IronClaw
by NEAR AI (NEAR Foundation)
Open-source agent runtime in Rust where your secrets never touch the model
IronClaw is an open-source, security-first runtime for autonomous AI agents, written in Rust by NEAR AI. Every tool runs in its own WebAssembly sandbox and credentials stay in an encrypted vault that the language model never sees, so a compromised prompt cannot walk away with your API keys, funds or filesystem.
IronClaw is an open-source, security-first runtime for autonomous AI agents, built from scratch in Rust by NEAR AI as a hardened answer to OpenClaw-style agent frameworks. Illia Polosukhin announced it in early 2026 after a run of incidents in which users lost credentials and funds to permissively-wired agents, and version 1.0 shipped on 27 July 2026. The design separates the model's decision-making from action execution and routes every action through a single coordination layer the team calls the guard, so a policy guarantee made once holds across every channel rather than being re-implemented per tool. Each tool executes inside its own WebAssembly sandbox with capability-based permissions, no filesystem access and no outbound network beyond an explicit host-and-path allowlist. Credentials sit in an encrypted vault using AES-256-GCM, are never placed in the model's context, and are injected only at the host boundary at the moment of execution, with real-time leak detection scanning for exfiltration. Prompt-injection defence is layered across pattern detection, content sanitisation and policy enforcement, and the Rust runtime removes the memory-safety class of bugs outright. One agent runs across CLI, web, Slack and Telegram sharing persistent memory, backed by hybrid full-text and vector search with reciprocal rank fusion over a PostgreSQL-backed workspace. A routines engine handles cron schedules, event triggers and webhook handlers, the agent can build new WASM tools on demand from a natural-language description and reuse them later, and MCP servers are supported. It is dual-licensed Apache 2.0 and MIT, carries roughly 12,600 GitHub stars and 1,500 forks, and runs either self-hosted or one-click on NEAR AI Cloud inside a trusted execution environment from $5 per month.
The security engineer or platform lead who has been asked to let an autonomous agent touch production credentials and needs the isolation enforced by the runtime rather than by policy documents.
Agent tools run with capability-scoped WASM isolation and credentials injected only at the execution boundary, so a successful prompt injection still cannot read the secret or reach an unapproved host.
At a Glance
- Category
- AI Agents & Orchestration
- Pricing
- Free, Subscription, Usage-based
- Target Market
- CTOs, CISOs, Enterprise Developers, Platform Engineers
- Deployment
- Open-source, Self-hosted, Cloud-first
Key Features
- ✓Per-tool WASM sandbox
Each tool runs in its own WebAssembly container with capability-based permissions, no filesystem access and resource limits, so one compromised tool cannot reach another.
- ✓Encrypted credential vault with boundary injection
Secrets are AES-256-GCM encrypted and injected only at the host boundary at execution time, never entering the LLM context where a hallucination or injection could leak them.
- ✓Network allowlisting and leak detection
Outbound HTTP is restricted to explicitly approved hosts and paths, and real-time scanning blocks credential exfiltration attempts before they leave the runtime.
- ✓Layered prompt-injection defence
Pattern detection, content sanitisation and policy enforcement operate as independent layers, so compromising one does not cascade into full agent takeover.
- ✓Unified multi-channel agent with persistent memory
The same agent serves CLI, web, Slack and Telegram with one memory store using hybrid full-text and vector search via reciprocal rank fusion.
- ✓Self-expanding tool building
The agent can generate new WASM tools on demand from a natural-language description, register them without a restart, and reuse them in later runs.
- ✓Routines engine
Cron schedules, event triggers and webhook handlers drive background automation, with parallel job handling in isolated execution contexts and self-repair for stalled jobs.
Capabilities
Use Cases
- •Credential-holding operations agent
Give an agent real cloud and SaaS credentials to perform routine operational work, with the vault ensuring the model never reads the secret it is using.
- •Regulated-industry document and workflow automation
Legal, healthcare and financial teams automate document handling where confidentiality is enforced by sandbox and allowlist rather than by written policy.
- •Internal Slack or Telegram assistant
Deploy one agent across chat and CLI so context, preferences and past decisions carry over between channels instead of resetting per interface.
- •Scheduled monitoring and reporting
Use routines to poll systems on a cron schedule or react to webhooks, producing recurring reports without a separate orchestration service.
- •Hardened replacement for an existing OpenClaw deployment
Migrate an agent already in use to a runtime where each tool is isolated, replacing a flat permission model with capability scoping.
Ideal For
Best For
- ✓Running an autonomous agent that holds live API keys, cloud credentials or wallet access without exposing them to the model context
- ✓Regulated teams in legal, healthcare or financial services that need data confidentiality enforced architecturally for GDPR or HIPAA obligations
- ✓Replacing a Docker-only agent sandbox with per-tool WebAssembly isolation and an explicit network allowlist
- ✓Operating one agent with shared memory across CLI, web, Slack and Telegram instead of separate bots per channel
- ✓Scheduled and event-driven background automation via the routines engine (cron, webhooks, event triggers)
Not Ideal For
- ✗Teams that need a large plugin and integration ecosystem today — IronClaw is newer than OpenClaw and its community and tool catalogue are correspondingly smaller
- ✗Projects that want maximum flexibility in multi-tool orchestration, since IronClaw is deliberately opinionated and constrains what a tool may reach compared with OpenClaw's permissive model
- ✗Organisations that require a formal third-party security attestation before deployment — Forbes notes hardware-level agent security is still early with no industry benchmarks and no large-scale stress testing yet
Integrations
Deployment
Market Analysis
Pros
- ✓The most thorough security architecture among the comparable agent runtimes: Rust memory safety, per-tool WASM isolation, vault-held credentials and layered injection defence
- ✓Genuinely open source under Apache 2.0 / MIT with an active repository — roughly 12,600 stars, 1,500 forks and 3,884 commits on main
- ✓One agent with shared persistent memory across CLI, web, Slack and Telegram, which most alternatives do not offer without separate deployments
- ✓Zero telemetry and local-first storage, with a self-hosted path that keeps data entirely under your control
- ✓Dogfooded internally — NEAR Foundation and NEAR AI say every employee runs their own IronClaw agent
Cons
- ✗Practitioners are not yet convinced the defences work: a Hacker News commenter comparing agent frameworks noted IronClaw has 'some defences against prompt injection but idk if they're any good'
- ✗Immature relative to OpenClaw — a smaller community, fewer plugins and integrations, and an opinionated architecture that constrains multi-tool orchestration
- ✗Roughly 1,300 open issues against 234 open pull requests on the repository, which is a heavy backlog for a project at 1.0
- ✗No industry benchmarks exist for agent runtime security and, per Forbes, real-world stress testing across large concurrent fleets has not happened yet
- ✗No published SOC 2, ISO 27001 or HIPAA attestation, which is awkward for a product positioned at regulated buyers
- ✗Self-hosting needs Rust 1.96+, Node.js 22+ and PostgreSQL, a heavier operational footprint than a single-binary or npm-installed agent
Pricing
Self-hosted (open source)
$0
- ✓Full runtime under Apache 2.0 / MIT
- ✓Local or Docker deployment
- ✓Bring your own LLM API keys
- ✓All WASM tools and channels
Starter (NEAR AI Cloud)
From $5/mo
- ✓1 agent instance
- ✓$5 of model credits included
- ✓One-click managed deployment
- ✓Runs in a trusted execution environment
Basic (NEAR AI Cloud)
From $20/mo
- ✓2 agent instances
- ✓$20 of model credits included
- ✓Managed hosting
Pro+ (NEAR AI Cloud)
From $200/mo
- ✓5 agent instances
- ✓$200 of model credits included
- ✓Priority support
- ✓Early model access
The runtime itself is free and open source under a dual Apache 2.0 / MIT licence, so self-hosting costs nothing beyond your own LLM API spend and infrastructure. NEAR AI Cloud is the paid path and is metered by agent instance plus bundled model credits: $5/mo for one instance, $20/mo for two, and $200/mo for five with priority support and early model access. There is no published enterprise tier or per-seat pricing, and no dedicated support SLA is advertised below Pro+.
Security & Compliance
Connect
Sources
This page was written from 6 sources, 5 on domains other than ironclaw.com.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Sema4.ai
Enterprise AI agents for knowledge work, running natively in your Snowflake or cloud account
Sapiom
Agent infrastructure that routes, runs and meters AI agents in production
Itential FlowAI
Governed AI agents for network and infrastructure operations, with deterministic execution and full audit trails
OpenAI Presence
Deploy production-grade AI voice and chat agents with enterprise policies, guardrails and evals