Ecosystem report · 43 tracked · data as of Sep 19, 2026
State of the ecosystem.
What moved across every tracked OpenClaw alternative, how the architecture cohorts actually compare, and where the security and deployment posture sits. Numbers are computed from the same data the profiles use — no figure on this page is written by a model.
Tracked
43
projects in every table below
New stars
4,336
across 7 days
Flat
13
gained nothing in the window
Hardened
5
security ≥ 85 and shell risk ≤ 4
The short version
Five things worth knowing before you open the index. Everything below expands on them with the full tables.
- 01Hermes Agent led absolute gains with +2592 stars; Ouroboros grew fastest at +2.4%.
- 02Compiled runtimes average a security score of 76 versus 64 for scripting runtimes.
- 0337 projects are local-first and only 4 require cloud; 10 have unknown licenses.
What moved
Star movement, Sep 12, 2026 → Sep 19, 2026.
Measured from the daily star history for 43 of 43 tracked projects. Absolute growth favours the large repos, so the relative column is listed beside it.
Most stars added
13 of 43 projects gained nothing over the window.
Architecture
Three cohorts, assigned by rule.
Rules are applied in order and the first match wins, so all 43 projects land in exactly one cohort and none can appear twice. Medians are computed per cohort.
Single-binary runtimes small enough for a tiny VPS, an ARM board, or an always-on background process.
Rule: Memory ≤ 20 MB and boot ≤ 50 ms
- Mem
- 11.5 MB
- Boot
- 27.5 ms
- Sec
- 75
+ 17 more in this cohort
Heavier runtimes that carry shared workspaces, tenant separation, or channel fan-out for a group.
Rule: Multi-user declared, above the edge footprint
- Mem
- 90 MB
- Boot
- 220 ms
- Sec
- 62
+ 8 more in this cohort
Single-operator assistants that keep the reference feature surface and pay for it in memory and boot time.
Rule: Everything else
- Mem
- 85 MB
- Boot
- 215 ms
- Sec
- 62
+ 3 more in this cohort
Security
The runtime split, in real numbers.
Averages and medians over the five security sub-scores every profile carries. Sandboxing and telemetry safety are protection axes where higher is better; shell risk runs the other way. How the axes are scored.
AI readingThe runtime split is the clearest security signal in the data. The 20 compiled-runtime projects average a security score of 76, with median sandboxing at 7 and shell risk at 5.5. The 23 scripting-runtime projects average 64, with sandboxing at 5 and shell risk at 7. Across all 43 projects only 5 count as hardened while 10 run unsupervised shells. The practical cost: choosing a scripting-runtime agent means you are more likely to need your own sandboxing layer, while compiled options more often ship containment built in. Check the shell-risk flag before deploying anything with tool access.
| Cohort | Projects | Avg security | Sandboxing | Shell risk | Telemetry |
|---|---|---|---|---|---|
| Compiled runtimesRust, Go, Zig, C, C++, Kotlin | 20 | 76 | 7 / 10 | 5.5 / 10 | 8 / 10 |
| Scripting runtimesPython, TypeScript, JavaScript and friends | 23 | 64 | 5 / 10 | 7 / 10 | 6 / 10 |
Median score
72 / 100
Across all 43 tracked projects
Hardened
5
Security ≥ 85 with shell risk ≤ 4
Open shell
10
Shell risk ≥ 8, largely unsupervised execution
Posture
Where the data actually runs, and under what licence.
AI readingThe ecosystem leans strongly local: 37 of 43 projects are local-first, 38 treat cloud as optional, and only 4 require it, so self-hosting is the norm rather than the exception. 19 projects declare multi-user support, which matters if you need shared deployments. Licensing is mostly permissive, with MIT covering 20 projects and Apache-2.0 another 10, but 2 use AGPL-3.0 and 1 uses GPL-3.0, which can constrain commercial or SaaS use. Notably 10 projects have unknown licenses, and shipping against an unlicensed dependency is a real legal risk worth checking before adoption.
Local-first
37 / 43
Cloud required
4 / 43
Cloud optional
38 / 43
Multi-user
19 / 43
Licences
- MIT20
- Apache-2.010
- AGPL-3.02
- GPL-3.01
- Not published10
Runtimes by median footprint
20 projects run on a compiled runtime and 23 on a scripting runtime — the split that drives most of the footprint and containment difference above.
Next
The report shows the shape. The index gets you to a shortlist.
Every project named above links to its profile. Sort the full index by what you care about, then send two candidates into a side-by-side comparison.