Ecosystem report · 43 tracked · data as of Aug 5, 2026
State of the ecosystem.
What moved across every tracked OpenClaw alternative, how the architecture cohorts actually compare, and where the security and deployment posture sits. Numbers are computed from the same data the profiles use — no figure on this page is written by a model.
Tracked
43
projects in every table below
New stars
0
across 7 days
Flat
0
gained nothing in the window
Hardened
12
security ≥ 85 and shell risk ≤ 4
The short version
Five things worth knowing before you open the index. Everything below expands on them with the full tables.
- 01QwenPaw added 4,669 stars this week, the largest absolute gain across all 43 tracked projects.
- 02Ouroboros grew 21.1% week-over-week, the fastest relative mover in the ecosystem.
- 0314 projects were flat or declining, signaling that attention is concentrating among fewer names.
- 04Edge & minimalist runtimes now account for 20 projects with a median boot time of just 22.5 ms.
- 0534 projects are local-first, and 30 support cloud-optional operation, giving teams real deployment choice.
What moved
Star movement, Jul 29, 2026 → Aug 5, 2026.
Measured from the daily star history for 0 of 43 tracked projects. Absolute growth favours the large repos, so the relative column is listed beside it.
AI readingStar movement this week was dominated by a handful of projects pulling far ahead. QwenPaw and Hermes Agent together accounted for more than 8,000 new stars, while the median project saw far smaller gains. Fourteen projects were flat or declining, which suggests that developer attention is consolidating around a narrower set of tools. For someone choosing a framework today, the widening gap between the fastest-growing projects and the rest means community momentum and ecosystem support are increasingly uneven across the landscape.
No star history is available for this window, so no movement is reported rather than showing an empty table.
Architecture
Three cohorts, assigned by rule.
Rules are applied in order and the first match wins, so all 43 projects land in exactly one cohort and none can appear twice. Medians are computed per cohort.
Single-binary runtimes small enough for a tiny VPS, an ARM board, or an always-on background process.
Rule: Memory ≤ 20 MB and boot ≤ 50 ms
- Mem
- 10.5 MB
- Boot
- 22.5 ms
- Sec
- 85
+ 15 more in this cohort
Heavier runtimes that carry shared workspaces, tenant separation, or channel fan-out for a group.
Rule: Multi-user declared, above the edge footprint
- Mem
- 80 MB
- Boot
- 200 ms
- Sec
- 65
+ 4 more in this cohort
Single-operator assistants that keep the reference feature surface and pay for it in memory and boot time.
Rule: Everything else
- Mem
- 80 MB
- Boot
- 150 ms
- Sec
- 67.5
+ 9 more in this cohort
Security
The runtime split, in real numbers.
Averages and medians over the five security sub-scores every profile carries. Sandboxing and telemetry safety are protection axes where higher is better; shell risk runs the other way. How the axes are scored.
AI readingThe security picture splits cleanly along runtime lines. Compiled runtimes, 19 projects, average a security score of 79 with stronger sandboxing and lower shell risk. Scripting runtimes, 24 projects, average 68 with weaker sandboxing and higher shell risk. Eight projects still allow unsupervised shell access, which is a concrete operational risk for anyone running agent code in production. The practical cost of choosing a scripting runtime is not just a lower score but a measurably wider attack surface that teams must compensate for with external controls.
| Cohort | Projects | Avg security | Sandboxing | Shell risk | Telemetry |
|---|---|---|---|---|---|
| Compiled runtimesRust, Go, Zig, C, C++, Kotlin | 19 | 79 | 7 / 10 | 4 / 10 | 8 / 10 |
| Scripting runtimesPython, TypeScript, JavaScript and friends | 24 | 67 | 5.5 / 10 | 7 / 10 | 7 / 10 |
Median score
75 / 100
Across all 43 tracked projects
Hardened
12
Security ≥ 85 with shell risk ≤ 4
Open shell
9
Shell risk ≥ 8, largely unsupervised execution
Posture
Where the data actually runs, and under what licence.
AI readingLocal-first operation is the norm, with 34 of 43 projects supporting it, and 30 projects offer cloud-optional deployment. Only 10 projects require a cloud connection, which means most tools in this space respect data locality and offline capability. Licensing is heavily permissive: MIT leads with 20 projects, Apache-2.0 covers another 10, and copyleft licenses like AGPL-3.0 and GPL-3.0 appear in just 3 projects combined. Ten projects have unknown licenses, which is a due-diligence gap worth closing before integration.
Local-first
34 / 43
Cloud required
10 / 43
Cloud optional
30 / 43
Multi-user
14 / 43
Licences
- MIT20
- Apache-2.010
- AGPL-3.02
- GPL-3.01
- Not published10
Runtimes by median footprint
19 projects run on a compiled runtime and 24 on a scripting runtime — the split that drives most of the footprint and containment difference above.
Next
The report shows the shape. The index gets you to a shortlist.
Every project named above links to its profile. Sort the full index by what you care about, then send two candidates into a side-by-side comparison.