QwenPaw (Qwen Personal Agent Workstation) is a personal AI assistant from the AgentScope team that runs on your own machine or in the cloud and is reachable from chat apps, a web Console, a terminal UI, and a desktop app. One instance serves DingTalk, Lark, WeChat, Discord, Telegram, iMessage, and QQ at the same time.
Version 2.0 is a rewrite on AgentScope 2.0 around an Agent OS architecture. Each agent has a workspace of resources kept on disk, a governance layer that allows, denies, asks, or sandboxes each action, and a protocol-neutral driver layer that connects MCP, A2A, and ACP endpoints with encrypted credentials and a per-call policy gate. Loop templates such as Coding Mode and Mission Mode add composable approval gates to the agent loop.
Memory has three layers: live working context, full verbatim history (Scroll Context persists every turn and indexes evicted turns for on-demand recall), and a self-evolving personal knowledge base built on ReMe that turns conversations and resources into linked, editable Markdown.
Models come from cloud providers (DashScope and Qwen, OpenAI, Anthropic, Google Gemini, DeepSeek, Kimi, OpenRouter, and others) or run fully locally through the built-in QwenPaw Local runtime (based on llama.cpp), Ollama, or LM Studio. The project also publishes QwenPaw-Flash, a series of 2B, 4B, and 9B models trained for agent tasks, with Q4 and Q8 quantizations.
Features
- Multi-channel: one instance answers on DingTalk, Lark, WeChat, Discord, Telegram, iMessage, and QQ, plus a Console, TUI, and desktop app
- Three-layer memory: working context, verbatim history with on-demand recall, and a ReMe-based Markdown knowledge base
- Local models: QwenPaw Local, Ollama, or LM Studio with no API key, and the QwenPaw-Flash 2B, 4B, and 9B agent models
- Sandbox: kernel-level isolation with Seatbelt on macOS, Bubblewrap or Landlock on Linux, and AppContainer on Windows
- Tool Guard and File Guard: a rule engine inspects every tool call for injection, path traversal, and reverse shells, and sensitive files are blocked from agent access
- Skill Scanner and Access Policy: skills are scanned for prompt injection and secrets before activation, and declarative rules allow, deny, or request approval per capability call
- Multi-agent: independent agents with their own memory and skills, runtime sub-agents, and ACP for cross-system orchestration
- Skills and plugins: skills for scheduling, documents, browser, and news, a plugin marketplace, and MCP clients for external tools
- File workspace: navigation, preview, editing, diffs, upload, and download across project and agent files
- Scheduling: cron jobs and a heartbeat for recurring digests, reports, and multi-channel broadcasts
- Documents: reads, writes, and converts PDF, Word, Excel, and PowerPoint files
- REST API: an HTTP API for integration and automation
