PersonalClaw

A self-hosted personal AI agent — an agentic operating system for one person.

Chat, autonomous goal loops, long-term memory, a knowledge base, skills, scheduled automation, and channel integrations — all behind one gateway process and one web dashboard you own. Local-first, provider-agnostic, zero telemetry, MIT.

Website · Core · Apps · Docs · Roadmap

_{The dashboard — one home for tasks, active work, and context-aware suggestions. Dark theme shown; PersonalClaw ships light and dark.}

PersonalClaw runs AI agents that accomplish your work with a rich, user-assembled set of capabilities. Every vendor — model providers, search, speech, channels, agent runtimes — is a removable app, so nothing ties you to a single LLM vendor or service. All state lives under one ~/.personalclaw home on your machine; the system degrades gracefully to local-only and never requires the network for core operation.

It is deliberately single-user and self-hosted: your conversations, memory, and knowledge never leave your machine unless you wire up a remote provider app. There is no telemetry — not as a setting, but as an architectural choice.

flowchart TB
    U["👤 You — dashboard · CLI · channels"] --> GW["🦞 Gateway (one process)"]
    subgraph core["Provider-agnostic core"]
        GW --> CHAT["Agentic Chat"]
        GW --> LOOP["Goal Loops"]
        GW --> AUTO["Automation · Triggers · Inbox"]
        CHAT & LOOP & AUTO --> ENG["Context Engine · Approvals · Guardrails"]
        ENG --> MEM["Memory"]
        ENG --> KN["Knowledge"]
        ENG --> SK["Skills"]
    end
    ENG --> APPS["App Platform (permission-gated, scanner-gated)"]
    APPS --> P1["Model providers"]
    APPS --> P2["Search · Speech · Local models"]
    APPS --> P3["Channels · Agent runtimes (ACP)"]
    APPS -. "removable, sandboxed" .-> EXT[("Your vendors & tools")]

PersonalClaw is one product across three public repos. Core is the only source of product truth; the apps repo follows it, and the website projects released core state — it never advertises ahead of a real release.

Tool approval modes, a shell-command denylist, an egress guard with allow/deny host policy, a tamper-evident (HMAC) security event log, app-scoped tokens, and honest labeling of the one permission it can't technically enforce. Controls are enforced at the point of execution, not merely requested in a prompt — the threat model maps each to the OWASP Agentic Top-10 with code citations and states the limitations plainly.

_{Chat · goal loops · knowledge · memory — the full showcase (every screen, light and dark) lives in the core repo.}

Install with one command — every path installs the same release artifact, and you don't need to install Python or Node yourself:

uv tool install personalclaw && personalclaw setup     # recommended — uv brings Python 3.12

Or use the bootstrap one-liner (installs uv if it's missing, then the above):

curl -fsSL https://personalclaw.dev/install | sh

Then start the gateway and open the dashboard at http://localhost:10000:

personalclaw gateway

Install a model-provider app from the Store, add your API key under Settings → Providers, and bind a chat model under Settings → Models. Full walkthrough in Getting started. Also available via pipx, pip (into an existing Python 3.12+ venv), Docker Compose, or a git checkout for development.

_{The Store — 38 first-party apps, each installed through a quarantine → security-scan → consent lifecycle.}

PersonalClaw follows a clean-break engineering doctrine: when a design is replaced, the old path is removed in the same change rather than carried behind compatibility shims. The upshot for early users:

• The next few minor (0.x) releases may introduce breaking changes with no automatic migration of your existing data under ~/.personalclaw.
• Back up before every update — personalclaw snapshot creates a portable archive (restore with personalclaw restore).
• Treat anything you put in PersonalClaw as reproducible or backed up elsewhere until backward-compatibility becomes the default posture (the post-1.0 lifecycle doctrine introduces gated, migration-backed changes).

We'd rather tell you plainly now than surprise you on an update.

• Build an app — an app is a directory with an app.json manifest that imports core only via personalclaw.sdk.*. Model providers, search, speech, channels, agent runtimes, and full backend + UI apps all use the same contract. See the app creation guide and platform architecture.
• Contribute to core — the contributing guide covers the engineering doctrine (clean-break-within-class, provider-agnostic core, validate-as-a-user) and dev setup.
• Supply chain — releases build in CI from a committed lockfile; PyPI publishing uses Trusted Publishing (OIDC) behind a manual approval gate; every release ships a syft SBOM and build-provenance attestations.
• Report a security issue — privately, via the security policy.