IronClaw reimplements OpenClaw in Rust to deliver memory-safe, sandboxed AI agent execution that keeps your data, credentials, and execution entirely under local control while outperforming the original TypeScript framework in security and performance.
The rapid adoption of autonomous AI agents has exposed a critical tension in the current landscape: powerful reasoning capabilities come at the expense of user privacy and security. Centralized platforms require uploading sensitive context, API keys, and personal data to remote servers, creating single points of failure for data breaches, prompt-injection attacks, and unintended credential leakage. Even self-hosted alternatives built in dynamic languages often inherit runtime vulnerabilities and loose sandboxing.
OpenClaw emerged as a popular framework for running personal AI assistants that integrate with messaging channels and execute tools on user-controlled hardware. However, its TypeScript foundation and Docker-based execution model left gaps in memory safety, credential isolation, and defense-in-depth. IronClaw, developed by NearAI, addresses these limitations through a complete reimplementation in Rust. The result is a single-binary, high-performance runtime that maintains full feature parity with OpenClaw while introducing WASM-based capability sandboxes, encrypted local persistence, and architectural safeguards that prevent credentials from ever reaching the language model.
IronClaw operates as a local-first personal AI assistant with support for REPL, HTTP webhooks, WASM channels (Telegram, Slack, and others), a browser-based web UI, background routines, and dynamic plugin extensibility. All processing, memory, and tool execution remain on the host machine or in user-controlled containers. This design directly solves the privacy problem for developers, AI researchers, and self-hosting enthusiasts who refuse to trade control for convenience.
The Rust Advantage
Rust was selected as the foundation for IronClaw precisely because it eliminates entire classes of vulnerabilities at compile time while delivering native execution speed. Unlike TypeScript, which relies on garbage collection and runtime checks, Rust’s ownership model guarantees memory safety without overhead. This translates to the absence of buffer overflows, use-after-free errors, and data races—common vectors in agent runtimes that process untrusted inputs from users or external APIs.
The single-binary distribution simplifies deployment across Linux, macOS, and Windows without dependency hell. Fine-grained control over system resources enables precise sandboxing boundaries that TypeScript runtimes cannot enforce as reliably. Performance gains appear immediately in parallel job scheduling, hybrid vector-plus-full-text search over persistent memory, and low-latency agent loops that coordinate multiple workers.
Privacy benefits stem directly from language-level guarantees. The orchestrator can enforce strict capability-based permissions on WASM tools without fear of accidental data leakage through unsafe code paths. Credential injection occurs exclusively at the host boundary after allow-list validation and leak scanning. Even if a malicious tool attempts exfiltration, Rust’s type system and the surrounding safety layer block the attempt before network transmission. These architectural decisions make IronClaw measurably superior for production-grade, privacy-sensitive deployments compared with interpreted or garbage-collected alternatives.
Memory Safety in Practice
Every tool execution path passes through a WASM sandbox with explicit capability grants. The Rust host never trusts the guest; outbound HTTP requests are intercepted, validated against an endpoint allow-list, scanned for credential patterns, and only then forwarded with injected secrets. This flow is impossible to bypass because Rust’s borrow checker prevents the creation of alternative data paths.
Performance and Deployment Benefits
Parallel job execution via the scheduler supports concurrent routines and webhooks without blocking the main agent loop. The resulting binary runs efficiently on modest hardware while scaling to multi-core servers, making IronClaw suitable for both individual developers and small-team self-hosted infrastructure.
Installation Guide
Installing IronClaw requires minimal setup yet provides multiple paths tailored to different expertise levels. The process supports both quick binary installation and full source builds for maximum customization.
Prerequisites
- Rust toolchain 1.85 or newer (install via rustup)
- PostgreSQL 15+ with the pgvector extension enabled
- Docker (for isolated worker sandboxes and optional containerized deployment)
- Git for source installation
- A NEAR AI account (free tier sufficient for initial setup; optional for local-only workflows)
Docker is explicitly required to power the containerized job execution environment, even when running the core agent natively.
One-Command Installation Options
The project provides platform-native installers that handle binary placement and shell completion automatically:
For macOS, Linux, or WSL:
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | shHomebrew users (macOS/Linux):
brew install ironclawWindows users can download the MSI from the releases page or run the PowerShell installer:
irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iexThese methods produce a globally available ironclaw command immediately.
Building from Source
Developers requiring custom builds or bleeding-edge features should compile from source:
git clone https://github.com/nearai/ironclaw.git
cd ironclaw
cargo build --release
cargo testThe resulting binary appears in target/release/ironclaw. For production channels, run ./scripts/build-all.sh after modifying source.
Setting Up PostgreSQL with pgvector
IronClaw stores persistent memory, identity files, and audit logs in PostgreSQL with vector extensions for hybrid search:
createdb ironclaw
psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"The repository includes docker-compose.yml for users preferring containerized PostgreSQL. Start the stack with docker compose up -d before onboarding.
Configuration and Initial Setup
After installation, the interactive onboarding wizard configures the entire environment in minutes.
Running the Onboard Wizard
ironclaw onboardThe wizard prompts for database connection details, NEAR AI OAuth credentials (for default LLM backend), and master encryption key storage (system keychain or file). It writes bootstrap variables to ~/.ironclaw/.env and persists all subsequent settings in the database.
LLM Provider Configuration
IronClaw defaults to NEAR AI but supports any OpenAI-compatible endpoint. For complete local privacy, select Ollama or vLLM during onboarding or set environment variables:
LLM_BACKEND=openai_compatible
LLM_BASE_URL=http://localhost:11434/v1
LLM_API_KEY=ollama
LLM_MODEL=llama3.2Detailed provider matrices and configuration examples reside in the included docs/LLM_PROVIDERS.md.
Environment Variables and Secrets
All sensitive values remain encrypted at rest with AES-256-GCM. The orchestrator injects credentials into approved endpoints only after WASM validation. No secrets ever reach the LLM context.
Getting Started with Usage
IronClaw exposes multiple interaction surfaces once configured.
Launching the REPL and Interacting with Your Agent
ironclawor, when running from source:
cargo runThe REPL supports natural-language commands that trigger intent classification, tool selection, and parallel execution. Background routines continue independently.
Implementing Channels and the Web Gateway
WASM channels enable seamless integration with Telegram, Slack, and other platforms. Configuration follows the dedicated docs/TELEGRAM_SETUP.md guide. The built-in web gateway provides a modern UI with real-time SSE and WebSocket updates for chat, memory inspection, job monitoring, and routine management.
Creating and Managing Tools and Routines
The dynamic tool builder accepts natural-language descriptions and compiles them into WASM modules on the fly. The MCP protocol integration allows importing community tools while the safety layer enforces permissions. Routines engine supports cron, event, and webhook triggers for autonomous operation.
Example Workflows for AI Agents
A typical privacy-preserving workflow might involve:
- User requests market research via REPL or Telegram.
- Agent classifies intent, schedules parallel web-scraping and analysis jobs.
- Tools execute inside isolated WASM or Docker sandboxes.
- Results persist in encrypted workspace memory.
- Summary returns to the user without external data transmission.
This pattern scales to complex multi-step research, automation, or personal assistance while maintaining complete auditability.
Security Best Practices for Self-Hosted Deployments
IronClaw’s architecture provides strong defaults, but production deployments benefit from additional hardening.
Running in Production Environments
Bind the HTTP listener to localhost or a reverse proxy. Enable firewall rules that restrict PostgreSQL and agent ports to trusted interfaces only. Rotate database credentials regularly and use connection pooling with TLS.
Credential and Data Protection Strategies
Maintain the encrypted vault as the single source of truth. Never store plaintext secrets in environment files beyond the minimal bootstrap set. Review allow-lists periodically and enable leak-detection logging.
Monitoring, Auditing, and Sandbox Configuration
Every tool invocation generates an immutable audit record. Set resource limits and rate caps per sandbox. Monitor Rust log output at RUST_LOG=ironclaw=debug during initial validation. The prompt-injection defense layer (pattern detection, sanitization, policy enforcement) should remain in Block or Review mode for untrusted channels.
Optional: Cloud Deployment with TEEs on NEAR AI
For teams requiring managed infrastructure without sacrificing hardware isolation, IronClaw supports one-click deployment into Trusted Execution Environments on NEAR AI Cloud. Secrets remain encrypted in TEE memory, invisible even to the cloud provider.
Conclusion
IronClaw represents a significant evolution in the OpenClaw ecosystem. By combining Rust’s compile-time guarantees with WASM sandboxes, encrypted persistence, and defense-in-depth credential handling, it delivers the first truly production-ready framework for privacy-focused autonomous AI agents. Developers and researchers can now build sophisticated agentic workflows without compromising data sovereignty or performance.
The project continues rapid iteration toward full feature parity while expanding the WASM plugin ecosystem and MCP integrations. Self-hosting enthusiasts, privacy advocates, and enterprises seeking decentralized AI infrastructure will find IronClaw the most robust and secure choice available today. Contributions via the GitHub repository accelerate this trajectory, ensuring the future of personal AI remains firmly in user hands.
