# lodos vs OpenClaw Source: https://lodos.md/en/compare/openclaw Language: en One gives an agent your machine. The other gives it your company. --- OpenClaw answers the question “what can my agent do?” with: anything, on this computer. lodos answers a different one. Its agent works out of a wiki that maintains itself and answers with citations, a graph it walks to build context across pages, a board with real state, workflows it drafts and then runs at eight in the morning, and a vault it can spend a production key from without ever reading the value. That last clause is why the rest is possible: you can only hand an agent your runbooks, your customers and your keys if it structurally cannot leak them. Two of the four questions above go to OpenClaw, and honestly so, since there is no vendor server anywhere in its picture. The row that decides this comparison is the third one. ## A very fast intern, on their first day, every day Give an agent a shell and it can do anything. Ask it why you chose Postgres over DynamoDB in March, or what the refund procedure is when the charge is over ninety days old, and it has no idea, because nothing in the product is holding that. So you paste. Every session starts with you rebuilding the context that was already in your head, and ends with the agent forgetting it again. The bottleneck was never capability. It was that the thing with all the capability knows nothing about you. lodos is built the other way round: first a company the agent can read, then an agent narrow enough that handing it the whole company is a reasonable thing to do. ## What OpenClaw does better than lodos The other project is enormous, moving faster than we are, and right about a great deal. Some of what follows we will never match. - Scale nothing else in this space is close to: 385,026 stars, MIT, a 501(c)(3) foundation, twenty-five messaging channels, thousands of community skills, and releases most weeks. lodos is not open source and has none of that gravity. - It does things lodos structurally never will: run any command you name, drive a browser, install its own skills, and pair other machines to execute on. If you want an agent with your whole computer, that is the product, not a compromise. - Any model provider, including fully local ones, so it can run with no network at all. lodos runs on Claude and needs your own account for the AI to work. ## What lodos gives the agent to work with None of this exists in an agent runtime, and not because nobody thought of it. A company brain is only safe to build once the agent reading it cannot leak it, which is the last pillar and the reason for the first six. ### A wiki that answers, and does not rot Ask a question and get a written answer with [[wikilink]] citations rather than a list of hits. Everything imported, a PDF, a contract, a spreadsheet, is written once to a raw layer and hash-checked at the database level, so every claim traces back to where it came from. Then the part nobody builds: a nightly pass runs five checks in plain SQL at no AI cost, finding orphaned pages, dead links, claims older than ninety days, unanswered TODO markers and pages nobody filed. Search folds Turkish and English alike, tolerates transposed letters, and takes its synonyms from a page you write rather than a list we hardcoded, because your wiki might be in German while you type in English. The company does not quietly go out of date while you are busy. ### A graph the agent walks One resolver serves the renderer, the linter and the AI, so the map the agent uses is the same map you see. It traverses slugs, titles and edges to assemble context across several pages, and never the page bodies, which is what makes multi-hop reasoning about your company affordable and safe at the same time. You get both views: local, around whatever you are reading, and global, filtered by type, confidence or orphanhood. Every page carries who last touched it and when, line-level attribution, a version rail and a diff. Pages are typed, so a question about a decision and a question about last Tuesday retrieve differently. ### A board with real state, that the agent can move Kanban with a state machine that refuses illegal transitions, not a list of strings. Hand the agent an epic and it proposes the decomposition as a dependency graph, cycle-checked, with readiness computed deterministically rather than guessed by a model, and you approve the whole batch in one diff. Repeated work becomes a template with parameters, each run producing a work item that stops at review before it can be called done. Dependencies unblock downstream tasks and tell you. Tasks link to the wiki pages that explain them, and those pages show which tasks are still open against them. ### Work that happens while you are asleep When a job starts repeating it becomes a declarative workflow with twenty-three step types, and the agent authors it through constrained mutations while the host assembles the definition, so a prompt cannot smuggle a step past you. Triggers are cron, interval, calendar rules, one-shot, database changes, inbound webhooks or a poll against your mailbox. Sixteen ready blueprints cover the ones every founder ends up writing: the morning brief, the weekly review, the renewal warning, the stale pull request, the runway number. And you can ask for a dashboard card in a sentence, without writing SQL or YAML, then watch it fill in tomorrow at eight. ### A team layer that never hands the server a key The part with the most engineering behind it, and the part OpenClaw explicitly does not try to be: its own policy says it “is not designed as a shared multi-tenant boundary between adversarial users on one gateway.” Here every member holds their own sealed copy of a section key, the coordinating server relays addressed envelopes it cannot open, and invites are confirmed out of band with a safety number so a coordinator in the middle is detectable rather than trusted. A member without a grant never receives the ciphertext at all. Remove someone and the key rotates, the content is re-encrypted, and everyone remaining moves to a new epoch. Every action lands in a signed, hash-linked record with a Merkle root you can anchor to an external timestamp, and it records whether a human or an agent did it. ### It remembers, and it remembers correctly Long-term memory is an encrypted store, add-only, where a later fact supersedes an earlier one instead of overwriting it, and a correction outweighs a repetition. Facts carry a confidence and the date they were last seen, and they arrive as a frozen block at the start of a session so the assistant knows your business before you have finished the sentence. Then the part that matters: a turn that touched untrusted content, a web page, an inbound message, a document, cannot write to memory at all. A poisoned page can waste one answer. It cannot become a permanent belief about your company. ### And the reason all of that is safe to hand over A credential is encrypted on your device before it touches the disk. The agent references it like a variable, and when a command genuinely needs the value it is decrypted in the desktop process, injected into an isolated subprocess whose environment was built from a whitelist, and stripped from everything that comes back. There is no shell tool, no filesystem tool, no browser tool, and nothing anywhere that returns a secret value; forty-one checks run on every build and fail the release if one appears. Network access is a default-deny allowlist, and the agent can propose a host but never add one. This is not the pitch. It is the reason the six pillars above are a product rather than a liability. ### Every machine you own, and your phone Free with no account, and free stays free: vault, wiki, graph, tasks, workflows, twenty-four built-in skills, documents, charts and the agent. Nine dollars a month for the whole install, not per seat, buys an encrypted snapshot that brings a new machine up in minutes and keeps the rest in step, with our servers holding ciphertext and an integrity chain and never a key. The desktop runs on macOS, Windows and Linux, and the phone companion reads that same snapshot behind Face ID. ## Coming from OpenClaw 1. Bring the notes first, because they are the point. Aim lodos at the folder your markdown already lives in: pages, structure and links come across, and anything carrying a plaintext secret is flagged so it can move into the vault instead. 2. Bring the credentials. Point at a .env file or paste the block straight in, and each key becomes an encrypted field rather than a line any process running as you can read. 3. Then rebuild the recurring jobs. What was a script the agent could run becomes a declarative workflow it drafts and you approve, calling your own APIs with the credential injected only at the moment of use. Keep OpenClaw for what it is good at. The two are not really competing for the same slot: one wants your whole machine, the other wants to be the place your company remembers itself. ## What can it see? Both products are described with the same four answers. There is no kinder phrase available for the same behaviour, so neither column can be graded on a curve. | What can it see? | OpenClaw | lodos | | --- | --- | --- | | Where your data lives | On your device | On your device, sync optional | | What the vendor can read | There is no server | Only ciphertext it cannot open | | What its AI can read | Your whole workspace | Structure, never a secret value | | Who holds the key | No key involved | You | | Starts at | $0 per member, per month | $0 | Read from the vendor on 2026-08-03: https://github.com/openclaw/openclaw/blob/main/LICENSE ## Is OpenClaw safe? It is as safe as its documented model says, and that model is stated more plainly than most commercial products manage. Their policy says outright that the project “is local-first agent infrastructure for trusted operators; it is not designed as a shared multi-tenant boundary,” that exec approvals “are operator guardrails to reduce accidental command execution, not a multi-tenant authorization boundary,” and that prompt-injection-only findings are formally out of scope as a vulnerability class. They ship a sandbox with four backends, run static analysis in CI, have security maintainers from NVIDIA and Tencent, and published twenty-nine advisories in a single batch in June 2026. This is not a careless project. Which is why this page is mostly not about security. The security model decides what you are willing to put in front of the agent, and that decides what the agent can be. OpenClaw’s answer means you show it a machine: the shell, the files, the browser session. Ours means you show it a company: the runbooks, the decisions, the board, the numbers, the keys it can spend but not read. Both are coherent. Only one of them ends with an assistant that knows why you chose Postgres in March. ## How the agent spends a key it cannot read This is the mechanism the whole company brain rests on, so it is worth being concrete about the order in which things happen. 1. Your runbook references the credential like a variable: `{{secrets.stripe.sk_live}}`. The reference is what gets stored, and it is all the model ever sees. 2. Before anything is decrypted, three things are checked: the entry point against a denylist that refuses every shell, interpreter and generic HTTP client, the host list you declared, and whether that field allows this tool at all. The vault has not been opened at this point. 3. Only then is the value decrypted, injected into an isolated subprocess whose environment was built from a whitelist rather than inherited from yours, and stripped out of everything that comes back, base64 and hex forms included. To be exact, since precision is the point: lodos does spawn processes. That one command runner does, and so does a curated external connector when you enable it. What it does not have is a shell tool an agent can reach for, and no setting turns one on. ## Three questions, both ways Same founder, same week, same three things you actually ask. ### Why did we choose this architecture? - **OpenClaw:** It does not know. You paste the context again, or it reads around your disk and infers something plausible from whatever files it happened to open. - **lodos:** It answers from the index with [[wikilink]] citations, and last night’s pass has already marked which of those pages went stale ninety days ago. ### Run the refund for this customer - **OpenClaw:** You describe the whole procedure again, then watch it work with the key sitting in your environment where anything running as you can read it. - **lodos:** The refund runbook is one of twenty-four skills in the box. The agent follows it, spends the key in an isolated subprocess without ever seeing the value, writes the outcome to the wiki and closes the task. ### What actually happened last week? - **OpenClaw:** Whatever is still in this conversation. Start a new session and the week is gone. - **lodos:** The board moved and the transitions are recorded, the workflows ran and their output is pinned to the dashboard, and the journal pages are typed and dated, so a question about time resolves like a question about time. ## So what should you actually do? - Stay with OpenClaw if what you want is an agent with your whole machine. That is a real thing to want, it is what the project is for, and lodos will never be it. - Take lodos if what you want is an agent that knows your company: the runbooks, the decisions, the board, the numbers, and the keys it can spend but not read. - Or run both, on different machines. They overlap less than the category name suggests: one is infrastructure you operate, the other is where your company keeps what it cannot lose. ## Questions people actually ask ### What is the best OpenClaw alternative? It depends what you liked about it. If you wanted an open, self-hosted agent that can do anything on your machine, nothing else is close and you should stay. If what you actually wanted was an assistant that knows your company, lodos is a different category: a wiki, a graph, a board, workflows and a vault, with an agent that works out of all of them. Narrower agent, far more context. ### Can OpenClaw remember my company? Not in the way you probably mean. It has skills, channels and files, and a very capable agent on top. What it does not have is a knowledge layer: no wiki that answers with citations, no graph to walk, no linter keeping claims from going stale, no board with state, no typed pages so a question about last month retrieves differently from a question about a decision. Context comes from the current conversation and whatever files it reads that minute. That is not a gap in the implementation, it is what an agent runtime is. ### Can OpenClaw read my API keys? Yes, and it is not hiding that. Its documentation says plaintext config still works and that references to a secret manager are opt-in per credential, and it warns that redaction is not a process-isolation boundary. Tools run on the host for the main session unless you enable sandboxing, and plugins load in-process with the same OS privileges as the gateway. For a single trusted operator on their own machine that is a reasonable design. It is simply a different one from a vault, and it is why the company brain has to live somewhere else. ### Does lodos run shell commands? There is no shell tool, and a build check fails the release if one is ever registered. There is exactly one command runner, used to spend a credential without revealing it, and it refuses every shell, interpreter and generic HTTP client as an entry point before it decrypts anything. Enabling a curated external connector also starts a local process. So lodos does spawn processes; what it does not have is a general-purpose shell an agent can reach for. ### What can OpenClaw do that lodos cannot? Run arbitrary commands, browse your filesystem, control a browser, install its own skills and plugins, pair other machines and execute on them, use any model provider including local ones, and connect to twenty-five messaging platforms. It also has a plugin ecosystem lodos deliberately does not: here an extension is a skill, a skill is instructions rather than code, and external tools come from a small catalog decided in a pull request. You lose thousands of community skills and gain an extension system with nothing to audit, because there is nothing that runs. ### Is lodos open source? No, and against an MIT project with a foundation behind it that is a real difference worth weighing. What lodos offers instead is a free app that runs with no account and no network, and guarantees enforced by checks that break the build rather than by policy documents. Those are not the same thing as source you can read, and we are not going to pretend they are. ### Is lodos free? The app is free with no account: vault, wiki, graph, tasks, workflows, twenty-four built-in skills, documents, charts and the built-in agent. The only paid part is encrypted cloud backup at nine dollars a month for the whole install, not per seat. The AI runs on your own Claude account, so we are not reselling you tokens. ## The rows that actually differ Not a feature checklist. OpenClaw is agent infrastructure and lodos is a company OS, so counting each other’s features would tell you nothing. These are the five places where both make a decision about the same problem and decide differently. Everything in the OpenClaw column comes from its own documentation, read on 3 August 2026. | | OpenClaw | lodos | | --- | --- | --- | | What the agent knows tomorrow | The current conversation, plus whatever files it reads that minute. | A wiki it answers from with citations, a graph it walks, and memory that outlives the session. | | Keeping that knowledge true | No knowledge layer to maintain; context is assembled per session from files and chat. | A nightly pass in plain SQL: orphans, dead links, claims older than ninety days, unfiled pages. | | Work that has state | Skills and channels. Tasks are whatever you keep in another tool. | A kanban board with a real state machine, agent-proposed decomposition and a review gate before done. | | Work that happens without you | Cron jobs running commands, with the agent able to write itself another one. | Declarative workflows the agent drafts and you approve, with results pinned to a dashboard. | | Shell access for the agent | On the host for the main session. A sandbox with four backends exists and defaults to off. | No shell tool exists. A check on every build fails the release if one is registered. | If this page describes OpenClaw incorrectly, that is a bug. Tell us and we will fix it.