QwenPaw is a self-hosted personal AI assistant that you run on your own machine or in the cloud and reach through the chat apps you already use. One running instance serves a browser Console, a full-screen terminal UI, a desktop app, and channels such as DingTalk, Lark, WeChat, Discord, Telegram, iMessage, and QQ, all sharing the same agent, memory, and sessions.
The 2.0 line is a rewrite on AgentScope 2.0 built around an Agent OS architecture. Each agent gets a workspace with three parts: resources kept on disk, governance rules (allow, deny, ask, or sandbox), and a sandbox for macOS, Linux, and Windows. A protocol-neutral driver layer connects MCP, A2A, and ACP endpoints with encrypted credentials and a per-call policy gate. Loop Engineering supplies agent loop templates such as Coding Mode and Mission Mode with composable approval gates, and Scroll Context persists every turn, indexing evicted turns for on-demand recall instead of summarizing them away.
Memory is three-layered: live working context, verbatim conversation history, and a self-evolving personal knowledge base built on ReMe that turns conversations and resources into editable, searchable, linked Markdown. For models, QwenPaw ships its own QwenPaw-Flash models (2B, 4B, and 9B) trained for agent tasks with a bundled local runtime that needs no API key, and it also works with Ollama, LM Studio, or more than 14 cloud providers. Python 3.11 to 3.13 is required; Docker images are also provided.
Features
- Multi-channel access: one instance answers in DingTalk, Lark, WeChat, Discord, Telegram, iMessage, and QQ, plus Console, TUI, and desktop app
- Three-layer memory: working context, full verbatim history, and a ReMe-based knowledge base kept as linked Markdown
- Local or cloud models: QwenPaw-Flash 2B/4B/9B on a built-in local runtime, or Ollama, LM Studio, and cloud providers
- Security layers: kernel-level sandbox, Tool Guard, File Guard, a Skill Scanner that detects prompt injection and hardcoded secrets, and declarative Access Policy rules with allow, deny, or human-approval outcomes
- Multi-agent: spawn independent agents with their own memory and skills, create sub-agents at runtime, and orchestrate across systems over ACP
- File workspace: unified navigation, preview, editing, diffs, upload, and download across project and agent files, with workspace checkpoints
- Extensibility: skills for scheduling, documents, browser, and news; a plugin architecture with a marketplace; MCP integration with tool whitelisting
- Automation: cron-style scheduled tasks and a heartbeat for scheduled check-ins and digests
- Browser-use and computer-use: added in v2.1.0 alongside Codex and Qoder agent integration
- REST API: an HTTP API for integration and automation
- Telemetry: anonymous version, OS, and hardware data collected once per version during init, with an opt-in prompt in interactive setup
