IronClaw: A Free Open-Source Rust Alternative to OpenClaw

IronClaw is a free, open-source Rust AI agent system from NEAR AI. This OpenClaw-inspired reimplementation runs a personal assistant with local PostgreSQL storage and a model provider you configure.

The agent can receive tasks through a terminal, web gateway, webhooks, and messaging channels. It can call approved tools, retain workspace context, and run routines on schedules or events.

IronClaw stores secrets in encrypted local PostgreSQL storage, injects credentials at the host boundary, and runs untrusted code inside WASM sandboxes.

The same system maintains context over time, communicates with external services through MCP, and can wake itself for scheduled work.

Visit IronClaw

Features

WASM Sandbox: Untrusted code runs in isolated WebAssembly containers. Permissions cover HTTP access, stored secrets, and tool calls.
Credential Protection: The host injects credentials at request time and scans outgoing requests and incoming responses for secret leaks.
Prompt Injection Defense: IronClaw screens external content for injection patterns, escapes it, and applies Block, Warn, Review, or Sanitize rules.
Endpoint Allowlisting: HTTP requests from tools are restricted to explicitly approved hosts and URL paths.
Multi-Channel Access: You can reach IronClaw through the REPL, HTTP webhooks, WASM channels such as Telegram and Slack, or a web gateway with SSE and WebSocket streaming.
Routines Engine: The agent can react to cron schedules, events, and webhooks while you are away.
Heartbeat System: The heartbeat system runs monitoring and maintenance tasks in the background.
Parallel Jobs: The scheduler can run independent requests in separate contexts.
Self-Repair: IronClaw detects stuck operations and attempts recovery.
Dynamic Tool Building: Describe a capability in plain language, and IronClaw builds a WASM tool for it.
MCP Protocol: IronClaw connects to Model Context Protocol servers for extra capabilities.
Plugin Architecture: You can add WASM tools and channels without restarting the agent.
Hybrid Memory Search: The workspace searches full text and vectors, then combines the results with Reciprocal Rank Fusion.
Workspace Filesystem: The local PostgreSQL database keeps notes, logs, and context in a path-based structure.
Identity Files: Identity files retain personality and preference settings across sessions.
AES-256-GCM Encryption: AES-256-GCM encrypts secrets at rest. The project does not send telemetry, analytics, or data to third parties.
Full Audit Log: The audit log records every tool execution.

OpenClaw vs. IronClaw

IronClaw is a Rust reimplementation inspired by OpenClaw. It uses Rust, PostgreSQL, and per-tool WASM sandboxes, whereas OpenClaw uses TypeScript, SQLite, and shared-process isolation.

Feature	OpenClaw	IronClaw
Language	TypeScript	Rust
Memory Safety	Runtime GC	Compile-time
Secret Handling	LLM sees secrets	Encrypted vault
Tool Isolation	Shared process	Per-tool WASM
Prompt Injection	“Please don’t leak”	Architectural controls
Network Control	Unrestricted	Allowlist

How to Use It

Table Of Contents

Prerequisites
Installation
Database Setup
First-Time Configuration
Connecting an Alternative LLM Provider
Running the Agent
CLI Command Reference

Prerequisites

You need Rust 1.96 or later and PostgreSQL 15+ with the pgvector extension. The setup wizard uses a NEAR AI account for authentication. Source builds with the webui-v2-beta feature also need Node.js 22+, Corepack, and pnpm.

Installation

Windows (installer): Download the .msi from the releases page and run it.

Windows (PowerShell):

irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex

macOS / Linux / WSL:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh

Homebrew (macOS/Linux):

brew install ironclaw

Build from source:

git clone https://github.com/nearai/ironclaw.git
cd ironclaw
cargo build --release
cargo test

Rebuild the channel bundles before a full release if you change any channel source, such as the Telegram WASM channel.

./scripts/build-all.sh

Database Setup

createdb ironclaw
psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"

First-Time Configuration

The wizard configures the database connection, NEAR AI browser OAuth, and secrets encryption through your system keychain. It writes bootstrap variables such as DATABASE_URL and LLM_BACKEND to ~/.ironclaw/.env.

ironclaw onboard

Connecting an Alternative LLM Provider

Select an OpenAI-compatible provider in the wizard, or set the environment variables directly. IronClaw also includes paths for Anthropic, OpenAI, GitHub Copilot, Google Gemini, MiniMax, Mistral, and local Ollama providers.

LLM_BACKEND=openai_compatible
LLM_BASE_URL=https://openrouter.ai/api/v1
LLM_API_KEY=sk-or-...
LLM_MODEL=anthropic/claude-sonnet-4

OpenRouter, Together AI, Fireworks AI, vLLM, and LiteLLM also work through the OpenAI-compatible route.

Running the Agent

# Interactive REPL
cargo run
# With debug logging
RUST_LOG=ironclaw=debug cargo run

CLI Command Reference

Command	Purpose
`ironclaw onboard`	Run the interactive setup wizard
`cargo run`	Start the interactive REPL
`RUST_LOG=ironclaw=debug cargo run`	Start REPL with debug output
`cargo build --release`	Build the release binary
`cargo test`	Run the test suite
`cargo test <test_name>`	Run a specific test
`cargo fmt`	Format source code
`cargo clippy --all --benches --tests --examples --all-features`	Run the linter
`createdb ironclaw_test`	Create the test database
`./scripts/build-all.sh`	Rebuild all WASM channel bundles
`./channels-src/telegram/build.sh`	Rebuild only the Telegram WASM channel

Pros

Rust memory safety.
Encrypted local secret storage.
Configurable model providers.
Isolated parallel jobs.

Cons

Requires PostgreSQL and pgvector.
Initial setup uses NEAR AI.
Source builds need Rust expertise.

Alternatives and Related Tools

FAQs

Q: Does IronClaw require a NEAR AI account to function?
A: The legacy onboarding wizard starts with NEAR AI authentication. IronClaw accepts other LLM backends after you configure it, including OpenAI-compatible endpoints and local Ollama.

Q: What does “secrets never touch the LLM” mean in practice?
A: A WASM tool signals that it needs an authenticated request. The host injects the stored credential only at execution time and scans requests and responses for text that resembles stored secrets before the model receives them.

Q: Is IronClaw an OpenClaw Rust implementation?
A: IronClaw is a Rust reimplementation inspired by OpenClaw. Its architecture uses Rust, PostgreSQL, and per-tool WASM sandboxes.

Q: Can IronClaw use a local model?
A: Yes. Set LLM_BACKEND=ollama, then set OLLAMA_BASE_URL or OLLAMA_MODEL when your local setup needs them. The database and onboarding requirements remain.

Q: What is the WASM sandbox performance overhead?
A: A WASM sandbox adds work to each tool call compared with native execution. IronClaw can still schedule independent jobs in isolated contexts at the same time.

Q: How do routines differ from a regular cron job?
A: A cron job runs a fixed command. An IronClaw routine may start on a schedule, event, or webhook. The agent then handles the task with its configured context and approved capabilities.

Q: What license does IronClaw use?
A: IronClaw is dual-licensed under MIT and Apache 2.0. You can choose either license for your use case.

Last Updated: July 10, 2026