OpenClaw Alternatives in 2026: Keep the Agent, Drop the Admin

Leaving OpenClaw usually comes down to one of three things: how much the agent can reach, how much upkeep it needs, or what its models cost. One of those may only need a settings change. Otherwise, the first question is whether you still want to run an agent yourself: two alternatives below keep you in charge of the machine, and three take that job away.

What OpenClaw gets right

OpenClaw is an open-source personal AI assistant installed on your own computer that answers in the chat apps you already use. OpenClaw's site lists WhatsApp, Telegram, Discord, Slack, Signal and iMessage among 29 channels, with desktop apps for macOS, Windows and Linux. It can browse, fill forms, read and write files and run shell commands, with full or sandboxed access.

Very little sits between you and the software. OpenClaw is MIT licensed and stewarded by a US nonprofit foundation, with no subscription and no hosted tier. By default, the same page says, an install sends the foundation only a daily version check, which you can turn off. Memory is plain Markdown in your workspace, so you can open it and correct it in any text editor. You also pick your model, hosted or local. OpenClaw's GitHub repository showed about 394,000 stars on November 2, 2026, a rough sign of how many people follow it.

If you want your assistant reachable from nearly any chat app, on hardware you control, with a model you choose, and you're comfortable maintaining it, OpenClaw is a strong place to stay. Only the two self-hosted alternatives below come close to that combination.

What running OpenClaw asks of you

Running OpenClaw makes you its administrator, and its own documentation is direct about what that involves. Network exposure starts tight: the security guide says a regular install binds to loopback, so it accepts connections only from the same computer, gives unknown direct messages a pairing code and puts groups behind an allowlist. What the agent may do on the host is another matter.

• Host access. The exec approvals page lists "full" as the default security setting on the gateway (the service OpenClaw keeps running) and on node hosts, with ordinary prompts off. The sandbox also starts switched off, and the same page says it isn't a perfect boundary even when on.
• Prompt injection. OpenClaw's prompt injection page says the problem isn't solved and advises treating links, attachments and pasted instructions as hostile. That advice matters most for an agent that reads your email and can also run commands.
• Community skills. ClawHub skill pages show a security scan state before you install, but the skills docs still say: "Treat third-party skills as untrusted code."
• The model bill. OpenClaw itself costs nothing, while its token guide notes that every turn costs tokens, heartbeat turns included. Spending depends on your model and how much you let the agent do.
• Upkeep. The releases page shows four releases between October 27 and 30, 2026, betas included. The update guide asks for a verified backup before a significant update and warns that older versions can't open newer database schemas.
• Sharing. The security guide assumes one operator or a team whose members trust each other, and advises separate gateways and credentials when they don't.

Setup itself is modest. The getting started guide estimates about five minutes to a first chat, with provider sign-in and optional setup taking longer.

Try these OpenClaw changes before you switch

Several of the reasons to leave OpenClaw can be reduced without leaving, so its settings are worth trying before a migration. Each step below comes from OpenClaw's own documentation.

1. Run openclaw security audit to detect drift from the defaults, then compare your setup with the hardened baselines.
2. Turn on sandboxing. Docker is the default local backend, and only tool execution moves inside it, while the Gateway stays on the host.
3. Use openclaw exec-policy to pick a stricter preset such as cautious, described on the exec approvals page, and check what it asks you to approve.
4. Keep web search, fetch and browser tools off for agents that don't need them, and give untrusted content to a read-only agent first.
5. Run /usage cost to see what sessions have cost, then use smaller models for verbose work.
6. If frequent updates are the problem, look at the extended-stable line. The releases page describes it as the gateway-only equivalent of a long-term support release.

Stay self-hosted, change the agent: Hermes Agent and NanoClaw

Hermes Agent and NanoClaw keep OpenClaw's basic bargain: free MIT-licensed software on your own machine, with your own model bill and your own maintenance. They differ from OpenClaw, and from each other, in what they put first.

Hermes Agent, for an assistant that builds on its own work

Hermes Agent, from Nous Research, centers on what its docs call a built-in learning loop: it creates skills from experience, improves them as it uses them, and searches past sessions. It reaches more than 20 messaging platforms from one gateway and runs on Windows, macOS, Linux and WSL2. Its six built-in terminal backends include Docker, SSH and serverless options that hibernate when idle. Of the products here, Hermes Agent is the most direct swap, and it has a documented importer for OpenClaw.

Hermes Agent's security page describes approval prompts for risky commands, in smart, manual or off modes, and a pairing flow for unknown senders. The same page is plain about the limits: local execution has no isolation, and container backends skip those command checks because the container is treated as the boundary. Its repository mentions an optional Nous Research subscription for model access, with no price on that page.

Who Hermes Agent fits: someone happy self-hosting who wants the assistant to accumulate its own procedures, and who likes a choice of where commands run.

NanoClaw, if host access is your objection

NanoClaw is built around isolation first. NanoClaw's site says each session runs in its own Docker container that sees only mounted files, and that agents never hold raw API keys because a credential gateway injects them at request time. It's also small on purpose. By NanoClaw's own count, it has about 29,300 runtime lines of code against OpenClaw's 434,453, which matters if you intend to read what you run.

The trade-offs follow from that design. NanoClaw's README requires Docker and covers macOS, Linux and Windows through WSL2. Claude Code is needed for customizing and for adding channels, which are installed one at a time. The default model is Claude, with others added as skills, and the README offers no OpenClaw migration guide.

Who NanoClaw fits: a developer who wants containment by default and doesn't mind Docker or adding channels one by one.

Stop running it: Claude Cowork and Poke

Claude Cowork and Poke remove the gateway, the updates and the separate model bill. In exchange, neither product's pages offer bringing your own model, and you pay a monthly price for anything beyond Poke's free plan.

Claude Cowork, for work across your files and tools

Claude Cowork is where you hand Claude a goal and it works across your files and connected tools. Anthropic's Cowork page lists scheduled tasks that run unattended, and starting a task from your phone that continues in the cloud with your laptop closed. You choose which folders and tools it can reach, deletions need your approval, and with permission settings on it shows a plan and waits before significant actions.

Paid plans run from Pro, at $20 billed monthly or $17 a month paid annually, through Max at $100 and Ultra at $200 a month. Team is $20 per seat for 2 to 150 people. Anthropic cautions that Cowork uses up limits faster than chat. The desktop app covers macOS, Windows and Linux, the last in beta. The Cowork page doesn't list WhatsApp or Signal as places to reach it, so OpenClaw's chat-app reach doesn't carry over.

Who Claude Cowork fits: someone who wanted OpenClaw's hands on files and apps, without a terminal or a server.

Poke, if the chat thread was the whole appeal

Poke is an assistant you simply text. Poke's docs put it in Apple Messages, Telegram, WhatsApp and RCS, and cover email, calendar, reminders, web search and connected apps, with an account at poke.com and no install mentioned. Poke's pricing lists Free at $0, Pro at $19 a month and Ultra at $199 a month. Those docs don't describe shell or local file access, so Poke replaces the messaging half of OpenClaw and not the computer-control half.

Who Poke fits: someone who mostly used OpenClaw for reminders and inbox help from a phone, and never wanted to think about a gateway.

Merlin, if your workday runs on a Mac

Merlin, our own product, is a Mac app that starts from your people and commitments, not from a gateway you configure. It uses Gmail and Google Calendar to track replies you owe and contacts gone silent, sends a briefing shortly before each meeting, records calls, and runs routines on a schedule or on a Gmail, Calendar or webhook event. Its browser tasks use its own browser with its own profile, which only has the logins you bring over. You talk to it in its chat window, or press ⌥Space over whatever you're doing.

Approvals depend on how the work starts. Ask in chat to email someone or move a meeting, and you get a card to check, adjust and approve first. Routines run unattended, so a routine permitted to send mail or post to Slack does it without a card, and a standing permission such as "always check me in" removes the stop for that errand.

Merlin gives up much of what makes OpenClaw appealing. It isn't software you host: connected-service credentials are encrypted by Merlin's backend, and transcripts and notes are tied to your account, though meeting audio stays on the recording Mac. It's Mac only, and setup needs both Gmail and Google Calendar connected. It doesn't answer in WhatsApp or Telegram, it sends nothing to your phone and it makes no phone calls. Browser tasks pause when your Mac sleeps. Merlin's plans start with 5,000 free credits a month, with transcripts on paid plans from $29 a month ($278 if you pay yearly).

Who Merlin fits: someone on a Mac and Gmail who wants a chief-of-staff style of help and meeting notes from one app, and has no wish to maintain an agent.

OpenClaw, Hermes Agent, NanoClaw, Claude Cowork, Poke and Merlin side by side

The six products split on who operates the agent and where you talk to it. The figures are US dollars, read on November 2, 2026, and the three self-hosted tools leave model costs to you.

How to choose an OpenClaw alternative

The right OpenClaw alternative depends on what you'd change first, so start from the part that bothers you.

• You like OpenClaw but not its defaults: keep OpenClaw and work through the settings above.
• You don't want the agent's tools loose on your host: NanoClaw, or OpenClaw with its sandbox turned on.
• You want it to get better at your recurring work: Hermes Agent.
• You don't want a terminal, and your work is files and business tools: Claude Cowork.
• You only need a capable contact in your messages: Poke.
• Your work is email, meetings and people, on a Mac: Merlin.
• Your team doesn't fully trust each other: OpenClaw with separate gateways, as its guide advises, or Cowork's Team plan with its admin controls.

Moving your memory off OpenClaw

OpenClaw's memory moves easily because it's made of files. Its memory docs place MEMORY.md, optional USER.md and daily notes in ~/.openclaw/workspace by default. Copy that folder first, whichever way you go. Moving to Hermes Agent can then follow its migration guide:

1. Install the importer with hermes plugins install agent-importers.
2. Preview the move with hermes import-agent openclaw --dry-run.
3. Run it without that flag. Add --migrate-secrets only if you want API keys brought across.
4. Re-pair WhatsApp with hermes whatsapp, since it uses QR pairing.
5. Recreate cron, plugin and hook configs by hand from the archive folder the importer leaves.

For any other destination, expect to paste in what matters by hand. When you're done, stop the service with openclaw gateway stop and revoke any API keys and channel tokens you no longer need.