TL;DR

QwenPaw (Qwen Personal Agent Workstation) is an open-source personal AI assistant from the AgentScope team that you install on your own machine — not a hosted product with a self-hosted tier bolted on. It went from first commit to 34,000+ GitHub stars in roughly six months, which makes it one of the fastest-growing agent projects of 2026. Key facts:

  • 34,759 GitHub stars, 3,052 forks, Apache-2.0 license — commercial use allowed
  • Created 2026-02-24; v2.0.0 ground-up rewrite shipped 2026-07-10, v2.1.0 on 2026-08-13, v2.2.0 currently in beta
  • Python 3.11 – <3.14; installs via pip, a shell installer, Docker, or a beta Tauri desktop app
  • Runs fully offline with bundled llama.cpp runtime + purpose-trained QwenPaw-Flash 2B/4B/9B models, or connects to Ollama, LM Studio, and 14+ cloud providers
  • Five security layers: kernel sandbox, Tool Guard, File Guard, Skill Scanner, Access Policy
  • Reachable from chat apps: DingTalk, Lark, WeChat, QQ, Discord, Telegram, iMessage
  • Three-layer memory via ReMe — plain Markdown on disk, editable by hand
  • 597 open issues and a heavily China-first ecosystem — the biggest practical caveats

If you have wanted a persistent assistant — one that remembers last month, runs scheduled jobs, and answers you in Telegram — without renting it from someone else, QwenPaw is the most complete attempt shipping right now.

Quick Reference

FieldValue
Repoagentscope-ai/QwenPaw
Docsqwenpaw.agentscope.io
LicenseApache-2.0
LanguagePython (TypeScript console frontend)
Python>= 3.11, < 3.14
Installpip install qwenpaw
Dockeragentscope/qwenpaw:latest
Default port127.0.0.1:8088
Stars / forks34,759 / 3,052
Built byAgentScope team (AgentScope, AgentScope Runtime, ReMe)

What QwenPaw Actually Is

The name decodes to Qwen Personal Agent Workstation, and “workstation” is the more honest half. This is not a chatbot wrapper. It is a long-running local service that owns a working directory, a memory store, a set of skills and plugins, a scheduler, and a permissions model — then exposes that single agent through a web console, a terminal UI, a desktop app, and a pile of chat channels simultaneously.

The mental model that helps most: think of it as a personal server for one agent, the way Home Assistant is a personal server for your devices. Install it once, configure a model provider, and it stays up. Sessions, memory, and skills are shared across every surface — a conversation started in the browser console continues from Telegram with the same context.

Version 2.0.0 (July 2026) rewrote the project on top of AgentScope 2.0 and introduced the architecture the project now leads with: Agent OS. It has two halves:

  • Workspace — three pillars per agent: Resources (stored transparently on disk, not in an opaque DB), Governance (allow / deny / ask / sandbox rules), and Sandbox (per-platform kernel isolation).
  • Drivers — a protocol-neutral connector layer speaking MCP, A2A, and ACP, with encrypted credentials and a per-call policy gate.

That second piece matters more than it sounds. Most agent frameworks pick one protocol and make you adapt. QwenPaw treats MCP servers, agent-to-agent calls, and ACP orchestration as three drivers behind one permission boundary, so a policy written once applies regardless of how the capability arrived.

Three things converged.

First, the self-hosting wave hit personal assistants. Through 2025 and early 2026 the self-hosted AI conversation was about inference — Ollama, LM Studio, llama.cpp. Those solved “run a model locally” but not “have an assistant.” QwenPaw targets the layer above: memory, scheduling, channels, tools, and permissions.

Second, the v2.0 rewrite gave it a real story. Agent OS, Loop Engineering, and Scroll Context reframed a conventional agent app as infrastructure, and the star curve reflects it.

Third, it ships genuinely small models. The QwenPaw-Flash series (2B / 4B / 9B, Q4 and Q8 quantizations) is trained for agent tasks — tool calling, loop adherence, structured output — rather than general chat. With the bundled llama.cpp runtime, you go from pip install to a working agent with no API key at all. Few competing projects can say that honestly.

The Features That Matter

Scroll Context: nothing gets summarized away

Most agent frameworks manage long conversations by summarizing old turns and discarding the originals. That is lossy in exactly the way that hurts — the detail you need three weeks later is the detail the summarizer dropped.

Scroll Context persists every turn. When a turn is evicted from the live window it is indexed rather than compressed, and recalled on demand. The design goal, stated plainly in the v2.0 notes, is that nothing is summarized away. For an assistant you intend to keep for a year, this is the single most consequential architectural choice in the project.

ReMe: memory you can open in a text editor

Memory is powered by ReMe v0.4, a sibling AgentScope project. It maintains three layers: live working context, full verbatim history, and a self-evolving personal knowledge base.

The knowledge base is the interesting one, because it is Markdown on disk — readable, editable, searchable, and linked. Conversations and resources continuously become notes. If the agent learns something wrong about you, open the file and fix it. Compare that to vector stores, where correcting a bad memory means deleting an embedding you cannot read.

Five security layers, and they are not decorative

Running an agent with shell access on your own machine is the whole value proposition and the whole risk. QwenPaw’s answer is unusually thorough:

  • Sandbox — real kernel-level isolation: Seatbelt on macOS, Bubblewrap / Landlock on Linux, AppContainer on Windows. Shell commands see a restricted filesystem view.
  • Tool Guard — a YAML rule engine whose ShellEvasionGuardian inspects every tool call before execution for command injection, path traversal, reverse shells, and obfuscation. Approval levels: STRICT / SMART / AUTO / OFF.
  • File Guard — blocks access to sensitive paths independently of Tool Guard; ~/.ssh and the secrets directory are protected by default.
  • Skill Scanner — scans skills before activation for prompt injection, hardcoded secrets, and exfiltration patterns. Block / warn / off, with a whitelist.
  • Access Policy — declarative allow / deny / ask rules at tool-level granularity, with source-aware matching.

Skill Scanner deserves a call-out. Community skill marketplaces are an obvious supply-chain attack surface, and QwenPaw ships scanning as part of the default install flow rather than a plugin.

One agent, every channel

Channel support is broad: DingTalk, Lark, WeChat, QQ, Discord, Telegram, and iMessage, plus the console, TUI, and desktop app — one instance, shared memory and sessions.

Loop Engineering and multi-agent

Loop Engineering provides templated agent loops — Coding Mode, Mission Mode — with composable approval gates, so a coding task’s control flow differs from a research task’s without rewriting the agent. Multi-agent support spawns independent agents with their own memory and skills, plus runtime sub-agents.

Getting Started

The fastest path, assuming Python 3.11–3.13:

pip install qwenpaw
qwenpaw init --defaults
qwenpaw app

Then open http://127.0.0.1:8088/ and configure a model in Settings → Models.

If you would rather not manage Python:

# macOS / Linux
curl -fsSL https://qwenpaw.agentscope.io/install.sh | bash

The installer pulls uv, creates a virtualenv, and installs everything including Node.js and frontend assets. (Piping a remote script to bash is worth the usual caution — read it first if the machine matters.)

Docker is the cleanest option for a homelab box:

docker pull agentscope/qwenpaw:latest
docker run -p 127.0.0.1:8088:8088 \
  -v qwenpaw-data:/app/working \
  -v qwenpaw-secrets:/app/working.secret \
  -v qwenpaw-backups:/app/working.backups \
  agentscope/qwenpaw:latest

Note the deliberate three-volume split: config/memory/skills, provider credentials, and backups are separated, so you can back up state without dragging API keys along. If you run Ollama on the host and QwenPaw in Docker, add --add-host=host.docker.internal:host-gateway and point the Base URL at http://host.docker.internal:11434.

Terminal users get a first-class TUI:

qwenpaw                     # chat with the active agent
qwenpaw tui --resume <id>   # resume a session
qwenpaw .                   # start in the current repo (Coding Mode)

It drives the same agent as the console — same memory, skills, MCP tools, sessions — with streaming replies, slash commands, and inline tool-permission prompts.

Who Should Use This — And Who Shouldn’t

Good fit:

  • Homelab and self-hosting people who want an assistant that outlives any vendor
  • Privacy-driven users who need data to stay on their hardware — local models mean zero outbound calls
  • Anyone wanting an assistant reachable from Telegram or Discord without building the bridge
  • Teams evaluating agent security models; the five-layer design is worth studying regardless

Poor fit:

  • Anyone wanting a polished consumer app today. The desktop build is explicitly Beta, unnotarized on macOS (you will fight Gatekeeper), and first launch can take 10–60 seconds.
  • English-only users who need English-language community support (see below)
  • Low-spec hardware, if you plan to run local models — the 9B Flash model wants real RAM
  • People wanting a coding agent specifically — Coding Mode exists, but dedicated tools are further along on that axis.

Honest Limitations

The ecosystem is China-first. This is the most important thing a Western reader should know, and the README does not hide it: the default cloud provider is DashScope, one-click deploy is Alibaba Cloud ECS, models are distributed via ModelScope alongside Hugging Face, and the community channels lead with DingTalk and RedNote. Scanning the open issues sorted by reactions, most of the top feature requests are written in Chinese. Nothing here is broken for international users — Discord and Telegram channels work, OpenAI/Anthropic/Gemini/DeepSeek/OpenRouter providers are supported, docs exist in English, Chinese, Japanese, and Russian — but if you file an issue, expect the surrounding conversation to be bilingual at best.

597 open issues. For a six-month-old project moving this fast that is not alarming, but it is a real backlog. The maintainers have posted an explicit contribution policy about AI-generated issues and PRs, which tells you what the triage load looks like.

Release velocity is extreme. Five v2.2.0 betas landed between 2026-08-27 and 2026-08-31. Recent commits include fixes for hung MCP session RPCs, stale DingTalk stream connections, oversized tool results, and installer edge cases. Pin a stable tag for anything you depend on; latest is a moving target.

Telemetry is on by default with --defaults. It is anonymous and narrow — version, install method, OS, Python version, CPU architecture, GPU yes/no, sent once per version — and no files, credentials, or IP addresses are collected. But qwenpaw init --defaults accepts it automatically. Run qwenpaw init interactively if you want the prompt.

Upgrades from source need care. Major-version bumps require rebuilding the frontend, reinstalling the package, restarting, and hard-refreshing the browser cache. Use pip or Docker unless you contribute.

Comparison With Alternatives

QwenPawOpen WebUIOllama aloneHosted assistants
Persistent memoryThree-layer + Markdown KBBasicNoneVendor-controlled
Chat channels7+ (Telegram, Discord, …)Web onlyNoneVendor apps
SandboxingKernel-level, 3 OSesLimitedN/AN/A
Scheduled tasksBuilt-in cron + heartbeatNoNoVaries
Local modelsBundled runtime + FlashVia OllamaYesNo
LicenseApache-2.0BSD-3MITProprietary

The clearest way to place it: Open WebUI is a chat interface for your models; QwenPaw is an operating environment for your agent. If all you want is a nice window onto Ollama, Open WebUI is simpler and lighter. If you want memory that persists for a year, jobs that run at 6am, and an agent that pings your phone, QwenPaw is doing something Open WebUI does not attempt.

FAQ

Is QwenPaw free, and can I use it commercially? Yes. It is Apache-2.0, which permits commercial use, modification, and redistribution. Running it costs nothing beyond hardware; the only spend is optional cloud model API usage, which you can skip entirely by using local models.

Do I need an API key to use QwenPaw? No, if you use local models. QwenPaw Local (bundled llama.cpp), Ollama, or LM Studio all work without keys. You only need a key for cloud providers like DashScope, OpenAI, Anthropic, Gemini, DeepSeek, or OpenRouter — and the app will not chat until a valid key is set if you pick one of those.

Does QwenPaw send my data anywhere? Not your content. Deploy locally and conversations, memory, and files stay on your machine. The only outbound telemetry is anonymous install metadata sent once per version, and it excludes files, credentials, and IP addresses. If you use a cloud model provider, prompts obviously go to that provider.

Do I need to speak Chinese to use it? No. Documentation is available in English, Chinese, Japanese, and Russian, and international channels (Discord, Telegram) are supported. But the issue tracker and much of the community discussion are predominantly Chinese, so support conversations may be harder for English-only users.

What hardware do I need for local models? The Flash series is deliberately small — 2B, 4B, and 9B, with Q4 and Q8 quantizations. The 2B Q4 will run on modest laptops; the 9B wants a machine with real RAM or a GPU. QwenPaw Local includes hardware-aware recommendations that pick a size for your machine. If you use Ollama, set the context length to at least 32k.

How does QwenPaw compare to running Ollama plus a script? Ollama gives you inference. QwenPaw gives you the assistant around it: persistent memory, scheduling, chat-app channels, a skills/plugin system, MCP integration, multi-agent orchestration, and a five-layer security model. If your script has grown its own memory store and cron jobs, you are rebuilding QwenPaw.

Is it production-ready? For personal and homelab use, yes — with a pinned version. For anything business-critical, treat it as fast-moving software: pin a stable release rather than latest, back up the data volumes, and read release notes before upgrading.

The Verdict

QwenPaw is the most architecturally serious open-source personal assistant available in September 2026. Scroll Context and the Markdown-based ReMe memory solve the long-horizon problem most agent projects hand-wave, and the five-layer security model is the only one in this category that looks designed by people who actually thought about a malicious skill.

The caveats are real but bounded: a China-centric ecosystem that costs English-only users some community access, a large issue backlog, and a release cadence that demands pinned versions. None of those are architectural.

If you want an assistant that is yours — one that remembers, runs on your schedule, and cannot be deprecated by a pricing change — install it with Docker, pin a stable tag, and give it a week.

Sources