Index / Carapace · updated Sep 3, 2026
Carapace
puremachinery/carapace · healthy · rank 39 of 43 by stars
A security-hardened Rust reimagining of OpenClaw built explicitly to counter its January 2026 vulnerability disclosures. It pairs multi-channel messaging and multi-provider LLM support with signed WASM plugins, OS-level sandboxing, and encrypted secret storage.
Facts
Repository
Runtime
Posture
Community
Security breakdown
Composite 92 / 100 · how these are scored
higher is safer
higher is safer
higher is safer
higher is safer
higher is riskier
Model access
Read from the repository, not written by a model · 46 files examined
5 providers · runs locally · custom endpoint
Pinned models
gpt-5.5 released 2026-04-24 — 4 months old (from the public model catalogue)
Pin last edited 4 months ago
Evidence
Decision
Why choose Carapace over OpenClaw?
Why choose this
- OS-level subprocess sandboxing with fail-closed behavior
- Ed25519-signed WASM plugins with capability limits
- OS credential store with AES-256-GCM fallback for secrets
Tradeoffs
- Far smaller community and star count (47 stars)
- No comparable third-party skill registry
- Younger project with some in-progress feature areas
Best fit
- Security-conscious users replacing OpenClaw
- Self-hosters wanting encrypted secrets and sandboxed tools
- Rust shops needing auditable, signed plugin runtimes
Avoid if
- You need a large existing plugin/skill ecosystem
- You want a mature community and lots of third-party guides
- You need features still marked partial in feature-status.yaml
README and commit evidence for the security architecture is strong and detailed, but community sentiment data is essentially absent — all Reddit matches are unrelated uses of the word 'carapace'. Confidence is high on technical claims, low on adoption signals.
AI layer reviewed Aug 24, 2026 · how this is written
Star activity
47 stars today
Overview
Carapace is a security-first, Rust-written personal AI assistant positioned as a hardened alternative to OpenClaw/clawdbot. It supports a broad set of LLM providers (Anthropic, OpenAI, Codex, Ollama, Gemini, Vertex AI, Bedrock, NEAR AI Cloud, Venice AI, local Claude CLI) and channels (Matrix, Signal, Telegram, Discord, Slack, webhooks, console), with streaming, cancellation, and provider-aware tool paths.
Its defining trait is a threat-model-driven architecture that directly answers the January 2026 OpenClaw security disclosures: localhost-only binding, CSRF-protected control endpoints, OS credential-store secret storage with AES-256-GCM fallback, Ed25519-signed WASM plugins running under capability sandboxes and resource limits, prompt-injection defenses (prompt guard, inbound classifier, exec approval flow), OS-level subprocess sandboxing that fails closed on unsupported paths, and SSRF/DNS-rebinding mitigations. Infrastructure extras include TLS/mTLS, mDNS discovery, Tailscale integration, Prometheus metrics, and audit logging.
Compared to OpenClaw, Carapace trades ecosystem breadth for assurance: it publishes verified-vs-partial feature status (docs/feature-status.yaml) and a threat-by-threat security comparison, and recent commits show disciplined maintenance (Dependabot cargo/GitHub Actions updates, CodeQL scanning, CI performance work). The project is young with a small community, so users should expect a thinner plugin ecosystem and fewer third-party resources than OpenClaw.