QwenPaw: a self-hosted assistant that bundles local models, Markdown memory and chat bridges into one Python install

One process, many chat channels, and a console on port 8088

QwenPaw is a personal agent that you host yourself. The pyproject.toml description states the model plainly: it talks to you over channels such as DingTalk, Feishu, QQ, Discord and iMessage, runs scheduled tasks according to your configuration, and gets its abilities from Skills. Built-in skills cover cron, PDF and Office handling, news digests and file reading, and you can add your own. The project says all data and tasks run on your machine with no third-party hosting and no data upload.

The shortest path is the pip route:

pip install qwenpaw
qwenpaw init --defaults
qwenpaw app

After that, model configuration happens in the browser, at http://127.0.0.1:8088/. Channels are not wired up by these three commands; connecting DingTalk, Lark or WeChat is a separate step covered in the Channel setup page of the documentation site. Besides the web Console there is a TUI and a desktop app, and pywebview sits in the dependency list alongside the uvicorn server. The consequence for a first run: expect to finish setup in a browser, not in a config file, and expect a second round of work per chat platform.

The Python 3.11 to 3.13 window and the exact pins behind it

pyproject.toml sets requires-python to ">=3.11,<3.14". If your system Python is 3.10 or 3.14, pip will refuse the package, which is why the project also ships an installer that manages Python for you.

The dependency list is long and several entries are pinned exactly rather than given a floor. agentscope[model-ollama,classifier-jev] is pinned to 2.0.10, reme-ai to 0.4.2.0, and reme-auto-fin and reme-daily-paper to 0.1.3. Others carry upper bounds: websockets below 16, click below 9, apscheduler below 4, onnxruntime below 1.24, and agent-client-protocol between 0.9.0 and 0.11.0. On top of that the package pulls in playwright, transformers, modelscope, huggingface_hub, google-genai, mss for screen capture and several Alibaba Cloud SDKs.

What this means in practice: QwenPaw cannot share a virtual environment with another project that wants a different agentscope or a newer websockets. Install it into its own environment, and treat any attempt to import it as a library inside an existing agentscope application as a version conflict waiting to happen.

The install scripts trade control over Python for a network dependency

The second install option needs no Python setup. The script downloads uv, creates a virtual environment, and installs QwenPaw with all dependencies, including Node.js and the frontend assets.

macOS and Linux:

curl -fsSL https://qwenpaw.agentscope.io/install.sh | bash

Windows CMD:

curl -fsSL https://qwenpaw.agentscope.io/install.bat -o install.bat && install.bat

Windows PowerShell:

irm https://qwenpaw.agentscope.io/install.ps1 | iex

The project itself warns that this route may not work in restricted network environments or behind corporate firewalls. That is the cost of a script that fetches uv, Node.js and frontend assets at install time: every one of those downloads has to get through. Each command also pipes or runs a remote script directly, so anyone with a policy against executing unreviewed scripts should download install.sh or install.ps1 first and read it, or fall back to pip with a Python they already manage.

The Docker compose file binds to localhost and leaves authentication commented out

docker-compose.yml runs the agentscope/qwenpaw:latest image with restart: always and three named volumes: qwenpaw-data mounted at /app/working, qwenpaw-secrets at /app/working.secret, and qwenpaw-backups at /app/working.backups. The relevant part of the service looks like this:

    ports:
      - "127.0.0.1:8088:8088"
    # environment:
    #   - QWENPAW_AUTH_ENABLED=true
    #   - QWENPAW_AUTH_USERNAME=admin
    #   - QWENPAW_AUTH_PASSWORD=yourpassword

Two consequences follow. First, the port mapping only listens on 127.0.0.1, so the Console is not reachable from other machines until you change it, which is a safe default. Second, the authentication variables ship commented out. If you widen the port binding to reach the Console from a laptop or a server, uncomment QWENPAW_AUTH_ENABLED and set a real username and password first, because the sample values are placeholders. The latest tag also means a container recreated next week can be a different release; pin a version tag if you need repeatable deployments.

QwenPaw-Flash and the path that needs no API key

The project trains its own QwenPaw-Flash models for agent tasks, listed in sizes 2B, 4B, 9B, 35B-A3B and 27B, and ships a built-in QwenPaw Local runtime that needs no API key and no cloud dependency. The 9B, 27B and 35B-A3B variants arrived with v2.2.2 on 2026-10-15. If you already run models elsewhere, QwenPaw also works with Ollama, LM Studio, or more than 14 cloud providers; the agentscope extra model-ollama and the google-genai dependency both reflect that. Since v2.2.1, routing can be set per Agent, so one agent can use a local model while another uses a hosted one.

The limit for planning: the feature table gives model sizes but no memory or GPU figures beside them, so it does not tell you which size fits your hardware. Check the Local Models section of the documentation before downloading the larger variants, and keep a cloud provider configured as a fallback if your machine turns out to be too small.

Memory kept as Markdown through ReMe

QwenPaw describes three layers of memory: live working context, full verbatim history, and a self-evolving personal knowledge base built on ReMe, another agentscope-ai project. Conversations and resources are turned into Markdown memory that you can read, edit, search and link. reme-ai is pinned to 0.4.2.0, so the memory format and behaviour move with QwenPaw releases, not independently.

The practical upside of Markdown is that you can open what the assistant remembers in any editor and correct it. The downside is that the verbatim history layer keeps everything, so the working directory grows with use and holds whatever you have said to the assistant. In the Docker setup that data lives in the qwenpaw-data volume, with backups in qwenpaw-backups; back those up and protect them as you would any personal archive. Since v2.2.2, a tool called PawPort imports data from Codex and Qoder, which helps if you are moving from those agents.

Guards around tools, files and skills, and what they cannot promise

The security layer names five pieces: a kernel-level Sandbox, Tool Guard, File Guard, a Skill Scanner, and Access Policy. The project states that dangerous commands are blocked before they run. This matters because QwenPaw has broad reach: since v2.1.0 it includes an OS Shell, Browser-use and Computer-use, it can read, edit and test code through the unified Files workspace, and the plugin marketplace and MCP integration let third-party code add tools.

Those guards reduce risk but do not remove it. A skill or plugin from the marketplace still runs inside your environment, and a blocklist only catches what it recognises. Anyone exposing QwenPaw to a group chat should assume that whoever can message the bot can ask it to act with the permissions you granted. Keep Access Policy strict, review skills before installing them, and turn on the Console authentication described above. The repository carries a SECURITY.md at its root; read it before reporting a guard that failed to stop something.

A release train that moves faster than most deployments want

The release history is dense. v2.0.1 shipped on 2026-07-24 with the PawApp mini-app platform and Oh-My-Paw plugins, v2.1.0 on 2026-08-13 added workspace checkpoints and Codex and Qoder agent integration, v2.2.0 on 2026-09-03 brought a self-hosted multi-user QwenPaw Hub, QwenPaw Mail and QwenPaw Data, and v2.2.1 followed a week later. The most recent tags are v2.2.2.post1 on 2026-10-22, v2.3.0-beta.1 on 2026-10-27 and v2.3.0-beta.2 on 2026-11-02, the same day as the last push to main.

For contributors, the Makefile offers test-unit, test-contract, test-integration, test-channel and check-contracts targets, and a quick target that runs unit tests against a throwaway QWENPAW_WORKING_DIR so your real data is untouched. The Makefile header still reads CoPaw Test & Coverage Makefile. The consequence for operators is that features, data layout and plugin interfaces change on a roughly monthly cycle, so read the release notes before every upgrade and test against a copy of your working directory.

Editorial conclusion

QwenPaw suits someone who wants one self-hosted agent reachable from DingTalk, Lark, Telegram or Discord, with memory kept as editable Markdown and a choice between its own QwenPaw-Flash models and cloud providers. It is a poor fit for anyone who needs a slow, stable release line or must install into a shared Python environment, because agentscope and reme-ai are pinned to exact versions and the newest tags are betas. Before deploying, confirm your Python is between 3.11 and 3.13, decide whether to enable the commented-out auth variables, and pin a specific image or package version instead of latest.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes