IronClaw vs OpenClaw — Which Agent Should You Run?
Current IronClaw stable is 1.1.0 — a ground-up rebuild with no migration path from 0.29.x — and a 1.x version number does not mean feature parity. mcp, memory, logs, channels list, hooks list, pairing, import and login are still "not implemented yet" from the CLI, and skills is list-only. That materially changes the comparison below if you are choosing today.
Short version: new IronClaw users should start on 1.1.0; existing 0.29.x users should evaluate it as a parallel install and keep 0.29.1 running. See the 1.1.0 quick start · the 1.0.0 rearchitecture · 1.1.0 stable. This page is queued for a 1.x rewrite.
OpenClaw is the popular, fast-moving personal agent with the biggest ecosystem. IronClaw (NEAR AI) is a Rust rebuild designed around one question: what can a compromised tool or a prompt-injected model actually reach? If you're choosing between them, the trade is ecosystem and channel breadth against isolation by default.
The earlier comparison relied on an IronClaw allowlist file, ironclaw audit and "sandbox modes" that don't exist. Everything below is checked against IronClaw's own documentation and release notes.
Side by side
| IronClaw 1.4 | OpenClaw | |
|---|---|---|
| Built as | Single Rust binary (ironclaw); hosted option at agent.near.ai | Node.js Gateway (Node 24.16+ for 2026.9.3+) |
| Config | config.toml + providers.json; secrets only by env-var name | ~/.openclaw/openclaw.json (JSON5, strictly validated) |
| Secrets | Encrypted store, master key in the OS keychain; injected at the network proxy, never inside tools | Config, env and auth profiles on the host |
| Tool isolation | WASM tools with fuel and memory limits; per-tool allowed_hosts; per-user sandbox containers and egress proxy on local-Docker | Exec approvals and allowlists; optional Docker sandbox |
| Skills | Trusted (local) vs installed (IronHub); installed skills can't be self-activated by the model | SKILL.md skills from ClawHub and local folders |
| Channels | Slack, Telegram | Many: Telegram, WhatsApp, Discord, Slack, iMessage, email and more |
| MCP | HTTP(S) only, wrapped as extensions; stdio rejected | stdio and HTTP |
| Maturity | 1.x is a 2026 rebuild; some CLI surfaces are still "not implemented yet" (channels list, logs, hooks list) | Large community, weekly releases |
Choose IronClaw if…
- the agent will hold credentials you can't afford to leak, and you want tools that structurally can't read them;
- Slack and Telegram cover your channels;
- you want privacy-focused inference (NEAR AI, TEE-attested Tinfoil) or a managed hosted instance.
Choose OpenClaw if…
- you want WhatsApp, iMessage, Discord or the widest skill ecosystem;
- you want the most tutorials, community help and third-party integrations;
- you're prepared to harden it yourself (OpenClaw security), or run it sandboxed in NemoClaw.
No official migration tool exists between them. Set IronClaw up fresh and move your prompts and skills across by hand, reviewing each skill before you put it in a trusted folder.
Sources: IronClaw's official docs in github.com/nearai/ironclaw/docs and the release notes (1.4.1 stable, 2026-09-29; 1.4.0 stable, 2026-08-28). Checked 2026-09-30.
← Back to IronClaw hub · See also: IronClaw Quick Start · OpenClaw Security Hardening · OpenClaw Quick Start