TrustClaw
by Composio
Self-hostable personal AI agent with OAuth-only credentials and sandboxed execution
TrustClaw is an MIT-licensed, self-hostable personal AI agent from Composio that runs continuously against more than 1,000 OAuth-connected tools. It deploys to Vercel in minutes, keeps long-term memory in Postgres with pgvector, and never handles passwords or API keys — every integration is brokered through delegated OAuth in a remote sandbox.
TrustClaw is an open-source, self-hostable personal AI agent published by Composio, the developer platform that supplies its tool layer. It describes itself as 'Your AI that does things while you sleep. Securely.' and was, in the maintainers' words, 'rebuilt from scratch for security' after OpenClaw — a security-focused redesign rather than a fork. The application is a Next.js 15 and React 19 front end over a tRPC backend that runs the agent loop, with Better Auth for authentication, Prisma against Postgres with pgvector for long-term vector memory, optional Redis for resumable streams, the Vercel AI Gateway for model and embedding calls, and the Composio SDK brokering more than 1,000 OAuth integrations including Gmail, GitHub, Notion, Linear, Jira, Slack, Google Drive, Google Calendar, Asana, Trello, Stripe, HubSpot and Airtable. Its security design is the point: connections are OAuth-only so no passwords or API keys are stored, tool execution happens in a remote sandbox rather than on the user's machine, and the system keeps full audit trails plus rate limiting and per-user caps for cost control. A three-layer context management scheme allows conversations of indefinite length, and cron-scheduled runs let the agent act proactively rather than only on request. Users interact through a web chat dashboard or a Telegram bot, with WhatsApp, Discord and Slack listed as coming. Typical published workflows include triaging and categorising email, drafting replies, logging customer feedback into Notion, summarising Slack threads, pulling completed tickets from Linear and generating release notes. Deployment is a one-click Vercel template or `npx @composio/trustclaw deploy`. The repository is MIT-licensed with roughly 874 stars, 204 forks and 47 commits on main.
Founders, operators and technical individuals who want an always-on personal agent across their SaaS stack but refuse to hand an agent passwords, API keys or access to their local machine.
A continuously running assistant across 1,000-plus apps where every connection is delegated OAuth in a remote sandbox, so revoking access is a single toggle and no credential is ever stored.
At a Glance
- Category
- AI Agents & Orchestration
- Pricing
- Free, Usage-based
- Target Market
- Startup Founders, Technical Operators, Enterprise Developers, Engineering Managers
- Deployment
- Open-source, Self-hosted, Cloud-first
- Headquarters
- United States
Key Features
- ✓OAuth-only credential handling
Every integration connects through delegated OAuth, so no passwords or API keys are stored and access can be revoked at the provider.
- ✓Remote sandboxed execution
Tool calls run in an isolated remote sandbox rather than on the user's machine, so a compromised prompt cannot reach local files.
- ✓1,000+ tool integrations via Composio
Gmail, GitHub, Notion, Linear, Jira, Slack, Drive, Calendar, Asana, Trello, Stripe, HubSpot and Airtable are available without per-tool integration work.
- ✓Persistent vector memory
Postgres with pgvector stores long-term memory so the agent carries context across sessions instead of restarting cold each time.
- ✓Cron-scheduled autonomous runs
The agent acts on a schedule rather than only on request, which is what makes proactive triage and reminders possible at all.
- ✓Three-layer context management
A layered context scheme lets conversations run indefinitely without hitting the model's window or losing earlier decisions.
- ✓One-click Vercel deployment
Deploys via a template or `npx @composio/trustclaw deploy`, so a working self-hosted agent stands up in minutes rather than days.
- ✓Audit trails and spend caps
Full logs of agent actions plus rate limiting and per-user caps keep both the security review and the model bill bounded.
Capabilities
Use Cases
- •Autonomous inbox triage
The agent fetches and categorises email on a schedule, drafts replies and flags what genuinely needs a human decision.
- •Customer feedback capture into Notion
Incoming complaints and requests are summarised and logged into Notion automatically, so nothing is lost between channels.
- •Engineering release notes from Linear
The agent pulls completed tickets from Linear on a cadence and drafts release notes without an engineer assembling them manually.
- •Slack thread summarisation
Long channel discussions are condensed into digests, letting operators skip catching up on hundreds of overnight messages.
- •Secure agent reference architecture
Teams fork the MIT-licensed codebase to study OAuth brokering, sandboxed execution and layered context before building their own agent.
Ideal For
Best For
- ✓Running an always-on personal assistant across Gmail, Slack, Notion, Linear and other OAuth-connected SaaS tools
- ✓Teams that want agent automation without storing passwords or API keys anywhere in the stack
- ✓Scheduled, proactive tasks such as daily inbox triage, Slack digests or automatic release-note generation
- ✓Self-hosting an agent on infrastructure you control rather than adopting a hosted assistant SaaS
- ✓Developers who want a readable, MIT-licensed reference implementation of a secure agent architecture to fork
Not Ideal For
- ✗Anyone unwilling to depend on Composio, since every one of the 1,000-plus integrations is brokered through Composio's infrastructure and there is no alternative tool layer
- ✗Teams needing a vendor-supported product with an SLA — this is a community open-source project with no user reviews on Slashdot or SourceForge and no published support commitment
- ✗Users who want model choice, as an independent review notes selection is effectively restricted to Claude through the Vercel AI Gateway
- ✗Anyone running on Vercel's free tier for real work, where cron is limited to once daily and functions are capped at 300 seconds
- ✗Organisations that need on-machine or desktop operation, since there is no native desktop application and local self-hosting lacks official documentation
Integrations
Deployment
Market Analysis
Pros
- ✓Security is the design centre, not a feature: OAuth-only credentials, remote sandboxed execution, full audit trails and per-user spend caps
- ✓1,000-plus integrations available immediately through Composio, with no per-tool API key management
- ✓MIT-licensed and fully self-hostable, so the whole agent loop is auditable and forkable
- ✓Deploys in minutes via `npx @composio/trustclaw deploy` or a Vercel template, with Postgres/pgvector memory and cron already wired
- ✓Three-layer context management supports indefinitely long conversations rather than truncating history
Cons
- ✗Complete dependence on Composio's infrastructure — every integration routes through it, so an outage or pricing change there is unmitigable
- ✗Model choice is effectively restricted to Claude via the Vercel AI Gateway, per an independent review of the project
- ✗The free Vercel tier caps cron at once daily and functions at 300 seconds, which undercuts the always-on premise unless you pay for Pro
- ✗Local self-hosting outside Vercel lacks official documentation, and there is no native desktop application
- ✗No persistent personality or identity across sessions, which the same review flags as a gap versus dedicated assistant products
- ✗Immature and unvalidated: roughly 47 commits on main, 874 stars, and zero user reviews on Slashdot or SourceForge
- ✗The project has no product website — trustclaw.app returns a 404 — so GitHub is the only canonical home
Pricing
Open Source (MIT)
$0
- ✓Full source, MIT licence
- ✓Self-host anywhere
- ✓One-click Vercel deploy
- ✓Community support via GitHub
The software itself is free and MIT-licensed, but running it is not: an independent review notes users pay for Vercel deployment, Composio tool integrations and Claude API usage separately, each with its own free tier. The Vercel free tier is the binding constraint in practice — cron jobs are limited to once daily and functions time out at 300 seconds, so a genuinely always-on agent needs a Vercel Pro plan for per-minute scheduling and longer execution. Total cost is therefore model spend plus hosting, and is entirely usage-driven.
Security & Compliance
Connect
Sources
This page was written from 5 sources, 4 on domains other than github.com.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Sema4.ai
Enterprise AI agents for knowledge work, running natively in your Snowflake or cloud account
Sapiom
Agent infrastructure that routes, runs and meters AI agents in production
Itential FlowAI
Governed AI agents for network and infrastructure operations, with deterministic execution and full audit trails
OpenAI Presence
Deploy production-grade AI voice and chat agents with enterprise policies, guardrails and evals