AI Agents Too Expensive and Leaky? This Open-Source Plugin Cuts Costs by 60% and Keeps Sensitive Data On-Device
AI agents are weaving themselves into our workflows at an unprecedented pace. But when we eagerly put them to real work, current usage patterns expose three glaring problems:
Cloud, "afraid to use": Want an agent to analyze a customer data spreadsheet? Great idea — but customer names, phone numbers, ID numbers... all of that sensitive information goes to a third-party cloud server along with the context. One data analysis could mean one serious privacy breach. That is a risk we cannot afford.
Cloud, "can't afford it": For a large number of simple tasks — say, just using grep to find where a function is called, or writing a short summary — the agent goes straight to the most expensive top-tier model without a second thought. Most tokens are spent on simple tasks a cheap model could handle. Like using a sledgehammer to crack a nut.
Local, "doesn't work well": Running models locally is safe and cheap, but performance often falls short of expectations because on-device models are limited in compute and parameter scale. Format conversion and data aggregation are fine, but once multi-file cross-analysis or complex anomaly detection comes in, the model "crashes" and struggles with hard tasks.
The cloud is too risky, local is too weak — are developers forced to choose one?
Clearly, there is always a way. Adults don't make choices — the best answer is device-cloud collaboration:
Let lightweight local models handle private data and simple tasks, and hand the complex "hard bones" to powerful cloud models. The key to connecting it all is an "intelligent traffic controller" that finds the best path for every request — routing.
THUNLP at Tsinghua University, Renmin University of China, AI9Stars, ModelBest, and OpenBMB have jointly released and open-sourced ClawXRouter — built precisely to solve this problem!
ClawXRouter is a device-cloud collaborative AI agent routing plugin that fits easily into the OpenClaw ecosystem. It comes from EdgeClaw, a device-cloud collaborative agent framework.
EdgeClaw natively provides a full set of device-cloud collaboration capabilities — three-tier privacy routing, cost-performance-aware routing, smart redaction and forwarding, and dual-track memory. ClawXRouter packages its core routing capabilities into a standalone plugin that plugs easily into the OpenClaw ecosystem.
Without changing a single line of business code, developers can make their AI agents automatically:
Analyze public data in the cloud
Redact sensitive data before sending it to the cloud
Process private data locally
One plugin, seamless device-cloud collaboration, solving developers' three problems: "afraid to use," "can't afford it," and "doesn't work well."
➤ GitHub repository
🔗 https://github.com/Openbmb/ClawXRouter
➤ ClawHub
🔗 https://clawhub.ai/plugins/clawxrouter
This article includes video content. Please view it in the original WeChat post.
ClawXRouter: The Best Answer for Every Request, Automatically
Three-tier privacy routing for "afraid to use"
Even a routine task like code review can accidentally feed an API key or database password to a cloud model. ClawXRouter plants hooks that scan every message, tool call, and agent output like a security checkpoint, sorting them into three tiers:
S3 (private): SSH private keys, hardcoded passwords, payroll records. This data is physically isolated; requests are handled entirely offline by the local model, and the cloud never sees it. Private information never leaves the machine.
S2 (sensitive): Alert logs containing internal IPs, contact lists containing phone numbers. ClawXRouter detects and redacts them automatically (for example, replacing "Wang Xiaoer" with [REDACTED:NAME]) before forwarding to the cloud model.
S1 (safe): Ordinary questions such as "What is the difference between HTTP 403 and 401?" go straight to the cloud to make the most of its capabilities.
Behind this, a dual detection engine of rules plus models keeps watch — fast and accurate, with no room for error.
Cost-performance-aware routing for "can't afford it"
Using a "space-grade" model to tighten a screw! ClawXRouter has a built-in "task assessor" (LLM-as-Judge) powered by a small local model. It quickly judges task complexity and dispatches each request to the most suitable model.
How well does it work? We ran it on PinchBench (23 OpenClaw agent benchmarks):
The conclusion is obvious: 58% cost savings, with performance up 6.3%!
Dual-track memory and smart redaction for "doesn't work well"
What if a task contains sensitive information yet needs the strong reasoning of a cloud model? That is where ClawXRouter's smart redaction comes in.
For complex tasks involving sensitive information, the local model doesn't have to grit its teeth when it falls short: ClawXRouter detects and redacts sensitive information automatically, then safely hands the redacted task to the cloud.
Meanwhile, ClawXRouter maintains a clever dual-track memory and dual-track session mechanism: the cloud model sees only the redacted conversation history (MEMORY.md), while the local side keeps the complete information (MEMORY-FULL.md). This protects privacy without letting the local model's limits stall the workflow, and eliminates the risk of private data leaking to third-party services through the context window.
Composable Pipelines and a Visual Dashboard
Every developer and team has different needs. So ClawXRouter provides:
Composable routing pipeline: Privacy routing and cost-performance routing run in one pipeline under a "safety first" principle. The privacy router runs first with high priority and short-circuits on sensitive data; only after passing the safety check does the cost-performance router optimize cost. The pipeline uses 10 hooks to cover the full lifecycle from model selection to session end, taking over OpenClaw's existing flow non-invasively.
Visual dashboard: Bilingual in Chinese and English, with five panels — usage overview, session records, detection logs, routing rule configuration, and model configuration. All changes take effect immediately without a restart, so users can adjust to their needs.
Quick Start
Prerequisite: OpenClaw installed
# Install via npm (recommended)
pnpm add -w @openbmb/clawxrouter
# Or install via ClawHub
openclaw plugins install clawhub:clawxrouter
# (Optional) Install a local inference backend
ollama pull openbmb/minicpm4.1
ollama serve
# Start
openclaw gateway
# Dashboard → http://127.0.0.1:18789/plugins/clawxrouter/stats
Cloud you dare not use, cloud you cannot afford, device that doesn't work well — ClawXRouter's answer is: no need to choose; let device and cloud each do what it does best. The project will keep iterating in the open, and we welcome developers and industry partners to contribute and build a safe, efficient device-cloud agent ecosystem together.