Basically it's just a loop with bubblewrap based sandboxing for the tools (not really enough if you're going to expose it to a lot of untrusted data - I intend to move the entire thing into a vm) and the "identity", "soul" and "memory" split that the original openclaw used to give the agents persistent identity.

The e-mail access is read-only simply by virtue of it having no direct access to credentials but access to tools to run read only operations on my mailbox.

They also have tools to read and send Matrix messages, but at the end of the turn any new messages also get injected automatically if any to start a new turn. In additional there's heartbeat that triggers occasional requests to clean ensure anything they "want to remember" is consolidated in the memory files, and to clean up, or advance any tasks, and a very basic reminder system.

I'm using a mix of Kimi, GLM5 to run the actual agents at the moment.

I might release parts of the code at some point. It's nothing special, but it's small and easily auditable unlike OpenClaw.

I picked Matrix because it's trivial to self-host with federation turned off so the agents are reasonably isolated (with the caveat that they do have web access but at least they'll have to work a bit more to leak my data - but be careful). I run it on in my wireguard network and can access it via a Matrix client on my phone and/or a web app on my home machine.

I can also access it via Claude, Codex, Kimi CLI via a trivial little mcp server that wraps the same Matrix client code the agents use.