Glossary: self-hosted AI agents from A to Z

A

AI agent

Software that uses a language model to plan and carry out multi-step tasks through tool calls.

An agent differs from a chatbot in that it acts: it calls tools, hits APIs, edits files or drives a browser instead of only producing text. The usual loop picks a tool, reads the result and picks the next one, until the goal is reached or the run is stopped.

Air-gap

Deployment with no connection to untrusted networks, usually no internet access at all.

Air-gapped deployments are the strongest network-security model. For self-hosted AI, air-gap mode requires local LLMs (no cloud API calls) and offline updates. Neither ZeroClaw nor IronClaw documents an air-gap mode in the pages we read on 18 October 2026: with an agent that talks to a local Ollama server, you cut the network at the host and update by hand. Until then this entry said both ship one.

Approval flow

UI pattern requiring human confirmation before an agent's tool call executes.

The agent proposes a command or tool call; a person (or a rule) approves or denies it before it runs. In Hermes Agent, commands that match a list of dangerous patterns go to approval; in its default smart mode a helper model settles the low-risk and the clearly dangerous ones and asks you about the rest, and a prompt nobody answers is denied. Its own security policy calls the gate a heuristic, not a boundary: pair it with a sandbox. For an agent with file or shell access, it is the last check before an injected instruction runs.

Sources (read 2026-10-18): Hermes Agent docs: security (approval modes); Hermes Agent SECURITY.md (v0.22.2): in-process heuristics.

B

BYOK (Bring Your Own Key)

Pricing pattern where a user supplies their own LLM API keys to a self-hosted or managed agent.

BYOK separates the cost of running the agent from the cost of the model: you pay for the agent or its hosting, and the LLM bill goes to your own Anthropic, OpenAI or OpenRouter account. Common with managed hosting of open-source agents.

C

Caddy

Web server and reverse proxy that obtains and renews TLS certificates on its own.

A few lines of Caddyfile put HTTPS in front of a self-hosted agent, with less configuration than Nginx for that case. It is the HTTPS front of the pocket AI setups in our guides.

Cloudflare Workers

Cloudflare's serverless runtime, which runs code in V8 isolates on Cloudflare's network.

Workers run JavaScript and WebAssembly close to the user, with no native binaries and no long-running processes, which rules out most agent runtimes. Moltworker gets around it by running OpenClaw in a Cloudflare Sandbox container that a Worker fronts.

CVE-2026-25253

High-severity 1-click remote code execution in OpenClaw (then Clawdbot / Moltbot) before 2026.1.29, via gateway token exfiltration. CVSS 8.8.

The OpenClaw Control UI took a gatewayUrl value from the query string and connected to it over WebSocket on page load, sending the stored gateway token. A crafted link could ship that token to an attacker, who could then connect to the victim's gateway, loosen sandbox and tool policies and run commands, even on a gateway bound to loopback. Fixed in 2026.1.29 (NVD: CVE-2026-25253, GitHub advisory GHSA-g8p2-7wf7-98mq).

Read: Full explainer, CVE record. See also: OpenClaw, RCE (Remote Code Execution).

D

Data residency

Regulatory or contractual requirement that data not leave a defined geographic or organisational boundary.

Data residency clauses are common in EU, healthcare and finance contracts. For self-hosted AI it usually means a local model, or a model provider whose processing stays in the region, and hosting in that region. Logs and backups count too, not only the server.

Docker Compose

Tool for defining and running multi-container Docker applications via a single YAML file.

One docker-compose.yml describes the agent, its reverse proxy and whatever else it needs, and one command starts the stack. On a single host it is much less work than Kubernetes. The StackScanner reads it to find the versions you run.

Docker sandbox

Sandbox using a Docker container with filesystem mount and network policy controls.

A common sandbox model. NanoClaw runs its agents in Docker containers by default; Hermes Agent and OpenClaw offer Docker as a backend you switch on (both run tools on the host by default). A container shares the host's kernel, and escapes have happened (runc, CVE-2024-21626): gVisor or a virtual machine isolate further.

Sources (read 2026-10-18): NanoClaw README: container isolation; Hermes Agent docs: tools and terminal backends; OpenClaw docs: sandboxing.

E

Edge AI

AI workloads running close to where data is generated rather than in centralised cloud datacenters.

Inference on hardware close to where the data is produced: a home, an office, a factory floor, a vehicle. It overlaps with pocket AI: edge AI is about where the data is, pocket AI about owning small hardware. The same Raspberry Pi 5 can be both.

Read: Edge AI hardware buyer's guide 2026. See also: Pocket AI, Self-hosted AI, Local LLM.

Embeddings

Numerical vector representations of text, images, or audio that capture semantic similarity.

Embedding models output vectors of a few hundred to a few thousand dimensions (384 for all-MiniLM-L6-v2, 3,072 for OpenAI's text-embedding-3-large). A small local model such as BGE-small lets you index documents without calling a cloud API.

EU AI Act

EU regulation classifying AI systems by risk level and imposing obligations on high-risk deployments.

The regulation entered into force on 1 August 2024 and applies in stages: prohibited practices from 2 February 2025, the obligations on general-purpose AI models from 2 August 2025, most other rules from 2 August 2026. Since the AI Omnibus, the high-risk rules apply from 2 December 2027 for the use cases of Annex III and from 2 August 2028 for AI built into regulated products. The obligations on general-purpose models fall on their providers; deploying a high-risk system (hiring, education, critical infrastructure) brings obligations of its own.

Sources (read 2026-10-27): European Commission: AI Act, application timeline.

G

GGUF

File format for storing quantised LLM weights, used by llama.cpp and Ollama.

GGUF is llama.cpp's file format for model weights, quantised or not. A Llama 3.3 70B file at Q4_K_M is about 40 GB. Hugging Face hosts GGUF builds of most open models.

See also: llama.cpp, Ollama, Quantisation.

gVisor

User-space kernel that runs as a sandbox layer between containers and the host kernel.

gVisor implements much of the Linux system call interface in user space: a container's system calls reach gVisor first, not the host kernel, which isolates further than a plain container. None of the agents we follow names it in the sandboxing pages we read; it is a container runtime you set up yourself. Until October 2026 this entry said IronClaw uses it: IronClaw's documentation describes WebAssembly and Docker sandboxes instead.

H

Hermes Agent

Open-source (MIT) AI agent from Nous Research. Multi-LLM; runs commands on the host behind approvals unless you choose a sandbox backend.

Hermes Agent is a Python agent you talk to from a terminal UI or chat apps (Telegram, Discord, Slack, WhatsApp, Signal, email). Its terminal tool runs commands on the host by default (the local backend), and commands that match its list of dangerous patterns need approval. Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox backends are opt-in, and its security policy asks for the whole agent inside its Docker image once it reads untrusted input. It works with Nous Portal, OpenRouter, Anthropic, OpenAI, Gemini and local servers. About 255,000 GitHub stars in October 2026. Until October 2026 this entry said it is Apache-licensed and sandboxed in Docker by default; it is MIT-licensed and never was.

Sources (read 2026-10-18): Hermes Agent README (v0.22.2); Hermes Agent docs: tools and terminal backends; Hermes Agent SECURITY.md (v0.22.2): trust model; Hermes Agent releases.

Read: Migration guide from OpenClaw, Comparison with OpenClaw. See also: OpenClaw, Nanobot, Docker sandbox.

Hetzner

German provider of cloud servers and dedicated servers, with data centres in Germany and Finland, and outside the EU.

Hetzner Cloud's small shared-vCPU plans are a common choice for a self-hosted agent that calls a hosted model; plans and prices are on its site. PocketClaw itself runs on Hetzner servers in Germany.

Sources (read 2026-10-27): Hetzner Cloud: plans and locations.

I

IronClaw

Rust agent from NEAR AI, MIT or Apache-2.0, that runs untrusted tools in a WebAssembly sandbox and keeps secrets out of their reach.

IronClaw calls itself a Rust reimplementation inspired by OpenClaw. Untrusted tools run in wasmtime sandboxes and may only reach the hosts, paths and credentials their capabilities.json declares; secrets are encrypted with AES-256-GCM and injected at the host boundary, and a leak detector scans requests and responses. Jobs can run in Docker containers. The licence is MIT or Apache-2.0, at your option. Until October 2026 this entry described a source-available enterprise product with gVisor, SAML SSO, RBAC, an air-gap mode and a $750 seat price: its repository documents none of that.

Sources (read 2026-10-18): IronClaw README (main, b0b999d); IronClaw docs: sandboxed WASM tools.

Read: Comparison with Hermes Agent. See also: OpenClaw, Hermes Agent, Sandboxed tool execution.

L

Llama

Meta's family of open-weight language models, under Meta's own licence.

Llama 3.3 70B (December 2024) is a dense model; quantised to 4 bits it fits on a machine with 48 to 64 GB of memory. Llama 4 Scout and Maverick (April 2025) are mixture-of-experts models with 17 billion active parameters and 109 and 400 billion in total, beyond most small hardware. The Llama licence is Meta's own, not an open-source licence.

Sources (read 2026-10-27): Meta, 5 April 2025: the Llama 4 herd; Llama 3.3 70B Instruct model card.

See also: Local LLM, Ollama, Quantisation.

llama.cpp

C++ inference engine for LLMs. The runtime under most local-LLM setups, including Ollama.

llama.cpp runs GGUF models on CPUs and on Apple Silicon (Metal), NVIDIA (CUDA) and AMD (ROCm) GPUs. LM Studio and GPT4All build on it, and Ollama on its ggml library. Using it directly gives more control than Ollama, for more setup. Its server has had CVEs of its own, listed in the CVE tracker.

Local LLM

A language model running on your own hardware instead of behind a cloud API: Llama, Qwen, Mistral and other open-weight models.

The trade-off is quality and hardware against privacy and running cost. A 70B-class model quantised to 4 bits needs around 40 GB of memory for its weights alone, before the context; 7B to 14B models run on a laptop or a mini PC. Whether one is good enough for agent work depends on the task: try it on yours before moving off a hosted model.

See also: Ollama, ZeroClaw, Self-hosted AI.

M

Magic link

Passwordless authentication where the user clicks a one-time link sent to their email.

Magic links remove passwords and their reset flow: the user enters an email address, receives a one-time link and clicks it. PocketClaw's own sign-in uses Google or an email and password (better-auth).

MCP (Model Context Protocol)

Open protocol for connecting language models to tools and data sources over JSON-RPC.

Anthropic introduced the Model Context Protocol in November 2024, and other vendors have adopted it since. An MCP server exposes a set of tools; the agent, as MCP client, discovers and calls them.

Sources (read 2026-10-27): Anthropic, 25 November 2024: introducing the Model Context Protocol.

MCP server

Process that exposes a set of tools to MCP-compatible AI agents over a JSON-RPC interface.

The server side of MCP: a process that declares tools an agent can call. A pocket AI setup can run one agent and several small MCP servers, each with a narrow set of tools (files, calendar, GPIO, sensors), on the same host or on others.

Read: Pocket AI complete guide. See also: MCP (Model Context Protocol), AI agent.

Mistral

French developer of language models, several of them open-weight under Apache 2.0.

Mistral 7B (2023) set the size of the small local model. Mistral Small 3 (30 January 2025) has 24 billion parameters under Apache 2.0, which allows commercial use; Mistral says a quantised build runs on a single RTX 4090 or a MacBook with 32 GB of RAM.

Sources (read 2026-10-27): Mistral AI, 30 January 2025: Mistral Small 3.

See also: Local LLM, Ollama, Quantisation.

Moltworker

Cloudflare's experimental package that runs OpenClaw in a Cloudflare Sandbox container behind a Worker.

Moltworker deploys OpenClaw into a Cloudflare Sandbox container fronted by a Worker, with Cloudflare Access on the admin UI and device pairing. It needs the Workers Paid plan plus container time, and loses its data on restart unless R2 storage is configured. Its README calls it a proof of concept that may break without notice. Until October 2026 this entry described a 600-line agent on Workers with state in Durable Objects, free at low volume.

Sources (read 2026-10-18): Moltworker README (main, 7b00c1d).

Read: Comparison with Hermes Agent. See also: Cloudflare Workers, Hermes Agent, Self-hosted AI.

N

Nanobot

Personal AI agent in Python (MIT) from the HKU Data Intelligence Lab, with a browser UI, chat apps and a wide choice of model providers.

Nanobot runs in a browser UI, a terminal or chat apps and talks to Claude through a native Anthropic provider, as well as to OpenAI, OpenRouter, AWS Bedrock and local servers such as Ollama and vLLM. Shell commands pass a filter that blocks obvious destructive patterns; its OS sandbox (bubblewrap on Linux, Seatbelt on macOS) and workspace guard are off by default, and its docs ask for both in production. It launched in February 2026 with a README that spoke of about 4,000 lines of core code; at v0.3.5 its nanobot/ package holds about 160,000 lines of Python by our count. Until October 2026 this entry called it a 4,000-line codebase with minimal dependencies to read in one sitting.

Sources (read 2026-10-18): Nanobot README (v0.3.5); Nanobot docs (v0.3.5): providers; Nanobot docs (v0.3.5): configuration, security section; Nanobot README of February 2026 (v0.1.3.post4).

Read: Comparison with Hermes Agent. See also: OpenClaw, Hermes Agent, Sandboxed tool execution.

NanoClaw

Small MIT-licensed TypeScript assistant that runs every agent in its own Docker container, on macOS, Linux or WSL2. Built on the Claude Agent SDK.

NanoClaw is its own codebase, not an OpenClaw fork: its README pitches OpenClaw's core functionality in a codebase small enough to understand. Each agent group runs in a Linux container (Docker on macOS, Linux and Windows through WSL2) and only sees the folders mounted into it, while API keys stay in a credential gateway outside the container. Claude through Anthropic's Claude Agent SDK is the default; OpenAI Codex, OpenCode and Ollama are provider skills you add. Until October 2026 this entry called it a macOS-only, Claude-only fork sandboxed in Apple containers.

Sources (read 2026-10-18): NanoClaw README (main, 7be8d7f); NanoClaw docs: security model.

O

Ollama

Local LLM runtime that exposes an OpenAI-compatible API over local model weights.

Ollama downloads models, picks a quantised build and serves them over an HTTP API, with an OpenAI-compatible endpoint. Most self-hosted agents can use it as a provider. Its API has had CVEs of its own, listed in the CVE tracker.

OpenClaw

Open-source AI agent started by Peter Steinberger in late 2025 as Clawdbot, renamed Moltbot, then OpenClaw.

OpenClaw spread fast and widely exposed: on 9 February 2026 The Register reported more than 135,000 OpenClaw instances reachable from the internet, by the count of SecurityScorecard's STRIKE team. CVE-2026-25253 let a crafted link steal the gateway token of its Control UI (fixed in 2026.1.29). In mid-February 2026 Steinberger announced he was joining OpenAI and that the project would move to a foundation and stay open source.

Sources (read 2026-10-27): The Register, 9 February 2026: more than 135,000 OpenClaw instances exposed; NVD: CVE-2026-25253; Trending Topics, 16 February 2026: Steinberger joins OpenAI, OpenClaw to a foundation.

Read: Complete OpenClaw timeline, Security crisis explainer. See also: Hermes Agent, CVE-2026-25253, AI agent.

OpenRouter

LLM API gateway providing a unified interface across Anthropic, OpenAI, Google, Mistral and many open models.

OpenRouter puts one OpenAI-compatible endpoint in front of many providers, which gives an agent provider fallback and a single bill. Its own fees are listed on its site.

P

Phi-3

Microsoft's small-language-model family. Phi-3 mini 3.8B runs on a Raspberry Pi 5.

Phi-3 mini has 3.8 billion parameters. The 4-bit build is a 2.2 GB download (phi3:mini in the Ollama library) and fits on a Pi 5; the Slips project measured 3B models at about 5 tokens per second on that board, so expect a little less. It falls short of larger models on complex tasks and suits narrow, well-defined jobs.

Pocket AI

Self-hosted AI agents and language models running on portable, low-power hardware you own.

PocketClaw's name for self-hosted AI on hardware you own and can put on a desk or carry: a Raspberry Pi 5, a mini PC, a Mac Mini. The bet is that such hardware can host a useful agent, and small local models, for less than the recurring cost of cloud AI, if you are willing to run it yourself.

Read: Pocket AI complete guide, Pocket AI hardware hub. See also: Self-hosted AI, Edge AI, Local LLM.

Prompt injection

Instructions hidden in content an agent reads (a document, a web page, a tool description) that it then follows as if they came from you.

OWASP ranks it first in its Top 10 for LLM applications (LLM01). An agent with tools turns it into actions: a web page can ask it to send a file or run a command. Defences: scope what the agent may do, keep it from acting on its own on untrusted input, and require approval for risky actions.

Sources (read 2026-10-27): OWASP Top 10 for LLM applications: LLM01 prompt injection.

Q

Quantisation

Reducing the numerical precision of model weights to shrink memory footprint and speed up inference, with quality tradeoff.

Weights go from 16-bit precision (FP16, BF16) to 8 or 4 bits. In llama.cpp's GGUF builds, Q4_K_M is a common choice for local inference. A 70B model takes about 140 GB at 16 bits and around 40 GB at 4 bits. Some quality is lost; how much depends on the model and the task.

Qwen

Alibaba's family of open-weight language models.

Qwen2.5-Coder (2024) is a code model in sizes from 0.5B to 32B. Qwen3 (29 April 2025) has six dense models from 0.6B to 32B, released under Apache 2.0, and two mixture-of-experts models, 30B-A3B and 235B-A22B.

Sources (read 2026-10-27): Qwen, 29 April 2025: Qwen3.

R

RAG (Retrieval-Augmented Generation)

Pattern of augmenting LLM responses with retrieved external data, typically from a vector database.

RAG works around the context window: relevant documents are fetched from a store and added to the prompt. Self-hosted setups often use Postgres with pgvector or a dedicated vector database. Until October 2026 this entry said ZeroClaw bundles an offline RAG over any document folder; its RAG module covers hardware datasheets only.

RCE (Remote Code Execution)

Vulnerability class where an attacker can execute arbitrary code on a target system over a network.

RCE is the highest-impact vulnerability class. Self-hosted AI agents are particularly RCE-prone because they typically include shell tools that, when reachable by an attacker via prompt injection or origin attacks, become RCE primitives.

See also: CVE-2026-25253, Prompt injection.

S

Sandbox

Isolation layer that constrains what an agent's tool execution can access on the host.

Docker containers, gVisor, Apple containers, WebAssembly runtimes such as wasmtime, bubblewrap or Seatbelt profiles: each limits which files, network destinations and resources a tool can reach. Few agents turn one on by default (see sandboxed tool execution).

See also: Docker sandbox, gVisor, Tool call.

Sandboxed tool execution

Running an agent's tool calls inside an isolated environment that limits filesystem, network and process access.

A sandboxed tool runs in a Docker container, a gVisor sandbox, an Apple container, a bubblewrap or Seatbelt profile, or a Workers runtime, with explicit limits on file paths, network destinations and resources. Fewer agents turn it on by default than their marketing suggests: Hermes Agent, OpenClaw and Nanobot all ship with it off (Hermes puts dangerous commands behind approvals; Nanobot offers bubblewrap on Linux and Seatbelt on macOS), while NanoClaw runs its agents in containers from the start. Until October 2026 this entry said it was default-on in Hermes Agent and OpenClaw.

Sources (read 2026-10-18): Hermes Agent docs: tools and terminal backends; OpenClaw docs: sandboxing; Nanobot docs (v0.3.5): configuration, security section; NanoClaw README: container isolation.

See also: Sandbox, Docker sandbox, gVisor.

Self-hosted AI

AI software you install on hardware you control, rather than consuming as a hosted product.

In practice: an agent (OpenClaw, Hermes Agent, Nanobot and others) on your own machine, VPS or container, pointed at an LLM API or at a local model. You keep control of credentials, data flow, logs and what the agent may do, and you take on running it.

T

Tailscale

Mesh VPN built on WireGuard. Common pattern for keeping self-hosted dashboards off the public internet.

Tailscale gives every device a stable address on a private network and sets access by user and group instead of by IP range. A common way to reach a self-hosted agent's dashboard without exposing it on a public IP.

Tool call

Structured invocation of an external function by a language model, typically as JSON conforming to a declared schema.

When an agent decides to act (read a file, call an API, run a shell command), the model emits a tool call. The runtime checks it against the declared schema, runs it, in a sandbox or not, and feeds the result back to the model.

V

Vector database

Database optimised for similarity search over high-dimensional embeddings.

It stores embeddings (fixed-length vectors that stand for text or other content) and finds the nearest ones fast. Used for RAG, semantic search and recommendations. Self-hosted options include Postgres with pgvector, Qdrant, Weaviate and Chroma; the last three are in the CVE tracker.

VPS

Virtual private server: a virtualised slice of a physical server, rented by the month.

The usual home for a self-hosted agent. Entry plans at providers such as Hetzner, Hostinger, Contabo or Linode give 2 to 4 GB of RAM and 2 vCPUs for a few euros a month, enough for one user's agent that calls a hosted model; a local model needs far more memory.

W

Watchtower

Container that watches running containers and pulls/redeploys when new images ship.

Watchtower automates Docker container updates. Useful for self-hosted AI agents where you want security patches applied promptly without manual intervention. The trade-off: an unwatched container with auto-updates can break unexpectedly. Use only on stable upstream images.

See also: Docker Compose, Self-hosted AI.

WebSocket origin validation

Server-side check that an incoming WebSocket connection comes from an allowed origin domain.

WebSocket connections are not subject to the same-origin policy by default. A server that fails to check the Origin header on the upgrade handshake can be connected to by JavaScript on any website. Related OpenClaw bug: CVE-2026-25253, where the Control UI auto-connected to an attacker-supplied gateway URL and sent its token.

Z

Zero trust

Security architecture that assumes no implicit trust and verifies every access request.

In self-hosted AI, zero-trust means no default permissions, explicit allowlists everywhere, identity-based access policies, and continuous verification rather than session-based trust. In agent terms that looks like IronClaw's WebAssembly tools, which get no network, file or credential access unless their capabilities file grants it. Until October 2026 this entry called IronClaw the canonical zero-trust agent, a label its own documentation does not use.

ZeroClaw

Single-binary Rust agent runtime, MIT or Apache-2.0, with approvals and an OS sandbox on by default and pluggable model providers.

ZeroClaw talks to Anthropic, OpenAI, Ollama, Bedrock, Gemini, OpenRouter and any OpenAI-compatible endpoint, so it can call a cloud model or stay on your machine with Ollama. Out of the box it is supervised (medium-risk actions need approval, high-risk ones are blocked), keeps file tools in the workspace and runs tools in the best OS sandbox it finds; sandboxed tools keep network access unless you restrict them. No telemetry, by its own policy. Prebuilt binaries cover every Raspberry Pi. Until October 2026 this entry called it local-only and AGPL-3.0, with egress denied at the iptables level.

Sources (read 2026-10-18): ZeroClaw README (v0.8.6); ZeroClaw docs: security model; ZeroClaw docs: sandboxing.

Read: Comparison with OpenClaw. See also: Local LLM, OpenClaw, Sandboxed tool execution.

A definition that is wrong or out of date: write to [email protected].