OpenClaw
Yes
It runs on your own computers, on macOS, Linux and Windows.
Choose the platform that fits your work.
Compare hosting, execution and controls, with sources for each rating.
Ratings checked 27 October 2026. Capabilities and editions can change.
When OpenClaw may fit better
Twenty-plus chat apps, phone apps, MIT source, a registry.
Read the full comparisonCriterionOrchestrator ZeroOpenClaw
Orchestrator Zero
Yes
Native binaries for all three. Service checks passed on hosted Windows and Mac runners.
OpenClaw
Yes
The Gateway installs as a service on macOS (LaunchAgent), Linux (systemd) and native Windows (Scheduled Task), with companion apps and node hosts on all three.
OpenClaw
Yes
MIT-licensed, with no hosted service: you run the Gateway.
OpenClaw
Yes
Nodes connect out to the Gateway over a WebSocket.
OpenClaw
Yes
A registry of paired nodes, placement of work on them, and staged upgrades of the Gateway and the nodes.
Orchestrator Zero
See conditions
Workflow steps replay; lost harness sessions start fresh. Interrupted calls have separate retry rules.
OpenClaw
See conditions
The Gateway persists recovery state and resumes eligible interrupted turns. Retries and reconciliation are bounded and depend on the runtime; this is not uniform replay from each completed step.
Orchestrator Zero
See conditions
Plugin tools follow tenant rules. Some native harness actions bypass the permission hook.
OpenClaw
See conditions
Tool filters and session permission modes restrict actions in code. Exec has approval and auto-review modes; plugin actions and native harnesses have their own approval paths.
OpenClaw
See conditions
Chat apps and the CLI can answer exec and plugin approvals. Requests can expire or be cancelled on Gateway restart, so waits are not uniformly durable.
OpenClaw
See conditions
Plugin versions can be pinned and artifact changes require confirmation. Remote MCP metadata refreshes automatically; grants identify servers and tools, rather than approved definitions.
OpenClaw
See conditions
Operator scopes and multi-user ownership work within one trusted Gateway domain. The docs recommend separate Gateways and OS users or hosts for strong separation between teams.
Orchestrator Zero
Yes
Set strict reservation to refuse model calls that cannot fit the budget. Uses configured prices and reported usage.
OpenClaw
See conditions
Cost is estimated; token budgets guard a session's goal and set no cap on spend.
OpenClaw
Yes
The Gateway holds provider credentials. Cloud workers proxy inference through it, while nodes and sandboxes run commands without provider keys. Stored secrets are not added to subprocess environments.
Orchestrator Zero
See conditions
Isolation varies by OS and mode. Windows has none; the latest Mac profile fix awaits a real rerun.
OpenClaw
See conditions
Docker sandboxes default to no network. A host allowlist needs OpenShell or your proxy; the secret egress proxy's allowlist only covers unsandboxed Gateway commands.
Orchestrator Zero
Yes
Signed evidence and hash chains cover recorded actions. Save trusted chain heads outside the database.
OpenClaw
See conditions
The Gateway records a bounded metadata ledger and can record execution identity and approval receipts. Persistence is best effort; the docs do not describe a verifiable hash-chained or signed activity log.
Orchestrator Zero
Yes
Per-person payload-key erasure is built in. Restore backups with the erasure ledger; older backups still contain keys.
OpenClaw
See conditions
Sessions can be deleted and memory derived from chosen sessions forgotten, but there are no per-person keys, and the docs say neither control erases everything the agent has seen.
Orchestrator Zero
See conditions
Retention and legal holds work. Paged capture stays incomplete with missing or invalid source data; it cannot recover lost records.
OpenClaw
See conditions
session.maintenance sets how long sessions are kept and a disk budget, the audit ledger keeps a fixed 30 days, and pinned sessions are protected from maintenance; no legal hold is documented.
OpenClaw
Yes
Bundled provider plugins cover OpenAI, Anthropic, Google Gemini and others, and local models run through Ollama, LM Studio or llama.cpp.
OpenClaw
Yes
Agents use MCP servers as tools, and the bundled A2A channel publishes an Agent Card, accepts A2A 1.0 tasks and can message peer agents.
Edition, preview status and missing functionality are different conditions. Read each explanation. These criteria are our selection, not a product score.
Research matrix: all 23 products
- Yes: Documented and available
- Conditional: Scope, preview or edition conditions apply
- No: Documented absence or incompatible architecture
- Not documented: Insufficient evidence
See where others are stronger.
| Product | Any machine you own | Linux, macOS and Windows | Self-hosted control plane | No inbound ports | Fleet operations | Durable runs | Tool policy outside the model | Approvals in chat | Tool snapshots | Tenants built in | Budgets that stop a run | Provider keys off the workers | Sandbox with an egress allowlist | Tamper-evident audit trail | Erasure by key | Retention with legal hold | Model provider choice | MCP and A2A |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Orchestrator Zero | Yes | YesNative; hosted-runner tested | Yes | Yes | Yes | ConditionalDepends on agent type | ConditionalHarness coverage varies | ConditionalTested against stand-ins only | Yes | Yes | YesSet strict reservation | Yes | ConditionalLinux/macOS; Windows tier 0 | YesKeep trusted chain heads | YesRestore with erasure ledger | ConditionalCapture needs source data | Yes | Yes |
| Hermes Agent | YesYour hardware or cloud | YesNative on all three | YesLocal agent and gateway | ConditionalDepends on connection | ConditionalGateway and peer management | ConditionalRecovery depends on path | ConditionalTool and backend coverage | ConditionalChat prompts; timed waits | NoTool lists refresh directly | ConditionalProfiles and separate keys | ConditionalLimits on costed MCP calls | ConditionalDocker sandbox scope | ConditionalDocker; network setup needed | Not documented | Not documented | ConditionalPruning; no documented hold | YesMultiple vendors and local | YesMCP and A2A plugin |
| Ruflo | YesYour own hardware | YesNative CLI installation | YesLocal core and federation | ConditionalLocal stdio; network peers | ConditionalFederation peer management | ConditionalPersisted workflow progress | ConditionalHost and transport coverage | ConditionalHuman review gates | Not documented | ConditionalSeparate AI Team service | ConditionalNew subagents can be stopped | NoKeys in runtime config | ConditionalDepends on execution path | ConditionalSelected receipt chains | Not documented | ConditionalBounded local audit logs | YesMultiple vendors and Ollama | ConditionalMCP; A2A discovery only |
| Windmill | Yes | ConditionalWindows and Mac in Enterprise | Yes | Yes | ConditionalWorker tags and groups | Yes | ConditionalTool lists per run | YesSlack and Teams | Not documented | Yes3 workspaces free | ConditionalMetered, no cost stop | ConditionalSecret store, worker reads it | Conditionalnsjail, no egress allowlist | ConditionalLogs vary by edition | Not documented | ConditionalRetention, no legal hold | Yes | ConditionalMCP, no A2A |
| Temporal Agent Harness | Yes | Yes | Yes | Yes | ConditionalWorker list, no machine join | Yes | YesPer agent and session | YesSlack, Discord and Teams | Not documented | ConditionalNamespaces, access is yours | ConditionalTokens counted, no budget | NoKeys in worker environment | ConditionalCode Mode only, no allowlist | ConditionalHistory, not tamper-evident | ConditionalDelete runs, no per-user keys | ConditionalRetention, no legal hold | Yes | ConditionalMCP, no A2A |
| Hatchet | Yes | ConditionalMac and Linux; Windows via WSL | Yes | Yes | ConditionalLabels, no version rollouts | Yes | Not documented | ConditionalEvent waits; chat is your code | Not documented | Yes | Not documented | NoKeys in worker environment | Not documented | ConditionalPaid plan, not tamper-evident | Not documented | ConditionalRetention, no legal hold | ConditionalYour code calls the model | ConditionalMCP, no A2A |
| Dapr Agents | Yes | Yes | Yes | NoSidecars call each other | ConditionalPlacement, no labels or block | YesDurableAgent workflows | ConditionalHook code; OPA on MCP only | ConditionalChat only via your own bot | Not documented | ConditionalNamespaces, access is yours | ConditionalClaude executor only | ConditionalKey in sidecar on the worker | ConditionalCode sandbox, no allowlist | ConditionalSigned history, preview only | ConditionalPurge per run, no user keys | ConditionalRetention, no legal hold | Yes | ConditionalMCP, no A2A |
| AgentField | Yes | YesWindows via the desktop app | Yes | NoCalls into agents | ConditionalAgent registry and canaries | ConditionalRe-runs, resume is manual | ConditionalAllow/deny rules, no approve | ConditionalWebhook API, no chat or CLI | Not documented | ConditionalTeam boundaries | ConditionalCaps for some harnesses | NoKeys in the agent's env | Not documented | YesSigned record per execution | Not documented | ConditionalRetention period, no hold | Yes | ConditionalMCP; no A2A protocol calls |
| OpenClaw | Yes | Yes | Yes | Yes | Yes | ConditionalRuntime-dependent recovery | ConditionalControls vary by runtime | ConditionalExpiry and restart limits | ConditionalPlugin pins; MCP unchecked | ConditionalOne boundary per gateway | ConditionalEstimates, no cost cap | YesWorkers proxy via Gateway | ConditionalAllowlist only via OpenShell | ConditionalAudit log without hash chain | ConditionalDelete sessions and memory | ConditionalRetention setting, no hold | Yes | Yes |
| kagent | ConditionalKubernetes only | NoKubernetes only | Yes | NoTraffic routed in | ConditionalKubernetes pools | ConditionalActive turn lost on node death | ConditionalTool lists, approval flag | ConditionalUI and A2A API, no chat app | Not documented | ConditionalNamespaces; user isolation gaps | ConditionalTokens traced, no budget | Yes | YesgVisor, default-deny egress | ConditionalTraces without tamper evidence | ConditionalDelete a user's memories | NoNo retention for run history | Yes | Yes |
| LangSmith Deployment | ConditionalEnterprise plan | ConditionalDocker on macOS and Windows | ConditionalEnterprise plan | ConditionalServer takes requests | ConditionalDeployments, no routing | YesCheckpointed workflows | ConditionalMiddleware in agent code | ConditionalSlack cards in beta only | Not documented | Yes | ConditionalCaps in gateway beta | ConditionalOptional gateway, beta | YesLangSmith Sandboxes | ConditionalAdmin actions, Enterprise | ConditionalDelete traces by metadata | ConditionalRetention, no legal hold | Yes | Yes |
| CrewAI | ConditionalFactory on your Kubernetes | ConditionalFramework only; AMP on Linux | ConditionalFactory, Enterprise plan | NoCrews serve an HTTP API | ConditionalOne K8s node pool, all crews | ConditionalManual resume from checkpoint | ConditionalTool hooks you write | ConditionalEmail and UI; chat via webhook | Not documented | YesOrganizations; RBAC Enterprise | ConditionalCost estimates, no spend cap | ConditionalInjected into crew env | ConditionalExternal sandbox required | ConditionalAudit logs, no hash chain | ConditionalForget a memory scope | ConditionalTrace retention, no hold | Yes | Yes |
| Dify | YesAnywhere Docker runs | ConditionalDocker; WSL 2 on Windows | YesFree community edition | NoAPI calls the agent backend | Not documented | ConditionalWaits persist; no crash resume | ConditionalTool list per agent only | ConditionalWeb, email, API; no chat app | ConditionalMCP tool list updated by hand | ConditionalMany workspaces: Enterprise | ConditionalToken costs shown, no cap | ConditionalPlatform-held credentials | ConditionalOpenShell allowlist is optional | ConditionalEnterprise, admin actions only | ConditionalDelete conversations by API | ConditionalRetention days, no legal hold | Yes | ConditionalMCP; A2A via community plugin |
| n8n | Yes | ConditionalNative npm being deprecated | Yes | Yes | ConditionalNo label routing | ConditionalManual retry | ConditionalReview set per workflow | YesSlack, Teams and more | Not documented | ConditionalProjects, paid plans | ConditionalPrepaid credits, Cloud only | ConditionalCloud gateway credits only | ConditionalSandbox, no egress allowlist | ConditionalLog streaming, Enterprise | ConditionalDelete their executions | ConditionalPruning, no legal hold | Yes | ConditionalMCP, no A2A |
| IBM watsonx Orchestrate | ConditionalTheir cloud or OpenShift | NoTheir cloud or OpenShift | ConditionalPaid, on OpenShift only | NoCalls into agents | NoNo machine fleet | ConditionalCrash resume not documented | ConditionalMCP controls; SaaS scope | YesWorkflow forms in Slack | ConditionalTool versions pinned | Yes | ConditionalUsage tracked, no cap | Yes | ConditionalAllowlist on SaaS only | ConditionalActivity events, not chained | ConditionalDeleted with user access | ConditionalRetention, no legal hold | Yes | Yes |
| UiPath | ConditionalLocal robots in preview | ConditionalWindows; Linux in Docker | YesAutomation Suite on Kubernetes | YesRobots and Relay dial out | ConditionalRobots; agent jobs in preview | ConditionalManual retry from last step | YesPer-agent tool guardrails | YesTeams, Slack, Outlook; cloud | ConditionalA2A cards kept until refresh | Yes | ConditionalUnit cap; LLM call boundaries | YesAI Trust Layer gateway | ConditionalIsolated, no egress allowlist | ConditionalLogs, not tamper-evident | Not documented | ConditionalRetention, no legal hold | YesIncl. own models via Relay | ConditionalA2A in preview |
| Camunda | YesWorkers on hosts you choose | ConditionalLinux only in production | ConditionalEnterprise licence in prod | YesWorkers poll for jobs | ConditionalJob types, no machine registry | Yes | ConditionalGates modelled per process | ConditionalCLI; Teams app in alpha | ConditionalBPMN tools versioned; MCP live | Yes | ConditionalCall caps; trial LLM budget | ConditionalSecrets resolved on the worker | Not documented | ConditionalAudit log, no hash chain | ConditionalDelete instances, no own keys | ConditionalRetention, no legal hold | Yes | ConditionalMCP; A2A client in alpha |
| Microsoft Copilot Studio | ConditionalComputer use on own PCs | NoTheir cloud; Windows PCs | NoMicrosoft cloud only | ConditionalOwn PCs dial out; A2A calls in | ConditionalComputer-use machines only | ConditionalFlows hold waits up to 30 days | ConditionalConnector block, no approve | YesTeams, Outlook, portal | NoMCP changes apply live | YesPower Platform environments | ConditionalCredit cap; delayed enforcement | YesModels served by Microsoft | ConditionalOffline sandbox; URL filters | ConditionalPurview log, no hash chain | ConditionalPurview delete; env-level keys | YesPurview retention and holds | ConditionalNo local models | Yes |
| Guild.ai | NoRuns in Guild's runtime | NoGuild's cloud only | NoHosted on Google Cloud | NoAPI forwards to the runtime | NoGuild runs the compute | ConditionalTypeScript state machines | ConditionalAllow and deny, no approve | ConditionalAgent asks; no call gate | ConditionalVersioned, no change check | YesOrganizations, workspaces | YesMonthly USD, blocks at 100% | YesCredential proxy holds them | YesProxy only, domains by policy | ConditionalNo documented check | Not documented | Not documented | ConditionalMany vendors, no local | ConditionalMCP, no A2A |
| Amazon Bedrock AgentCore | ConditionalRuntime runs in AWS only | NoAWS cloud, Linux only | NoManaged AWS service | NoPlatform calls the agent | NoAWS manages all compute | ConditionalStorage, not step replay | ConditionalCedar allow and deny | ConditionalInline function, your own UI | ConditionalCached schema until resync | ConditionalTenant mapping is yours | ConditionalToken caps, no money budget | ConditionalGateway for OpenAI, Anthropic | ConditionalSandbox, allowlist via VPC | YesEnable logging and validation | ConditionalDelete per actor, no own keys | ConditionalExpiry settings, no legal hold | Yes | Yes |
| Microsoft Foundry Agent Service | ConditionalMicrosoft hosts the agents | NoMicrosoft cloud only | NoManaged Azure service | NoPlatform calls the container | NoMicrosoft-managed compute | ConditionalPreview, handler restarts | ConditionalPer-agent MCP lists | ConditionalAPI only, no chat approvals | ConditionalToolbox versions; manual review | ConditionalTenants defined by your app | ConditionalToken quotas, no run budget | ConditionalEntra identity, no static key | ConditionalNo egress, or via your VNet | ConditionalAudit log, no integrity proof | ConditionalPer-user delete, no own keys | YesPurview, pay-as-you-go | YesCatalog or your own gateway | Yes |
| Google Gemini Enterprise Agent Platform | ConditionalGoogle-managed runtime | NoGoogle cloud only | NoManaged Google Cloud service | NoContainer serves port 8080 | NoFully managed runtime | ConditionalManual resume by invocation ID | ConditionalAllow and deny, no approve | ConditionalExperimental, in ADK code | ConditionalRegistry copy; manual updates | ConditionalIAM per user, no tenants | ConditionalToken metrics, no budget | ConditionalIAM identity, no static key | ConditionalAllowlist only in preview | ConditionalAudit logs, no integrity proof | ConditionalPurge per user, no own keys | ConditionalTTL settings, no legal hold | Yes | YesA2A hosting in preview |
| Warp | ConditionalEnterprise workers | Yes | NoWarp hosts the control plane | Yes | ConditionalRouting; you maintain hosts | ConditionalResumable sessions | ConditionalCoverage depends on harness | ConditionalApp approvals; chat intake | Not documented | YesTeams and workspaces | ConditionalEnterprise; external costs | ConditionalWarp-managed inference | ConditionalEgress depends on backend | ConditionalLogs; integrity not documented | Not documented | ConditionalRetention; hold not documented | YesLocal via reachable endpoint | ConditionalMCP; A2A not documented |
Official sources checked 27, 29 and 30 October 2026.
What each column means.
Where it runs
- Any machine you own
- Agents run on hardware you choose: laptops, servers, VMs and GPU boxes.
- Linux, macOS and Windows
- The part that runs agents installs natively on all three.
- Self-hosted control plane
- You can run the whole control plane on your own servers.
- No inbound ports
- Machines that run agents only dial out, so nothing has to be opened to them.
- Fleet operations
- Join, label, route work to, block and upgrade the machines that run agents.
Durability
- Durable runs
- A crash or a restart continues a run from its last finished step.
- ConditionalOrchestrator Zero: Depends on agent type
Governance
- Tool policy outside the model
- Rules an admin sets decide whether each tool call runs, waits for a person or is refused, and the platform enforces them.
- ConditionalOrchestrator Zero: Harness coverage varies
- Approvals in chat
- A risky call waits durably for a person, who can answer it from a chat app.
- ConditionalOrchestrator Zero: Tested against stand-ins only
- Tool snapshots
- A tool that changes its description or schema is blocked until someone approves the change.
- Tenants built in
- Separate tenants or workspaces, each with its own access and data.
Cost
- Budgets that stop a run
- A spend limit in money that stops a run when it is reached.
Security
- Provider keys off the workers
- Model provider keys stay in a gateway, and the machines that run agent code never hold them.
- Sandbox with an egress allowlist
- Agent tools run isolated and reach only the network hosts you list.
- ConditionalOrchestrator Zero: Linux/macOS; Windows tier 0
Audit and compliance
- Tamper-evident audit trail
- A record of what agents did that is hash-chained or signed, so an edit shows when it is checked.
- Erasure by key
- Per-person encryption keys can erase recorded payloads, with a documented way to keep erasures effective after backup restoration.
- Retention with legal hold
- Admins set how long run records are kept, and a legal hold stops their deletion.
- ConditionalOrchestrator Zero: Capture needs source data
Openness
- Model provider choice
- Compatible models from several vendors, including self-hosted services, through the same platform.
- MCP and A2A
- Agents use tools over MCP and work with other agents over A2A.
Where others are stronger.
- Hermes Agent
- Ruflo
- Windmill
- Temporal Agent Harness
- Hatchet
- Dapr Agents
- AgentField
- OpenClaw
- kagent
- LangSmith Deployment
- CrewAI
- Dify
- n8n
- IBM watsonx Orchestrate
- UiPath
- Camunda
- Microsoft Copilot Studio
- Guild.ai
- Amazon Bedrock AgentCore
- Microsoft Foundry Agent Service
- Google Gemini Enterprise Agent Platform
- Warp
What Orchestrator Zero does not do yet
- No hosted service.
- No independent security audit, ISO certification or SOC 2 report yet.
- No drag-and-drop canvas, and a small set of verified plugins.
How we rated.
Our vendor comparison.
- Docs, pricing and repositories reviewed 27, 29 and 30 October 2026. No hands-on benchmark. Some IBM sources were search-indexed copies.
- Undocumented does not mean absent. Send sourced corrections to hello@oz0.ai .
- The same criteria apply to oz0. Configuration is expected; coverage gaps lower ratings. Roadmap work is excluded.