Overview
Cunning Claw is a local AI agent that runs on the user's own machine and operates that machine. It is described as "a practitioner you bring a job to · not a chatbot" and is designed to be installed locally, binding to 127.0.0.1 behind a self-minted token. The software is open source under the MIT license and can run cheaply on Gemini models or fully offline via Ollama, with nothing leaving the machine in the latter case.
The agent includes a threat model with multiple layers of defense. It fences all external input as data, gates any action that changes the machine behind human approval, maintains a code-level denylist of forbidden commands, and pins turns that can see hostile text to a capable model. The site states: "Everything read from the web, your inbox, or a connected server arrives as data, never orders — with the fence tokens stripped so a page can't close it and impersonate you." It also notes that "Anything that changes your machine — shell, file writes, sending, buying, deleting — stops and asks first." A plan-based approval system allows users to approve a sequence of steps once, but anything outside the plan still requires approval.
Cunning Claw provides a range of capabilities including screen reading, shell and file operations, browser automation, email reading and drafting, offline text-to-speech, markdown memory, and connections to 94 MCP connectors. It can build and deploy code, interact with WhatsApp Web, manage accounts via Xero, and control Home Assistant devices. The software runs on Linux, Windows, and macOS, with Linux being the most tested platform. It includes 10 brains, 70 tools, 94 connectors, 31 skills, and 396 tests, with only 2 dependencies.
Pricing
Free
Detailed plans have not been confirmed in our catalog. Check the official website for current limits and billing terms.
Visit WebsitePrices and limits may change. Confirm the currency, billing period, seat minimum and usage caps on the official website.
Use Cases
- Teams use Cunning Claw to build and preview websites locally, as shown in a demo where it builds a garage site and previews it in the glass.
- Users can have Cunning Claw read and summarize web pages while resisting prompt injection attempts.
- Teams use Cunning Claw to schedule recurring tasks like morning briefings and invoice checks via markdown-based standing orders.
- Users can ask Cunning Claw to draft letters, plans, or briefings that land in the Desk as markdown files on their own disk.
- Teams use Cunning Claw to operate their machine via shell, files, apps, windows, keystrokes, clipboard, volume, media, and notifications.
- Users can have Cunning Claw drive its own Chrome browser to open, read, click, fill, and submit web content.
- Teams use Cunning Claw to read Gmail inbox and search, and to draft and send emails with approval.
- Users can connect Cunning Claw to 94 MCP connectors including Canva, Lovable, v0, GitHub, Notion, Slack, Figma, and Stripe.
Features
Observe your computer screen
Run commands in your shell
Speak Welsh at dawn
Ask before consequential actions
Operate with a local-first approach
Reviews
No reviews yet. Be the first to share your experience!
FAQ
Does it phone home?
No. It binds to 127.0.0.1 behind a token it mints for itself. The only thing that leaves the machine is your prompt, to the brain you chose — and with Ollama, not even that. There is no account, no telemetry, and no Cunning Claw token, ever.
Is it a sandbox?
No, and it will not pretend to be. It runs real commands on your real machine. The approval cards are the boundary — read them. The floor above is what it refuses regardless.
What does a turn cost?
Whatever it cost, shown under the reactor to four decimal places. A quick answer on Flash-Lite is a fraction of a cent; a full website build a few cents. The guard moves hostile-text turns to a capable brain, and tells you when it does.
What if a web page tells it to do something?
Everything it reads from outside arrives fenced as data, and it has been attack-tested against exactly that. But it is defence in depth, not a guarantee — which is why the cards exist.
Can I read what it did?
Yes — every tool call is a chip in the transcript as it happens, every day is a journal entry on disk, and the Board shows the project's commits. It is versioned software; git log is its changelog.
What's the catch?
It's new. It has run on very few machines, and the fastest way to make it good is people finding what's wrong with it. Open an issue; it will be read.