Six questions. In order. Each one cuts the field, until what's left is the agent you should install today. We aim for honesty over completeness: if the right answer is a managed-hosting service rather than self-hosting at all, we'll say so.
Q1: Does your data have to stay on your hardware, no exceptions?
Then the model has to run on your hardware too: every agent below sends your prompts to the model provider you configure. Pair a local model server such as Ollama with an agent that talks to it. ZeroClaw is the smallest one: a single Rust binary, MIT or Apache-2.0, that lists Ollama among its providers and runs its tools in an OS sandbox it turns on by default (providers, security model). Hermes Agent, Nanobot, IronClaw and NanoClaw (through a skill) can use Ollama too. Mind two things: ZeroClaw's sandboxed tools keep network access unless you restrict them, so the agent itself can still reach the internet, and a local model needs the hardware for it (Llama 3.3 70B at 4-bit is a 43 GB file). Until October 2026 this answer said ZeroClaw only runs local models, denies egress at the iptables level and is AGPL-3.0: its repository says none of that.
If you can let the LLM call leave the machine (cloud Claude, OpenAI, OpenRouter), continue.
Q2: Will your agent's tools read input you don't control, and must they never see your API keys?
If yes, your answer is IronClaw. Untrusted tools run in WebAssembly sandboxes and reach only the hosts, paths and credentials they declare; secrets are encrypted and injected at the host boundary, so a tool never holds the raw key; jobs can run in Docker containers (README, sandboxed tools). It is MIT or Apache-2.0, with release builds for macOS, Linux and Windows. Trade-off: the shell tool is off by default and runs on the host once you enable it, and OpenClaw plugins don't carry over. Until October 2026 this answer described a source-available product for regulated industries at $750 a seat, with gVisor and SAML SSO: IronClaw's repository documents none of that.
If your tools only touch data you trust, continue.
Q3: Do you want every agent in its own container from the first run, with Claude as the model?
If yes, your answer is NanoClaw. Each agent group runs in its own Linux container (Docker on macOS, Linux and Windows through WSL2) and only sees the folders you mount into it; API keys stay in a credential gateway outside the container (README, security model). Claude runs through Anthropic's Claude Agent SDK by default, and OpenAI Codex, OpenCode or a local Ollama model are skills you add. Trade-off: you change what it does by changing the code with Claude Code, not a config file, and its network lockdown stays off until you turn it on. Until October 2026 this answer called NanoClaw macOS-only, Claude-only and sandboxed in Apple containers: its repository says none of that.
If you'd rather configure an agent than edit its code, continue.
Q4: Do you want a light personal agent with a browser UI, and will you set its sandbox yourself?
If yes (one owner, a small Linux or Mac machine, a mix of cloud and local models), your answer is Nanobot. It runs in a browser UI, a terminal or chat apps, reaches Claude through a native Anthropic provider and also works with OpenAI, OpenRouter and local servers such as Ollama (providers docs). Trade-off: its shell sandbox (bubblewrap on Linux, Seatbelt on macOS) and its workspace guard are off until you set them, and its docs ask for both in production (security section). Nanobot launched in February 2026 at about 4,000 lines of core code; at v0.3.5 it holds about 160,000 lines of Python by our count, so reading all of it is no longer the point. Until October 2026 this answer said it had no sandbox and needed a shim for Anthropic: both were wrong.
If you'd rather have command approvals on from the first run, continue.
Q5: Do you want OpenClaw without a server of your own?
If yes, and you already use Cloudflare, look at Moltworker: Cloudflare's experimental package that runs OpenClaw inside a Cloudflare Sandbox container behind a Worker (README). It needs the Workers Paid plan ($5 a month) plus container time, about $34.50 a month around the clock by the README's estimate, and the first request can take a minute or two while the container starts. Its README calls it a proof of concept that may break without notice, and data is lost when the container restarts unless you add R2 storage. Until October 2026 this answer called it free, with sub-millisecond cold starts and the V8 isolate as its sandbox: its README describes none of that.
If you want an agent you run and keep up yourself, continue.
Q6: Command approvals from the first run, multi-LLM, production-ready today?
That's Hermes Agent. Out of the box it runs commands on the host
(the local terminal backend) and sends the ones that match its list
of dangerous patterns through an approval step
(security docs).
Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox backends
are one setting away, and its
security policy
asks for the whole agent inside its Docker image once it reads input
you don't control. Model support is wide (Nous Portal, OpenRouter,
Anthropic, OpenAI, Gemini, local servers such as Ollama), the trust
model is documented, and the repository had about 255,000 GitHub stars
in October 2026. Until October 2026 this answer said Hermes is
Docker-sandboxed by default with network and filesystem allowlists; its
default backend has been local since its first release
(v0.22.2 defaults).
For new deployments without a specific reason to choose otherwise, this is the answer: run it in its Docker image.
The OpenClaw question, separately
Notice that OpenClaw doesn't appear above as a top recommendation. It's not because OpenClaw is bad: post-2026.4, it's fine. It's because if you're starting fresh in 2026, Hermes Agent is the easier on-ramp and Nanobot is the lighter one. OpenClaw 2026.4+ is the right answer if you have an existing install with custom plugins or team familiarity. Migrate-vs-stay is its own decision; we cover it in the migration guide.
The "should I self-host at all" question, even more separately
If your reading of the six questions above is "none of these fit me: I just want the bot to work and I don't want to do ops," that's a legitimate answer. Managed services like ClawRift, NitroClaw and ClawGo exist because not everyone should self-host. Their pricing pages, read on 18 October 2026, start at $19 (ClawRift) or $20 (NitroClaw, ClawGo) a month and go up to $49, $100 and $200; that buys you the agent without the VPS, the Caddy config, the cron jobs, the security advisories or the sleep deprivation. Until October 2026 this paragraph also named DeployHermes, whose site now presents Hermes Agent and sells no plan.
Self-hosting is a choice. It's not always the right one.
Quick map
| If… | Pick |
|---|---|
| Data can't leave your machine | ZeroClaw with a local model (Ollama) |
| Tools read untrusted input, keys must stay out of reach | IronClaw |
| Every agent in its own container, Claude by default | NanoClaw |
| Light personal agent, sandbox set by you | Nanobot |
| OpenClaw on Cloudflare, no server of your own (experimental) | Moltworker |
| Default safe new deployment | Hermes Agent |
| Existing OpenClaw install with plugins | OpenClaw 2026.4+ |
| Don't want ops at all | Managed service (ClawRift/NitroClaw/etc.) |
Then: hardware
Once you've picked the agent, the hardware decision is downstream. See the hardware buyer's guide. The short version:
- First-time self-hoster, cheap: Raspberry Pi 5 (8 GB) + Hermes Agent without browser tool. €140 all in.
- Workhorse: €450 generic Intel mini PC + Hermes Agent full including browser. €500 all in.
- Local-LLM 8B class: Mac Mini M4 24 GB + ZeroClaw. €1,099.
- Local-LLM 70B class: Mac Mini M4 Pro 48 GB + ZeroClaw. €1,899.
The agent-on-device combinations page covers the realistic crossings, read from each agent's requirements and each device's specs.
Then: LLM strategy
Last decision. Three options:
- Cloud LLM as primary: Claude (best agentic reliability) or GPT (mature SDK ecosystem). OpenRouter as fallback.
- Local LLM as fallback only: Ollama with Mistral 7B Q4 for cheap subtasks; cloud for hard reasoning.
- Local LLM as primary: ZeroClaw + Llama 3.3 70B Q4 on Mac Mini M4 Pro 48 GB. Cloud-free.
Published local-LLM speeds, machine by machine and with their setup, are in Local LLM benchmarks.
The thing nobody says
The "best" agent in 2026 is the one that's still maintained, still patched within 48 hours of disclosure, and still actively documented when something breaks at 11 PM. Project momentum matters more than benchmark scores. Hermes Agent has that momentum right now. OpenClaw post-foundation has it. NanoClaw, ZeroClaw, IronClaw and Nanobot have it within their niches. The fringes: small forks, new entrants without a security disclosure channel: don't.
Pick the answer the decision tree gives you. Then check that the project has shipped a release in the last 90 days, has a working security disclosure address, and has a public CVE record (zero CVEs is suspicious on a real install base: it usually means nobody's looking yet).
Then install it.
Sources
Read on 18 October 2026 (Hermes Agent v0.22.2, Nanobot v0.3.5):
Hermes Agent README,
security docs,
SECURITY.md,
AI providers;
Nanobot README,
providers,
configuration, security section,
README of February 2026;
Nanobot line count: Python files under nanobot/ in the
v0.3.5 release archive.
NanoClaw (read on 18 October 2026): README,
security model.
IronClaw (read on 18 October 2026): README,
sandboxed tools,
shell tool,
licence field.
ZeroClaw (v0.8.6, read on 18 October 2026): README,
providers,
security model,
sandboxing.