// the take
QwenPaw is a self-hosted personal AI assistant that runs as a long-lived agent reachable from its own web console, a terminal UI, a desktop app, and seven-plus chat platforms (DingTalk, Lark, WeChat, Discord, Telegram, iMessage, QQ). It's aimed at developers and power users who want one agent with persistent memory and shell/file access across all their devices and channels, backed by Alibaba's AgentScope team, rather than people looking for a simple chatbot.
The channel reach is real and unusual — DingTalk, Lark, WeChat, Discord, Telegram, iMessage and QQ all hang off one instance with shared memory and session state, not separate bolted-on integrations. Local inference is more than a token gesture: a bundled llama.cpp runtime (QwenPaw-Flash models from 2B up to 35B-A3B) ships with hardware-aware recommendations, alongside Ollama and LM Studio support, so you're not forced into a cloud API key. The security layering — per-OS kernel sandboxing (Seatbelt/Bubblewrap/Landlock/AppContainer), a rule-based Tool Guard that inspects calls for shell evasion and path traversal, and a separate Skill Scanner for prompt injection and hardcoded secrets — is more serious than the usual agent framework that just execs shell commands and hopes.
This thing runs shell commands, edits your files, and talks to the outside world on your behalf by design, and the elaborate security stack is really damage control for that — a misconfigured Tool Guard or an unreviewed plugin from the marketplace is a real local-code-execution risk, not a hypothetical one. The desktop app is explicitly Beta, with the README admitting incomplete compatibility testing and unresolved performance issues. Installing from source means a full Node/npm frontend build plus a separate Python package install, and the README itself warns you to redo both and clear your browser cache on every major version bump. Telemetry is collected by default if you install non-interactively with `--defaults`, easy to miss when scripting a deployment.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →