Every CVE hitting self-hosted AI, tracked in one place.
PocketClaw is the watchdog for self-hosted AI stacks. We track 12 AI agents in the OpenClaw universe — Hermes, Nanobot, NanoClaw, IronClaw, ZeroClaw and the rest — plus every provider, plugin and CVE around them. The live tracker, the stack scanner and 77 hands-on guides are free. Want it pushed to your inbox the second it lands? That's Pro.
Scan your stack for CVEs
Paste a docker-compose, requirements.txt, or package.json. Get every matching CVE, severity-graded, in 10 seconds.
What to run it on
15 self-hosted AI hosts tested for real — Raspberry Pi 5, mini PCs, Mac Mini, Orange Pi — with tokens/sec, watts and a straight buy/skip call.
Alerts, pushed to you
Declare your stack once; we email you (and fire a Discord/Slack webhook) the minute a CVE lands on a tool you run. Everything else stays free.
Recent advisories
The agents we follow
The original viral self-hosted AI agent. Post-crisis 2026.4 line is genuinely safer; pre-2026.3 is genuinely dangerous.
4,000-line Python agent designed to be auditable in an afternoon. Trust through verification.
Post-OpenClaw safe default. Docker-sandboxed by default, multi-LLM, opinionated. The agent we'd hand a colleague today.
Privacy-first. Local LLMs only. Network egress denied at iptables. AGPL-3.0.
macOS-only opinionated fork. Apple containers + Claude. Sub-second boot.
Self-hosted AI agent on Cloudflare Workers. Free at low volume. Workers runtime constraints apply.
Guides we've written
Self-hosted AI news & trends — Q2 2026 state of the ecosystem
PocketClaw's quarterly state-of-the-ecosystem report. The agents that grew, the agents that died, the CVE landscape, the hardware that won, the providers that stopped being interesting. Hard numbers from public sources, opinions credited.
GPU vs CPU for self-hosted AI inference — when each genuinely wins in 2026
When does a GPU actually pay for itself in self-hosted AI inference, and when is a modern CPU genuinely the better answer? Real benchmarks across Mac Mini M4, Intel NUC 13, Raspberry Pi 5, and a single-GPU box. Watts per token, euros per million tokens, and the surprising places CPU wins.
Migrating from OpenAI Assistants to OpenClaw — six weeks of pain (and what we kept)
A weekly diary of six weeks moving a working internal tool from OpenAI Assistants API to a self-hosted OpenClaw 2026.4 deployment. The actual mistakes, the actual cost reductions, the things that broke that we hadn't anticipated.
Raspberry Pi 5 LLM benchmarks — real tokens/sec after 90 days of self-hosted AI
What it's actually like to run a self-hosted AI agent on a Raspberry Pi 5 for 90 days. Real numbers on tokens-per-second, watt-hours, thermal throttle, SD card wear and the workloads where the Pi is genuinely good — and the workloads where it absolutely is not.
Solo developer self-hosted AI — a year-long retrospective
What it's actually like to run a self-hosted AI stack for a year as a solo developer. Real numbers on cost, ops time, downtime, regrets. What worked, what didn't, what we'd do differently.
GDPR for self-hosted AI agents in 2026 — a practical compliance walkthrough
Practical GDPR compliance walkthrough for self-hosted AI agent operators. Lawful basis, data residency, sub-processor disclosure, DPIA triggers, breach notification. Plain language. Not legal advice.
Best self-hosted AI agents 2026 — OpenClaw, Hermes, Nanobot compared (decision tree)
Pick the right self-hosted AI agent in 2026 with a six-question decision tree. Covers OpenClaw, Hermes Agent, Nanobot, NanoClaw, IronClaw, ZeroClaw, Moltworker. Practical, vendor-agnostic, no-bullshit.
Hosts we've tested
The default starting point for pocket AI in 2026. 4–8 GB of LPDDR4X, ARM Cortex-A76, sub-€100, runs Hermes Agent (no browser tool) or Nanobot comfortably.
Mini PCs at €300–600 with i5/i7 + 16–32 GB RAM. The sweet spot for self-hosted AI agents that need browser automation and decent local model performance.
The single best small-form-factor host for local LLMs in 2026. Apple Silicon unified memory makes 70B-class models tractable on a desk-sized machine.
One email. Every Thursday morning.
The week's CVEs, releases, and the one piece we shipped — auto-generated from the live tracker, hand-finished from the desk. Free. No sponsored content. No exit-intent popups.