one pure-Swift daemon · self-hosted
Your AI. Your machine.
Always on.
A personal AI assistant that lives on hardware you own. Chat with it on Telegram, give it durable memory, and let it run scheduled tasks — while every consequential action waits for your explicit approval.
curl -fsSL https://raw.githubusercontent.com/ivan-magda/swift-claw/main/install.sh | sh
- Swift 6.3
- macOS 15+
- Linux x86_64
- Telegram bot
- MIT license
- OpenAI-compatible
Capabilities
Everything a personal assistant should be — but private
One binary. Your data. Your schedule. Your rules.
A real Telegram chat
Answers stream in as live message drafts. /stop cancels a turn, /new starts a fresh session. On-device voice transcription on macOS 26, and it can see photos your model supports.
- Live streaming drafts
- /stop and /new controls
- Voice notes transcribed on-device
Durable memory
Confirmed facts persist in SQLite and are recalled by importance and recency.
Proactive, on your clock
Schedules fire per occurrence across restarts and DST, with an opt-in heartbeat that respects quiet hours.
Skills you write once
A skills/<name>/SKILL.md file shows up in context. When a task matches, clawd follows your procedure.
Bring your own model
Any OpenAI-compatible endpoint works — or run an eligible model on your ChatGPT subscription.
MCP server tools
List a server, store its token encrypted, and its tools join the least-trusted set.
Sandboxed code
Untrusted code runs in a fresh disposable VM per request (macOS arm64, opt-in).
One binary
Swift 6 with strict concurrency, from Telegram long-poll down to SQLite.
Security model
Built on default-deny
swift-claw assumes you are the only person it serves — and enforces it in code.
The approval card
A file write suspends the run until you answer. Every field — the fully resolved path after symlink and .. resolution, the size, a preview — comes from the daemon's own record of the action. Tap Deny and clawd writes nothing.
Write file: ~/workspace/notes.md
Size: 2.4 KB
Approve and write, or Deny?
Default-deny allowlist
Only allowlisted Telegram IDs get a conversation. Everyone else is refused — CLAW_ALLOWLIST only ever adds.
Secrets encrypted at rest
Bot tokens and API keys are wrapped in an AES-GCM envelope. Plaintext dev fallbacks warn on every boot.
Approvals durable & unforgeable
File writes and code execution suspend until you tap Approve in Telegram. Forged callbacks can't approve; pending approvals expire to deny.
Prompt injection contained
Messages, web content, tool output, and memory enter context as untrusted data. clawd pins providers and the model can't redirect them.
Install
Up and running in one command
No sudo. Everything lands in ~/.swift-claw, verified against release checksums.
Install script
curl -fsSL https://raw.githubusercontent.com/ivan-magda/swift-claw/main/install.sh | shThe script verifies every download against release checksums, stages the service files, and prints the next steps. Pin a release with CLAWD_VERSION=v0.2.0.
Build from source
git clone https://github.com/ivan-magda/swift-claw.git && cd swift-claw swift build -c release
Requires a Swift 6.3 toolchain (Linux: libsqlite3-dev).
FAQ