How to Choose Your Self-Hosted Agent

Six weeks. That's roughly how long it took for OpenClaw to go from "interesting weekend project" to spawning an entire family tree of forks and rivals — Hermes, NanoClaw, ZeroClaw, IronClaw, TrustClaw, PicoClaw, and a dozen more, most of them named like they lost a bet. If you're trying to pick one right now, "which is best" is the wrong question. None of them are best. They're all optimized for different constraints, and the right one for you depends on which constraints you actually have.

Here are the five criteria that actually decide this, in the order they should decide it.

1. Security is the tiebreaker, not a footnote

Start here, because everything else on this list is a preference and this one isn't.

In February 2026, a critical remote-code-execution vulnerability — CVE-2026-25253 — was found in OpenClaw, with over 135,000 exposed instances discovered publicly by security researchers. That single incident is the reason half this ecosystem exists. NanoClaw, IronClaw, ZeroClaw, and TrustClaw were all built, at least in part, as a direct answer to it.

The uncomfortable truth about most of these agents, OpenClaw included, is that their default security model is "the agent can do anything you can do." If you can sudo, so can it. If you have AWS credentials sitting in a config file, it can read them. That's not a bug — it's the design, in service of maximum capability. Whether that's acceptable depends entirely on what you're connecting the agent to.

If the agent is only ever going to summarize your personal Telegram messages, this matters less. If it's going to touch your email, your file system, or a customer database, this is the whole decision.

2. Match the footprint to the hardware you actually have

This one is refreshingly non-philosophical: it's just math, and it eliminates candidates before you've compared a single feature.

OpenClaw runs comfortably on a proper VPS — think 2+ vCPUs and several gigabytes of RAM — but you won't get it running on a Raspberry Pi. ZeroClaw compiles to a single Rust binary a few megabytes in size, boots in under 10 milliseconds, and was specifically built to run on hardware that "would not even boot OpenClaw." PicoClaw goes further still, running under 10MB of RAM on $10 microcontroller boards.

If you already know you want this running on a spare Pi in a closet, or you want it on the cheapest possible VPS tier because you're running three of these things at once, the resource-heavy options are off the table before you even open their docs. Conversely, if you've already got a beefy server sitting mostly idle, the lightweight options aren't buying you anything you need — you're trading ecosystem and polish for a resource saving you don't require.

Check this before you check anything about features. It's the fastest way to cut a list of fifteen down to three.

3. Decide: do you want an ecosystem, or a scalpel?

OpenClaw's skill marketplace, ClawHub, reportedly hosts over 50,000 community-built skills. That is a genuinely enormous head start — whatever you're trying to automate, there's a decent chance someone already built and shared the skill for it.

Every single alternative trades that away. NanoClaw, ZeroClaw, IronClaw — none of them have anything close to that catalog, and their pitch isn't "we have more," it's "we have less, on purpose." Fewer dependencies, smaller attack surface, a codebase small enough that someone on your team could actually read the whole thing before deploying it. One comparison put OpenClaw's codebase at well over 100,000 lines against NanoClaw's roughly 700.

There's no universally right answer here, only a right answer for your situation. If you need something specific and prebuilt today and don't want to write it yourself, ecosystem size wins outright. If you're building something narrow and you actually care about being able to audit what's running, a smaller, more focused tool with a fraction of the surface area is doing you a favor, not shortchanging you.

4. Should your agent learn, or should it stay exactly as you set it up?

This is the one genuinely philosophical fork in the road, and it's mostly about Hermes versus everyone else.

Hermes writes its own reusable skills from experience — it does a complex task, figures out what worked, and saves a procedure it can invoke faster next time. It gets measurably more capable the longer you run it, with no retraining involved; the improvement lives at the skill and memory layer, not the model. Most of the rest of this ecosystem deliberately doesn't do this. What you install is what runs, indefinitely, until you change it yourself.

Self-improvement sounds like a strict upgrade until you think about where it goes wrong. An agent that writes its own procedures needs those procedures reviewed before they're trusted with anything consequential — a self-generated skill is a draft, not an audited process. In a regulated environment, or anywhere "the agent invented its own way of doing this" is not an acceptable answer to a compliance question, static and predictable is the feature, not the limitation. For a personal assistant that you want to feel less like a fresh install every time you talk to it, that same self-improvement is the entire point.

Pick based on whether "the agent changed its own behavior without telling me" sounds like a feature or an incident report.

5. Check whether the project is actually still there

This last one doesn't show up in any feature comparison, and it should.

While researching this space, I ran into a genuinely unresolved contradiction: one source, writing in May 2026, flatly stated that ZeroClaw's GitHub repository had been taken down back in March. Three other sources — from April, May, and June — described ZeroClaw as an actively maintained, thriving project with tens of thousands of stars and dozens of contributors. Both can't be fully right. Maybe one is outdated, maybe there was a dispute or a rename that some writers caught and others didn't. Either way, it's a live example of the actual risk: in an ecosystem this young and this forky, "which tool is best" can quietly become "which tool still exists" within a single fiscal quarter.

That's not paranoia — it's just appropriate caution for a category where the "established leader" and the "brand-new challenger" can swap places in a matter of weeks.

The short version

If you're touching real credentials or customer data, start with security and let it veto everything else. If your hardware is fixed, let footprint narrow the field next. Then it's ecosystem versus minimalism, static versus self-improving, and a five-minute check that the project you're about to bet on is actually still breathing.

None of that requires picking a winner. It just requires being honest about which constraints are actually yours.