Frequently asked.

PocketClaw is an independent publication and live tracker for self-hosted AI agents. We monitor projects like OpenClaw, Hermes Agent, Nanobot, NanoClaw, IronClaw, ZeroClaw and Moltworker, read NVD, CISA KEV and GitHub every 6 hours for their CVEs and releases, and publish comparisons and migration guides.

Robin Monteiro, a developer based in Europe. No co-founders, no investors, no agency. Help is welcome: see the partners page if you want to contribute.

It started as a hardware experiment (running an AI gateway on a $20 phone). The hardware project is archived, but the audience and indexed URLs were already attached to the name. Renaming would have cost more than it would have helped.

The content under /guides, /compare and /glossary is published openly. The site code itself is not currently open source: that may change once the codebase stabilises.

The CVE tracker reads NIST NVD and CISA KEV every 6 hours, and GitHub for the agents' figures on the same schedule. Guides are written when there is something to explain, not on a fixed rhythm. The newsletter goes out when there is something worth sending.

AI tools help with research and drafting. A page states only what a linked source backs, an opinion is labelled as one, and Robin Monteiro answers for what is published. When a page was wrong, the correction is dated on it.

NIST NVD (the CVE API) for CVEs, the CISA Known Exploited Vulnerabilities catalog for what is exploited in the wild, and the GitHub API for stars and releases. All public sources, all attributed.

Either we haven't covered it yet, or it didn't pass our coverage baseline (documented threat model, sandbox-on by default, working security disclosure channel, patch SLA). Hermes Agent, OpenClaw and Nanobot miss the sandbox line out of the box: their sandbox is documented but off. We cover them anyway and say so on their pages. Email [email protected] with the project and we'll consider it.

The comparisons are our reading of each project, not lab results; a comparison checked against the projects' docs gives its sources and date. Nobody pays for a placement, and PocketClaw sells no sponsorship.

The new CVEs on the components we track that deserve a closer look, and the breakdowns we publish. No sponsored content.

When there is something worth sending. There is no fixed day, and never more than one email a week. Past issues are in the archive, each with its date.

Yes. The newsletter has no paywall. Pro is a separate paid plan: alerts on the components you run, checked every 6 hours, by email and Discord or Slack webhook.

Every email has a one-click unsubscribe link in the footer. You can also email [email protected] to be removed manually.

No. Never. Not even with a sponsor. Subscriber emails stay on our database and on AWS SES (which we use to deliver). They are deleted on unsubscribe.

Three ways: PocketClaw Pro (CVE alerts on your stack, checked every 6 hours, €9 a month or €49 a year), paid full scans of a stack file (the preview and the first full report are free), and affiliate links to tools we use, flagged on every guide.

No. No AdSense, no banner networks, no programmatic. We've made this commitment explicit in the disclosure page and we keep it.

No. Comparison rankings are not for sale. We won't accept payment to move a vendor up a list. Full stop.

No. PocketClaw sells no sponsorship. If that ever changes, the partners page will say so first, with how the slot is labelled.

€9 a month or €49 a year, with a 7-day free trial and a 14-day refund window. It watches the components you declare and emails you (plus Discord or Slack) when a new CVE is about one of them. NVD and CISA KEV are read every 6 hours: it is not real time.

Next.js 16 with App Router, server components and ISR. Hosted on a VPS via Docker. PostgreSQL for the live data. AWS SES for email. No tracking JS, no third-party heavy bundles.

Only what's strictly necessary (locale preference, session cookie if you sign in). No advertising or tracking cookies.

Yes: /feed.xml carries the guides and CVE breakdowns, newest first. It is not a feed of every CVE: for that, use the tracker or Pro alerts.

When PocketClaw pivoted in April 2026, the URL structure changed (from /hacks/* to /guides/*). We added 301 redirects so nothing on the open web breaks. If you find a broken link from somewhere, email us.

Yes. CVEs are read from NIST NVD and CISA KEV every 6 hours, GitHub figures on the same schedule. Pages are rendered from the database when you open them, so they show the last run, not a snapshot taken when the site was built. Between two runs nothing moves: it is not real time.

Yes. Subscriber data is minimal (email + opt-in date), stored in the EU, deleted on unsubscribe. We don't share data. We don't profile readers.

Short version: we collect nothing we don't need, share nothing with anyone, and delete on request. The full policy is at /privacy: it is short because the data we collect is minimal.

On servers rented from Hetzner Online in Nuremberg, Germany, the PostgreSQL database included, behind Cloudflare. Email goes out through Amazon Web Services (SES). The details are in /privacy.

Yes, with attribution. Links are appreciated. For commercial use beyond fair-use quoting, email [email protected].