IronClaw
IronClaw is a security-hardened fork of the OpenClaw architecture. Where OpenClaw optimises for flexibility, IronClaw optimises for a minimal, auditable attack surface. Every skill must be explicitly allowlisted. Every outbound network call is blocked until you grant the specific host. Every security event is logged — mandatorily. If your agent handles credentials, production infrastructure, or shared access, IronClaw's defaults are worth the extra setup time.
IronClaw 1.0.0 (2026-07-28) rebuilt the agent runtime, storage, extension host and web UI from scratch, and 1.1.0 (2026-08-07) is the first stable release on that new line. There is no migration path from 0.29.x — no migration for config, databases, settings or secrets — and installing 1.x does not touch your existing 0.29.x data.
A 1.x version number also doesn't mean feature parity: mcp, memory, logs, channels list, hooks list, pairing, import and login are still "not implemented yet" from the CLI, and skills is list-only. New users should start on 1.1.0. Existing 0.29.x users should evaluate it as a parallel install and keep 0.29.1 running.
Details: the 1.1.0 quick start · the 1.0.0 rearchitecture · 1.1.0 stable and 1.1.1-rc.1.
Only the Quick Start has been rewritten for 1.1.0 so far. Skill Allowlisting, Security Architecture, Configuration Reference, vs OpenClaw and the FAQ still document the 0.29.x line — accurate for 0.29.1, but not a description of how 1.x works. Each is banner-marked; treat their commands as 0.29.x-only until they are updated.
Guides
IronClaw uses the same skill architecture as OpenClaw — all 53 official skills are compatible. We don't maintain a separate skills database for IronClaw:
→ Skills Guide: Write Your Own Custom Skills
→ Skills Database: 53 Verified Official Skills
On 0.29.x the install commands are identical to OpenClaw's: ironclaw skill install <name>, then ironclaw allowlist add <name> to activate it. This changed in 1.x — skills is list-only from the CLI, and 1.x instead ships 12 first-party extensions embedded in the binary (GitHub, Gmail, Google Calendar/Docs/Drive/Sheets/Slides, Notion, NEAR AI MCP, Slack, Telegram, web access) that install with no network fetch, plus IronHub deep-link installs and custom hosted MCP servers registered from the WebUI.
At a Glance
| License | MIT core (free); advanced audit tooling commercial |
| Current stable | 1.1.0 (2026-08-07) — 1.1.1-rc.1 is a prerelease, not recommended yet |
| Install | Platform installer — shell, PowerShell or MSI. Not npm since 1.0.0. |
| Requires | No Node.js runtime — 1.x ships as a compiled binary across 7 targets (macOS Apple Silicon/Intel, Linux x86_64/aarch64 gnu+musl, Windows x86_64) |
| Web UI | ironclaw serve — WebChat v2, frontend compiled into the binary |
| Storage | File-backed libSQL by default; PostgreSQL available by config |
| Sandbox | Deny-by-default, seccomp-bpf (Linux) / sandbox-exec (macOS) |
| Capabilities (1.x) | 12 first-party extensions embedded in the binary; IronHub deep-link installs; custom hosted MCP servers from the WebUI. skills is list-only from the CLI. |
| Skill activation (0.29.x) | Install + ironclaw allowlist add <skill> — 0.29.x only, no 1.x equivalent |
| Audit log | Mandatory — gateway won't start without writable log path |
| Compatible skills | All 53 official OpenClaw skills |
| Typical monthly cost | Same as OpenClaw — depends on model choice, not IronClaw itself |
IronClaw is Built for These Use Cases
IronClaw's default-deny sandbox is the right pick whenever the agent touches production systems, customer data, or money.
- Customer support triage — IronClaw's manifest-declared capabilities cap the blast radius
- Invoice processing — agent touches money; sandboxing is non-negotiable
- Code review automation — read-only by default; signed skill manifests for repo access
- Email triage — IronClaw is the safest of the email-capable platforms
- All 12 use cases →
IronClaw Troubleshooting
- Skill not in allowlist — IronClaw's allowlist enforcement explained
- All troubleshooting entries →
Cross-Platform Security Topics
- Sandboxing — contain the blast radius (IronClaw is the reference implementation)
- Skill & tool allowlisting — IronClaw enforces this at the process level
- MCP server supply chain — IronClaw signs manifests; you should still verify
- Prompt injection — the #1 agent vulnerability
- Full security hub — 8 deep-dive topics
Related on This Site
- OpenClaw hub — the base framework IronClaw forks from; simpler setup, same skill ecosystem
- NemoClaw — a different security approach: Docker + OpenShell policy sandbox rather than syscall enforcement
- OpenClaw Security Hardening — if you want OpenClaw with better security but don't need IronClaw's full enforcement
- Decision guide — when IronClaw is and isn't the right choice
- Weekly News Digest — IronClaw security advisories and CVE summaries every Monday