Primary question: Does the single-operator trust boundary match how your team wants to run a personal assistant, or do you need per-user isolation QwenPaw explicitly does not provide?
RepoDaily adoption score
RepoDaily rates this as 91/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
6 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 4 command/install signal(s) were detected.
Trending momentum is +818 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 6 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
5 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
QwenPaw is a Python-based personal AI assistant from the agentscope-ai organization that runs inside your own environment — a laptop, a server, or a cloud host you control. The project description and pyproject.toml are explicit: all data and tasks run on your machine, with no third-party hosting of conversations or credentials. The package is built on agentscope 2.0.4.post1 and depends on a wide but intentional set of libraries for chat channels, scheduling, browser automation, and local model serving.
Where most agent frameworks focus on orchestration primitives, QwenPaw focuses on the operator surface. It ships two console entry points — `qwenpaw` and `copaw` — both pointing at `qwenpaw.cli.main:cli`, and an init command (`qwenpaw init`) that walks the operator through setup while displaying a security notice about the trust model. The README pitches the project as 'Your Personal AI Assistant; easy to install, deploy on your own machine or on the cloud; supports multiple chat apps with easily extensible capabilities.'
The extensibility story is centered on Skills and channels. CONTRIBUTING.md lists DingTalk, Feishu, QQ, Discord, and iMessage as chat targets, and pyproject.toml adds Telegram, Slack, Twilio, Matrix, and WeCom through their respective SDKs. Built-in skills named in the package description include cron, PDF/Office handling, news digest, and file reading, and the CONTRIBUTING guide invites new channels, model providers, and skills from outside contributors. The security model is published in SECURITY.md and is explicitly aligned with what users see during `qwenpaw init`.
Why it is trending now
- 818 period stars and a trending rank of 3 indicate sustained interest in self-hostable personal-assistant runtimes rather than API-only wrappers.
- Apache 2.0 license and a PyPI package (`qwenpaw`) lower the barrier to install and fork compared with closed-source assistants.
- Support for DingTalk, Feishu, QQ, Discord, iMessage, Telegram, Slack, Twilio, Matrix, and WeCom covers the chat apps most teams already live in.
- Built on agentscope 2.0.4.post1, which signals the project plugs into a known agent runtime rather than reinventing orchestration.
- A bundled Textual-based TUI with streaming Markdown, plus a Coding Mode that bundles `python-lsp-server` and `ast-grep-cli`, make the assistant useful as a local dev companion, not just a chat relay.
Problem it solves
- Operators who want one assistant across many chat apps usually face a stack of per-app bots with no shared skills or memory.
- Hosted assistant services put conversation data and credentials in a vendor cloud, which conflicts with privacy, compliance, or air-gapped requirements.
- Generic agent SDKs provide planning primitives but not the operator-facing UX: init flow, channels, scheduled tasks, skill marketplace, or a local TUI.
- Multi-channel bots that handle file reading, PDF/Office parsing, and browser automation typically require custom glue per channel.
- Adding a new model provider or channel often means forking rather than contributing back, because the upstream project lacks contribution conventions.
How it works
- Install from PyPI (`pip install qwenpaw`) on Python 3.11 through <3.14, as declared in pyproject.toml.
- Run `qwenpaw init`, which presents the security notice documented in SECURITY.md and configures credentials, channels, and skills.
- Pick one or more chat channels — DingTalk, Feishu, QQ, Discord, iMessage, Telegram, Slack, Twilio, Matrix, or WeCom — using their bundled SDKs.
- Select a model provider; CONTRIBUTING.md states providers must be natively compatible with the OpenAI `chat.completions` API or the Anthropic `messages` API, and lists DashScope, ModelScope, Ollama, and LM Studio as examples.
- Enable built-in Skills such as cron, PDF/Office handling, news digest, and file reading, or add custom skills following the contribution guide.
- Use the bundled `qwenpaw` TUI (or `copaw` alias) for a local streaming-Markdown console, or expose the assistant over your configured chat channels.
Product demo and interface preview
Architecture read: runtime, channels, skills, and security layers
- Entry point: `qwenpaw = "qwenpaw.cli.main:cli"` with a mirror alias `copaw`, as declared in `[project.scripts]`.
- Agent runtime: pins `agentscope==2.0.4.post1` and `agent-client-protocol>=0.9.0,<0.11.0` for agent communication.
- Channel SDKs: `dingtalk-stream`, `alibabacloud-dingtalk`, `lark-oapi` (Feishu), `discord-py`, `python-telegram-bot`, `slack-bolt`, `twilio`, `wecom-aibot-python-sdk`, `matrix-nio`, and others.
- Scheduling: `apscheduler>=3.11.2,<4` backs the cron skill named in the package description.
- Browser and screen: `playwright>=1.49.0` and `mss>=9.0.0` enable web tasks and screen capture.
- Local TUI: pins `textual>=8.2.8,<8.2.9`, with the upper bound tied to upstream fixes for Textualize/textual#6592 and #6643.
- Security surfaces: packaged rule directories `security/tool_guard/rules/**` and `security/skill_scanner/rules/**` indicate a tool guard and a skill scanner run inside the package.
- Coding Mode: bundles `python-lsp-server[all]>=1.10` as a zero-config LSP fallback and `ast-grep-cli>=0.20` for multi-language AST pattern matching.
Deployment notes from pyproject.toml and SECURITY.md
QwenPaw targets `requires-python = ">=3.11,<3.14"`, so operators need Python 3.11, 3.12, or 3.13. The pinning on `anyio>=4.0.0,<4.13.0` exists because anyio 4.13.0 introduced a busy-loop / getpid storm tracked as QwenPaw#2632 — operators who override dependency resolution should keep this upper bound. The `openai` pin is `>=2.0.0,<=2.33.0`, and `onnxruntime<1.24` is capped for local inference compatibility.
SECURITY.md states the trust model is aligned with `qwenpaw init`, and that the init flow shows a security notice covering the single-operator boundary, shared delegated authority when multiple people message the same instance, allowlists for channels and users, separate config and credentials per trust boundary, least-privilege sandboxing, and keeping secrets out of the working directory and skill-accessible paths. The same document says the SECURITY_WARNING text lives in `src/qwenpaw/cli/init_cmd.py`, and asks maintainers to keep both surfaces consistent.
How QwenPaw differs from other self-hostable agent runners
- Versus agent orchestration SDKs: QwenPaw ships an operator-facing CLI, init flow, channels, and a TUI; SDKs leave those to the user.
- Versus hosted assistant SaaS: QwenPaw keeps data on the operator's host and exposes the full Python source under Apache 2.0.
- Versus per-channel bot templates: QwenPaw unifies DingTalk, Feishu, QQ, Discord, iMessage, Telegram, Slack, Twilio, Matrix, and WeCom behind one Skills layer.
- Versus closed-source coding assistants: Coding Mode is an open, local fallback built on `python-lsp-server` and `ast-grep-cli`, not a remote IDE plugin.
Who should pay attention?
Good fit if
- You want one assistant that lives on your own machine and talks to chat apps your team already uses.
- You need scheduled tasks, file reading, PDF/Office handling, or news digests as first-class built-in skills.
- You are comfortable running Python 3.11–3.13 and editing YAML-style config files.
- You want to contribute new channels, model providers, or skills under Conventional Commits and Apache 2.0.
Skip for now if
- You need per-user, multi-tenant authorization on a shared instance — SECURITY.md explicitly says that model is out of scope.
- You require a vendor SLA, paid bug bounty, or enterprise support — the project states there is no bug bounty program and no budget for paid reports.
- You want prompt-injection hardening as a primary feature — prompt injection without a trust-boundary bypass is listed as out of scope.
- You cannot pin `agentscope`, `textual`, `openai`, `anyio`, or `onnxruntime` to the project's declared ranges.
Risks and cautions
The project has a clear, documented security model and a clean install path, but the single-operator trust boundary and the early-stage pinning surface mean operators must review config, channels, and skills before exposing the instance.
- SECURITY.md is explicit that per-user multi-tenant authorization on a shared instance/config is not supported.
- Prompt injection without a demonstrated trust-boundary bypass is out of scope, which puts responsibility on the operator to sandbox skills.
- Dependency pins such as `anyio<4.13.0`, `textual<8.2.9`, and `openai<=2.33.0` indicate active compatibility work; overriding them can reintroduce known bugs.
- There is no bug bounty program and no budget for paid reports, so disclosures rely on voluntary responsible reporting.
- The project is relatively new at trending rank 3 with 818 period stars; long-term maintenance cadence is not yet established.
- Trust model: single-operator boundary, with shared delegated authority when multiple people message the same instance (SECURITY.md).
- Init alignment: `qwenpaw init` displays a security notice mirrored in `src/qwenpaw/cli/init_cmd.py`.
- Packaged guards: `security/tool_guard/rules/**` and `security/skill_scanner/rules/**` are bundled in the wheel.
- Out of scope: prompt-injection-only chains without a boundary bypass, operator-intended local features framed as injection, and authorized-user actions framed as privilege escalation.
- Disclosure route: vulnerabilities are reported through the Alibaba Security Response Center (ASRC).
- Acceptance gate requires exact vulnerable path, tested version or commit SHA, reproducible PoC, and demonstrated impact tied to documented trust boundaries.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
OpenHands | You want an open-source agent runtime focused on software-engineering tasks rather than personal chat channels. | Apache 2.0; self-host. |
AgentScope (runtime upstream) | You want the orchestration runtime QwenPaw builds on, without the channel and skills packaging. | Apache 2.0; self-host. |
Dify | You need a visual LLMOps platform with hosted and self-hosted options and a broader app-store model. | Open-source self-host plus hosted tiers. |
n8n | Your need is multi-channel automation and scheduled tasks more than LLM-first assistant behavior. | Sustainable Use License; self-host. |
What this trend reveals
Channel adapters for underserved chat apps
CONTRIBUTING.md invites new channels, and the existing set already spans DingTalk, Feishu, QQ, Discord, iMessage, Telegram, Slack, Twilio, Matrix, and WeCom. Apps not in that list — such as Signal, Teams, or regional messengers — are natural PR targets.
Open an issue on the QwenPaw issue tracker proposing the channel, confirm scope with maintainers, and follow the `feat(channels): ...` commit convention.
Custom Skills on top of the built-in set
The built-in skills (cron, PDF/Office, news digest, file reading) demonstrate the extension surface. Skills that combine `playwright` for browser flows with `apscheduler` for cron would exercise parts of the runtime that already ship.
Write a skill that reuses existing dependencies from pyproject.toml so it does not bloat the install, and add tests following the local `pytest` gate.
Model-provider contributions beyond DashScope and Ollama
CONTRIBUTING.md says providers must be OpenAI `chat.completions`- or Anthropic `messages`-compatible and lists DashScope, ModelScope, Ollama, and LM Studio. Providers that meet that bar but are not yet integrated are straightforward additions.
File an issue with the provider's API compatibility details and a proposed `feat(models): ...` PR scope.
RepoDaily verdict
QwenPaw is a credible local-first personal-assistant runtime: it packages a real agent runtime, a broad set of chat channels, a Skills layer, and a documented single-operator security model. Operators who accept that trust boundary — and the project's early-stage dependency pins — get a self-hostable assistant they can extend under Apache 2.0. Teams that need multi-tenant isolation or vendor-backed support should look elsewhere.