中文
AI Tools / local-self-hosted

QwenPaw Review 2026: Local AI Assistant with Memory

Reviewed by AIX Cove ·
QwenPaw Review 2026: Local AI Assistant with Memory
local-self-hosted

QwenPaw at a glance

QwenPaw is an open-source personal AI assistant built by Alibaba's AgentScope team. You run it on your own machine, on a cloud server, or through the free AgentScope Platform. It connects to chat apps (DingTalk, Lark, WeChat, Discord, Telegram, iMessage, QQ), keeps a three-layer memory, and can run entirely on local models with no API key at all. It is Apache-2.0 licensed, has roughly 34,000 GitHub stars, and has shipped about one release per month since the 2.0 rewrite.

Before writing this I read the repository README, the documentation, the release notes, and the discussions, and I checked a third-party security writeup. This is a genuinely active project, and it is also a young one. The 2.0 line only landed in July 2026, and the open issue count (over 900) reflects both heavy use and rough edges.

What it actually gives you

  • Channels: one instance serves DingTalk, Lark, WeChat, Discord, Telegram, iMessage, and QQ. You can also use the web console, a full-screen terminal UI, or the desktop app.
  • Three-layer memory: live working context, full verbatim history, and a self-evolving personal knowledge base (ReMe) stored as readable, editable Markdown.
  • Skills and plugins: scheduling, documents, browser, news, PDF and Office handling, a plugin marketplace, and MCP integration for external tools.
  • Local or cloud models: the QwenPaw-Flash models (2B, 4B, 9B) are trained for agent tasks and run fully offline, or you can use Ollama, LM Studio, or 14+ cloud providers.
  • Automation: cron-style scheduled tasks, multi-channel broadcasting, scheduled digests, and multi-agent setups with parallel sub-agents.
  • Security layers: OS-level sandbox, Tool Guard, File Guard, and a Skill Scanner that inspects skills before activation.
  • Agent OS (2.0): each agent gets a workspace with on-disk resources, governance rules, and a sandbox, plus protocol drivers for MCP, A2A, and ACP.

The v2.1.0 release (August 2026) added an OS shell, a unified Files workspace, a Creator app, browser-use and computer-use, workspace checkpoints, and integration with Codex and Qoder agents. The roadmap moves month to month, so the release notes are the most reliable picture of what exists.

Typical workflow

Install is deliberately easy. pip install qwenpaw, or the one-line script installer, or Docker. Then:

  • Run qwenpaw init --defaults, then qwenpaw app.
  • Open the console at http://127.0.0.1:8088/ and configure a model. Cloud providers need an API key (DashScope, OpenAI, Anthropic, Gemini, DeepSeek, Kimi, OpenRouter, and more); local models need none.
  • For a private setup with zero API keys, pick QwenPaw Local in Settings and download a QwenPaw-Flash model. Everything then runs on your machine.
  • Connect channels (DingTalk, Lark, Discord, Telegram, and others) following the channel setup docs.
  • Add skills and cron jobs for scheduled digests or reports.

A realistic first project: a Telegram channel that collects your news subscriptions, summarizes them at 8 a.m. through a scheduled task, and stores the digests in your ReMe knowledge base. That is roughly 20 minutes of setup with no code.

Where it fits

Good fits:

  • People who want a personal assistant that is not in the cloud, with data staying on their machine.
  • Users who live in DingTalk, Lark, WeChat, or QQ and want AI inside those apps.
  • Anyone who wants scheduled automation (digests, reports, broadcasts) without writing code.
  • Users who want to switch models freely between local and cloud without rebuilding the setup.

Weak fits: teams that need a managed, supported deployment with SLAs; people who want a polished commercial product rather than an actively evolving open-source one; and users who need every chat channel. WeChat Work, for instance, is still on the wish list, and vision input is not fully there yet. If you need a self-hosted knowledge base rather than a personal assistant, AnythingLLM is a more focused tool, and OpenClaw is the closest comparable open-source assistant for agent-style automation.

Practical tips

  • Skip API keys entirely for a private assistant. Use QwenPaw-Flash via QwenPaw Local. The 9B model is a reasonable default for agent tasks; the 2B is for weaker hardware.
  • Know the Docker networking gotcha. Inside the container, localhost is the container. Add --add-host=host.docker.internal:host-gateway and point the model Base URL at http://host.docker.internal:11434 for Ollama, or use --network=host on Linux.
  • Use separate volumes. Mount qwenpaw-data, qwenpaw-secrets, and qwenpaw-backups as distinct volumes so config, credentials, and backups stay isolated and portable.
  • Keep the guards on. Tool Guard approval levels (STRICT, SMART, AUTO, OFF) and the File Guard defaults (it protects ~/.qwenpaw.secret/ and ~/.ssh) are the difference between an assistant and a footgun. Use Skill Scanner block mode before installing third-party skills.
  • Work in the terminal. qwenpaw . starts Coding Mode scoped to the current repo, with slash commands (/model, /clear, /resume) that work while the agent is running.
  • Back up the volumes. qwenpaw uninstall keeps config and data; --purge removes everything. After a major upgrade, rebuild the console frontend from source and hard-refresh the browser cache.

Limits and risks

  • Young 2.x codebase. The ground-up rewrite shipped in July 2026. Over 900 open issues, and the discussions contain real complaints: UI freezes, coding processes that stall, AGENT_UNKNOWN_ERROR failures, and channel gaps like WeChat Work. Expect rough edges.
  • Desktop app is beta. It is not notarized on macOS, so Gatekeeper will warn. First launch takes 10-60 seconds, and compatibility is not fully tested across hardware.
  • Telemetry. qwenpaw init sends anonymous usage data once per version (version, install method, OS, Python version, architecture, GPU presence). The interactive prompt lets you opt out; --defaults accepts it automatically.
  • Security is layered, not absolute. An independent writeup on Towards AI planted six attacks across QwenPaw's 18 tasks and its guards caught five. The skill scanner is a real control, but treat the assistant as a semi-trusted actor when it touches your files.
  • Docs churn. Several documentation URLs have already moved or died between releases. If a doc link 404s, the GitHub README is the most reliable index.

Pricing and licensing

Free, Apache-2.0, no usage limits. The costs are whatever you pay for cloud model APIs (or nothing for local models), plus hardware if you run larger models. The AgentScope Platform offers free cloud deployments of QwenPaw, but that means trusting the platform with your assistant's data, which defeats the point for privacy-focused setups.

Related tools on AIXCove

Sources and further reading

Sources: official docs & pricing pages, hands-on testing where noted, and community feedback. Prices verified August 2026 and may change.