Blueprint€12, paid once

Your agent, your machine, one page.

Pick the agent you want to run. The blueprint tells you which machine to buy and in which configuration, how to install the agent on it, what to switch on before it talks to anyone, and which CVEs to patch first.

Choose your agent

Each link opens the free hardware recommendation for that agent; the blueprint is bought from there, with your budget and local-model answers carried over.

Hermes Agent
Agent from Nous Research (MIT, Python). Runs shell commands on the host by default, with an approval step for dangerous ones; Docker and cloud sandboxes are options. Works with many LLM providers.
your machine
OpenClaw
Self-hosted AI agent at the centre of the January 2026 security crisis. Its tool sandbox is off by default: the main session's tools run on the host until you configure one.
your machine
Nanobot
Personal AI agent in Python (MIT) with a browser UI and chat apps. Native Anthropic, OpenAI and OpenRouter providers plus local servers; its shell sandbox is off until you switch it on.
your machine
NanoClaw
Small TypeScript agent (MIT) built on Anthropic's Claude Agent SDK. Every agent runs in its own Docker container, on macOS, Linux or Windows through WSL2.
your machine
IronClaw
Rust agent from NEAR AI, MIT or Apache-2.0. Untrusted tools run in a WebAssembly sandbox with declared capabilities, and secrets are injected outside them.
your machine
ZeroClaw
Single Rust binary from ZeroClaw Labs, MIT or Apache-2.0. Works with Anthropic, OpenAI, Ollama and about twenty other providers, and turns on an OS sandbox it detects.
your machine
Moltworker
Cloudflare's experimental package that runs OpenClaw inside a Cloudflare Sandbox container behind a Worker. Needs the Workers Paid plan.
Cloudflare

What is in it

  • The machine. The pick for your budget and whether a local model runs next to the agent, the RAM configuration to buy, two alternatives, and the parts that go with it (a Raspberry Pi 5 needs the right power supply and is better off with an NVMe SSD).
  • The install. Preparing that machine, then installing the agent with the commands its own docs give, with our notes where we wrote some for that pair.
  • The security checklist. What the agent leaves off by default (several of them run tools on the host until you configure a sandbox) and the network rules that would have prevented the 2026 OpenClaw exposures.
  • The CVEs. The agent's current CVEs with the release that fixes each one. The page reads the tracker every time you open it, so the link stays useful after the purchase.

What it is not

Not a benchmark: we have not bought and tested these machines, and the RAM sizing is our estimate, labelled as such. Not secret either: every fact in it is published on this site with its source. You pay for the assembly, for your agent and your machine, on one page you can print or keep. If it gets something wrong about your setup, write to [email protected]: we correct the page for everyone.

How paying works

€12 through Stripe Checkout, once. No account, no subscription, no renewal. Stripe asks for your email; the link to your blueprint is shown right after payment and sent to that address. The shop links in the blueprint may earn PocketClaw a commission (disclosure).