Seven Hands put scheduled agent work behind one daemon
OpenFang runs agents from a Rust daemon with a browser dashboard, CLI, and OpenAI-compatible API. Its seven bundled Hands cover video clipping, prospect research, monitoring, forecasting, research reports, social posting, and browser tasks. Each Hand combines a manifest, operating instructions, a skill file, settings, and guardrails.
The same repository includes model routing, SQLite-backed memory, tools, schedules, channels, a desktop app, MCP support, and migration from OpenClaw. Our checkout measured about 210,880 source lines across 533 files. An upgrade can touch credentials, message intake, browser actions, spending, long-lived memory, and unattended timers in one system.
The 134-second install led to a 729-second build
In our unprivileged container, dependency installation succeeded in 134 seconds and pulled 843 packages. Building the Rust workspace took another 729 seconds. That is over 14 minutes before tests, on the stated 3-CPU, 12 GB lab machine.
The runtime still needs somewhere to send model requests. openfang init guides provider setup, and the sample environment file supports hosted keys plus local Ollama, vLLM, or LM Studio addresses. Optional Telegram, Discord, Slack, email, Signal, Matrix, and WhatsApp connections introduce their own tokens or service details. Docker Compose exposes the service and stores data in a named volume, but its comment says the registry image is not public and builds locally instead.
What happened when we ran it
Our build of commit acf2587 completed in 729 seconds. Cargo tests then ran for 600 seconds and reported 5,398 passed with 0 failures out of 5,398. Installation had already succeeded in 134 seconds with 843 packages. This is strong evidence that the checked-out Rust code compiled and its available cargo suite passed in our fresh container.
The lab did not measure agent answer quality, schedule accuracy, browser completion, channel delivery, model latency, idle memory, or the comparative figures printed in the README. It also found two CI workflow files, a Dockerfile, a Compose file, and no separate tests directory. Rust tests can live beside source, as the 5,398 passing cases demonstrate. The result supports a serious trial; it is not a benchmark for an autonomous production workload.
Forty channels create a large credential boundary
The README lists 40 messaging adapters, ranging from Telegram and Slack to email, WhatsApp, Matrix, and workplace chat products. Per-channel policies and model choices are useful when one agent must meet users where they already work. Every connected account also expands the effect of a mistaken tool call or hostile inbound message. Start with one channel, one low-privilege identity, and no schedule while you inspect logs and approval behavior.
WhatsApp deserves special caution. Its documented Web gateway is a separate Node.js process on port 3009 with login, status, send-message, and health routes. Open issue 1234 reports that these routes have no authentication and return wildcard CORS headers, allowing a malicious webpage to target the loopback service. The report remains open. Production users can choose the WhatsApp Cloud API, but that is a different integration with its own Meta account and token requirements.
Sixteen named security controls leave open enforcement questions
OpenFang documents 16 security systems, including capability checks, secret clearing, request filtering, a hash-chained audit log, and a metered WASM sandbox. The list is specific enough to audit. Issue 1242 does exactly that: it reports that the configured WASM max_memory_bytes value is carried into a reserved field but never attached to Wasmtime through a store limiter. If correct, CPU metering would not enforce the advertised memory ceiling.
A September 12 pull request addresses another boundary in the audit chain. It says deleting entries from the end can leave surviving links valid, so verification misses the truncation. The proposed fix stores the expected tip separately. That contribution had not merged when fetched. Passing 5,398 tests still matters, but an autonomous agent host should test the exact threat controls it depends on instead of translating suite size into blanket security assurance.
v0.6.9 has open reports about unattended model costs
Issue 1206 says v0.6.9 auto-spawned bundled sample agents whose existing schedules then began making model calls without user interaction. Issue 1252 separately reports that a configured heartbeat timeout was ignored in favor of 60 seconds, leading one deployment into repeated recovery calls. These are reports from particular setups, not our lab results, but both concern unattended activity and remain relevant until reproduced or closed.
Review every agent file before the first daemon restart, disable schedules you did not choose, and set provider-side spending alerts. OpenFang includes cost tracking and budgets, yet external account limits are the safer backstop when behavior itself is under review. Browser purchases have an approval gate according to the README. Social posting and arbitrary tool access deserve the same explicit operator check, regardless of the bundled Hand's default wording.
July's last push and September PRs split the health signal
GitHub recorded 18,183 stars and 120 combined issues and pull requests when fetched, of which 45 were open pull requests. The main repository's last push was July 2, 2026, and v0.6.9 was released May 12. Community work continued later, including a September 12 audit-chain pull request and a September 5 skill-installer report. Open issue 1275 asks for project status and a v1.0 outlook, with no maintainer response in its thread.
That record does not prove abandonment, but it weakens the case for adopting OpenFang without an ownership plan. LibreFang is a current community fork from the same codebase. OpenClaw emphasizes an assistant across chats and devices, while ZeroClaw offers another Rust runtime with supervised defaults. OpenFang itself merits a contained evaluation because our long build finished and all 5,398 tests passed. Production adoption needs a named maintainer on your side, a pinned commit, and verified fixes for the controls your agents rely on.