Overview

IronClaw is NEAR AI's agent written in Rust, dual-licensed MIT or Apache-2.0. Its README calls it a Rust reimplementation inspired by OpenClaw, not a fork. Untrusted tools run in WebAssembly sandboxes (wasmtime) with capability-based permissions, HTTP requests go only to allowlisted hosts, and secrets are encrypted with AES-256-GCM and injected at the host boundary, with a leak detector on requests and responses. Jobs can run in Docker containers, every tool execution is logged, and data stays in its local application state. It installs from release binaries on macOS, Linux (x86_64 and ARM64) and Windows, then ironclaw onboard picks a model provider. Until October 2026 this site described it as a source-available enterprise product with gVisor, SAML SSO and a $750 price per seat; its repository shows none of that.

Our take

Editorial opinion, not a test result.

Best for

Builders who want untrusted tools in a WebAssembly sandbox with declared network and file access
Setups where API keys must never reach the tools or the model
Rust teams that want an extensible agent under MIT or Apache-2.0

Not for

Teams that want the largest plugin ecosystem (OpenClaw)
Python-first teams (Hermes Agent, Nanobot)
Setups that need the agent's shell confined: the shell tool, once enabled, runs on the host

Security posture

Sandbox by default	yes
Auth on dashboard	yes
Threat model documented	yes
Multi-LLM support	yes
CVEs on NVD (total)	2
CVEs in the last 30 days	0

On for untrusted tools: WebAssembly tools run in a wasmtime sandbox and reach only the hosts and paths their capabilities.json declares, and jobs can run in Docker containers. The host shell tool is not registered unless you set ALLOW_LOCAL_TOOLS=true; then it runs on the host, with a scrubbed environment and an injection filter.