How the system works

Every profile carries five 1-10 sub-scores under Security breakdown. Four measure protection, so higher is safer. The fifth measures risk, so higher is worse.

• Sandboxing — isolation from the host OS. 10 is fully virtualised or containerised; 1 is direct local execution.
• API security — how external integrations are handled. 10 is scoped, encrypted and multi-user safe; 1 is plaintext keys.
• Network isolation — outbound traffic control. 10 is air-gapped or strictly whitelisted; 1 is unrestricted internet access.
• Telemetry safety — what the tool reports back. 10 is no telemetry; 1 is extensive logging to external servers.
• Shell access risk (higher is riskier) — 10 is raw unmonitored shell access; 1 is no unsupervised execution.

The 0-100 security score shown on profiles and compare pages is separate: it weighs these axes together with the wider evidence we hold.

Measured: GitHub metadata, releases, stars, commit history, language and runtime clues — anything directly observable. AI-written: clone summaries, "why choose this over OpenClaw" blocks, compare verdicts, tradeoffs and confidence notes, generated from that evidence. Community: Reddit and public search coverage, used as supporting evidence. The ecosystem report keeps the same split — its tables are computed, its commentary is labelled.

How strong the backing evidence looks behind an AI-heavy claim. High usually means multiple direct signals agree. Low often means the repo is young, the docs are thin, or sources conflict. Read low-confidence content as a directional nudge, not a verdict.

Because unknown is more honest than filler. If a project does not clearly publish something like deployment posture or privacy behaviour, we show unknown or mixed rather than polished speculation.

Targets: repo data nightly, clone profiles reviewed weekly, compare verdicts checked more aggressively, methodology pages monthly. These are targets, not guarantees — the About page shows the dates that actually landed, so you can check the gap yourself.

Security incidents, major releases, architecture changes, momentum spikes, confidence drops, or a meaningful change in OpenClaw itself. Credible community reports of a factual miss also send a profile back for review.

GitHub for repository facts, Reddit for community discussion, and public search and news coverage for wider signals. They are complementary evidence, not a replacement for reading the repo.

The verdict is a shortcut; the metrics are the evidence. If the two disagree, the evidence wins.

Yes. For a missing project use the Add clone button in the header; for a wrong or stale figure open a correction issue. Both land as public GitHub issues, and a link to the source beats a description. We would rather queue a review than leave a misleading claim live.