Four interfaces share one Rust core and one trust boundary
OpenHuman's Rust core powers four interfaces: a Tauri desktop app, browser interface, terminal client, and openhuman-embed library. Around that core are model routing, persistent memory, MCP tools, browser actions, messaging channels, schedules, and visual workflows. The appeal is obvious: an agent can keep its context while you move between interfaces. The cost is also concentrated. One installation can touch models, files, connected accounts, and actions, so a trial needs tighter limits than an ordinary chat client.
The measured checkout makes that scope visible. commit a4b16c9 contained 6,778 files, about 1,401,395 lines of source, and occupied 87.6 MB before dependencies. It is a pnpm monorepo with 25 CI workflow files, a Dockerfile, a Compose file, and a tests directory. Our install added 1,314 packages and took the working environment to 903 MB. This is a substantial application even before local model weights or user data arrive.
What happened when we ran it
Our fresh Debian sandbox installed commit a4b16c9 in 72 seconds and built it in 66 seconds. The container had 3 CPUs, 8 GB of RAM, Node 22, no secrets, and no elevated privileges. Both commands succeeded, despite the current contributor guide calling for Node 24 or newer. That is useful evidence for repository mechanics. It does not prove that the desktop installer, OAuth connections, model routes, or native platform integrations work on a user's machine.
The test command did not finish within 900 seconds. Near the end, the log showed runStepSummary.test.ts passing 14 tests, useChatSurfaceRegistration.test.tsx passing 10, tauriCommands.test.ts passing 7, and MemoryNavigator.test.tsx passing 7. Mock servers reported listening on 127.0.0.1:5005. The final line begins EditableFlowCanvas.test.tsx, then the run stops without a suite summary. The log does not identify a failed assertion or explain the timeout, so assigning a cause would be guesswork.
Privacy Mode blocks cloud calls, but voice still leaves the device
Privacy Mode's local_only setting refuses cloud model clients, network tools, web search, integrations, and cloud embeddings at core egress points. Ollama, LM Studio, MLX, and local OpenAI-compatible endpoints remain available. Control-plane traffic for sign-in, billing, and connection management still runs, and the docs distinguish that metadata from user content. That division is clear enough to audit before connecting an account.
Voice breaks the otherwise simple rule. The privacy documentation says speech-to-text still uses the hosted proxy or another configured service because there is no local STT engine. Open issue 6870 asks for loopback transcription endpoints to work under local_only; it remained open when checked. Our 3 CPU, 8 GB run used no credentials and did not exercise any network route, so it cannot confirm the privacy controls. If dictation includes client names, health details, or private meetings, leave voice disabled until its route matches your policy.
Open P0 and P1 reports put unattended actions outside the safe trial
Issue 6842 describes a v0.64.9 agent that kept promising to search and send email after its tool-call format stopped parsing. The report records seven occurrences across two sessions and labels the bug P0. Issue 6631, labeled P1, says the macOS sandbox rejects shell commands that redirect output to /dev/null. These are specific operational failures, not a general complaint about beta polish. Both can interrupt the reason someone installs an agent: getting an action completed and knowing whether it happened.
A separate open P1 security report, issue 6733, says quoted tool-call markup can execute on the streamed path under the default recovery policy. The issue frames the repair as a tradeoff because disabling recovery may drop genuine narrated calls. We did not reproduce that report, and our 900-second test timeout supplies no evidence either way. It still changes the adoption boundary. Use a restricted workspace, approval gates, and low-value accounts while these reports are open, especially for email, shell, browser, or purchase actions.
Native packages avoid the unsigned script path
OpenHuman recommends Homebrew, a Debian or Ubuntu package, or a signed Windows MSI because its live install scripts have no separate signature. The guide also warns that Linux AppImages may hit Wayland or missing-library failures. Source contributors need Node 24+, pnpm 10.10.0, Rust 1.96.1, CMake, Ninja, ripgrep, desktop prerequisites, and recursive submodules. Our 72-second install did not test those platform packages because the lab image was prepared for repository builds.
Maintenance is active. GitHub showed 40,431 stars, 251 open issues, and 4 open pull requests on October 2, 2026; the combined repository counter was 255, not 255 bugs. The last push was October 1, and v0.64.10 shipped September 30 with fixes across approvals, MCP handling, memory selection, updates, and CI. That pace is encouraging, though the README still labels the product early beta. A 66-second successful build and a 900-second unfinished suite can both be true in a fast-moving repository.
The right first use is one reversible workflow
OpenClaw is the closer fit when an assistant should live mainly in existing chat channels. Hermes Agent suits developers who want terminal control and a smaller surface to modify. AnythingLLM is easier to justify when the job is private document chat rather than workflows and multiple agent interfaces. OpenHuman earns a look when its particular combination matters: editable local memory, a visual workflow canvas, several interfaces, and an embeddable Rust runtime.
Start with the native installer, one low-value data source, and one action you can undo. Inspect what reaches the Obsidian mirror, which provider handles each workload, and what the approval screen permits. Our run showed that 1,314 packages can install and the monorepo can build, while 900 seconds were insufficient for the tests to finish. That is enough for an informed experiment. It is not enough to hand OpenHuman a primary inbox or unattended production task.