine → security-scan → consent lifecycle.}

PersonalClaw follows a clean-break engineering doctrine: when a design is replaced, the old path is removed in the same change rather than carried behind compatibility shims. The upshot for early users:

• The next few minor (0.x) releases may introduce breaking changes with no automatic migration of your existing data under ~/.personalclaw.
• Back up before every update — personalclaw snapshot creates a portable archive (restore with personalclaw restore).
• Treat anything you put in PersonalClaw as reproducible or backed up elsewhere until backward-compatibility becomes the default posture. The migration-backed regime — gated changes that carry your data forward — is deliberately deferred until the architecture stops moving, on the way to 1.0; the reasoning is in CONTRIBUTING § the lifecycle mental model.

We'd rather tell you plainly now than surprise you on an update.

Every commit needs a Signed-off-by line (git commit -s) — CI enforces the DCO. Running npm install once in your clone installs the hooks that add it for you.

Supply chain. Releases build in CI from a committed lockfile; PyPI publishing uses Trusted Publishing (OIDC) behind a manual approval gate; every release ships a syft SBOM and build-provenance attestations.