IronClaw is NEAR AI's open-source (MIT or Apache-2.0) security-first AI agent. Version 1.x is a Rust rebuild shipped as a single ironclaw binary: credentials are kept in an encrypted store and injected only at the network proxy, tools run in a WebAssembly sandbox that can reach only the hosts they declare, and everything sent to the model is scanned for leaked secrets. You can self-host it or run a private instance on the NEAR AI Agent Hub.

Do I need IronClaw or OpenClaw?

Run OpenClaw for home assistant use. Run IronClaw if your agent handles credentials, production infrastructure, or shared channels — anywhere a compromised agent causes real harm.

Can I run OpenClaw skills on IronClaw?

Skills are Markdown SKILL.md files in both, so the instructions carry over, but IronClaw activates them by keyword, tag and pattern scores declared in the skill's activation block, so add one. Put reviewed skills in ~/.ironclaw/skills/ (trusted) or install from the signed IronHub catalogue with ironclaw ironhub install --kind skill. OpenClaw plugins and tools do not carry over; IronClaw tools are WASM extensions.

Last updated: 2026-09-30

🛡

IronClaw

Security-hardened · Deny-by-default · Mandatory allowlist · Audit logged

MIT / Apache-2.0 WASM-sandboxed tools v1.4.1 stable Linux · macOS · Windows NEAR AI · Anthropic · OpenAI · Ollama · 25+ providers

IronClaw is NEAR AI's security-first personal agent. Version 1.x is a ground-up Rust rebuild shipped as one ironclaw binary, or as a private hosted instance on the NEAR AI Agent Hub. Its design assumes a tool or a prompt can turn hostile. Secrets are encrypted and injected only at the network proxy, so tools never hold them. Tools run in a WebAssembly sandbox that can reach only the hosts they declare. Everything sent to the model is scanned for leaked secrets. The trade-off: fewer channels (Slack and Telegram) and a younger ecosystem than OpenClaw.

Current: IronClaw 1.4.1 (2026-09-29). All guides re-checked 2026-09-30

1.3.0 added per-user model preferences, structured automations with a fail-closed preflight, and document editing. 1.4.0 added a durable notification inbox, background subagents, persistent per-user sandbox containers on the local-Docker profile and a managed egress proxy. 1.4.1 (2026-09-29) fixes Gmail and Google Calendar activation when the operator sets the Google OAuth client in the web UI, and moves the WASM runtime to Wasmtime and WASI 48.0.3, which fixes recent guest fuel-accounting vulnerabilities. Still "not implemented yet" in the CLI: channels list, hooks list, logs. Every guide below was rebuilt on 2026-09-27 from IronClaw's own docs. Earlier versions described an allowlist file, audit-log commands and a JSON config that IronClaw doesn't have.

Guides

⚡

Quick Start — IronClaw 1.4

Agent Hub or the one-line installer, ironclaw onboard, ironclaw serve on 127.0.0.1:3000, the background service, channels and updates.

Live

🔐

Skills, Tools & Allowlisting

Trusted vs installed skills, signed IronHub installs with digest pinning, and per-tool network allowlists in capabilities.json.

Live

🏛

Security Architecture

Encrypted secrets injected at the proxy, WASM sandbox, leak detection, prompt-injection layers, profiles, and a hardening checklist.

Live

⚙️

Configuration Reference

config.toml and providers.json, precedence, ironclaw config, secrets by variable name, profiles and budget caps.

Live

⚖️

IronClaw vs OpenClaw

Architecture, config, secrets, tool isolation, channels and maturity compared, and who should pick which.

Live

❓

IronClaw FAQ

Current version, PostgreSQL, installing skills, where the config lives, supported channels and setup time.

Live

Skills on IronClaw

Skills are SKILL.md files, like OpenClaw's, but IronClaw activates them by the keywords, tags and patterns in each skill's activation block. Skills you place in ~/.ironclaw/skills/ are trusted. Skills from the signed IronHub catalogue (ironclaw ironhub install <name> --kind skill) are installed: the model can't self-activate them. Writing a skill: skills guide. Trust rules: skills, tools & allowlisting.

At a Glance

License	MIT or Apache-2.0 (your choice)
Current stable	1.4.1 (2026-09-29)
Install	One-line shell or PowerShell installer, or MSI, from GitHub releases; or hosted at agent.near.ai
Config	`~/.ironclaw/reborn/config.toml` + `providers.json`
Web UI	`ironclaw serve` on 127.0.0.1:3000
Storage	File-backed libSQL by default; PostgreSQL optional
Tool isolation	WebAssembly (wasmtime) with per-tool host allowlists; secrets injected at the proxy
Channels	Slack, Telegram
Models	NEAR AI (default), Anthropic, OpenAI, Gemini, Bedrock, Ollama, OpenRouter, Tinfoil and 20+ more, or any OpenAI-compatible endpoint
Spend caps	`budget.*` in config.toml (daily per user and project, pause threshold)

IronClaw is Built for These Use Cases

IronClaw's default-deny sandbox is the right pick whenever the agent touches production systems, customer data, or money.

Customer support triage — IronClaw's manifest-declared capabilities cap the blast radius
Invoice processing — agent touches money; sandboxing is non-negotiable
Code review automation — GitHub access through a tool that never holds your token
Email triage — IronClaw is the safest of the email-capable platforms
All 12 use cases →

IronClaw Troubleshooting

Start with ironclaw doctor: it reports your home, profile, config files and driver health without creating state
All troubleshooting entries →

Cross-Platform Security Topics

Sandboxing — contain the blast radius (IronClaw sandboxes tools in WebAssembly)
Skill & tool allowlisting — IronClaw enforces per-tool host allowlists at its network proxy
MCP server supply chain — IronHub entries carry provenance and SHA-256 digests; pin them
Prompt injection — the #1 agent vulnerability
Full security hub — 8 deep-dive topics

Related on This Site

OpenClaw hub — the most popular self-hosted agent; more channels and a bigger ecosystem
NemoClaw — a different security approach: Docker + OpenShell policy sandbox rather than IronClaw's WASM tool sandbox
OpenClaw Security Hardening — if you want OpenClaw with better security but don't need IronClaw's full enforcement
Decision guide — when IronClaw is and isn't the right choice
Weekly News Digest — IronClaw security advisories and CVE summaries every Monday