# IronClaw

> A Rust personal assistant emphasizing credential protection and isolated tool execution.

- **Maker:** NEAR AI
- **Catalogue type:** Self-hosted runtime
- **Website:** https://www.ironclaw.com
- **Source code:** https://github.com/nearai/ironclaw
- **Also known as:** unknown — no other names recorded
- **Evidence:** 7 sources, checked 2026-10-21 to 2026-10-21
- **Profile:** https://agentlist.wiki/agent/ironclaw/
- **This record:** https://agentlist.wiki/agents/ironclaw.md

## Key facts

| Field | Value | Status | Sources |
| --- | --- | --- | --- |
| Availability & access | Available | documented | 1 |
| Price & usage costs | Free; you pay models | documented | 1, 5 |
| Included in another plan | ChatGPT subscription through Codex provider | documented | 5 |
| Where it runs | Self-hosted | documented | 1 |
| Open source & license | MIT OR Apache-2.0 | documented | 1 |
| Controls your computer | unknown | unknown | — |
| Its own computer | unknown | unknown | — |
| Works while your computer is off | unknown | unknown | — |
| If the vendor stops | Keeps working | documented | 1 |
| Remote shut-off | Not possible | documented | 1 |
| What you keep | Partial | documented | 1 |
| Company type | Startup | documented | 7 |
| Launch date | Feb 23, 2026 | documented | 7 |

Status marks — `documented`: Supported by official documentation; not independently tested. `limited`: Only partial or conditional support established. `unknown`: Not established by reviewed sources; does not mean unsupported.

## Company & launch

*Who makes it and when it arrived. Company type and funding are context, not a quality score: an open-source project and a public company carry different risks, not better or worse ones.*

- **Company type** `documented` — Startup [7]
- **Company stage** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Disclosed funding** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Launch date** `documented` — Feb 23, 2026 · Public launch [7]

**Launch history**

- 2026-02-23 · Public launch [7]

## What it can do

*What this agent can actually operate — a machine of its own, yours, or neither. Computer control is three separate questions, and most products answer only some of them.*

- **What stands out** `documented` — WASM tool isolation and credential injection that keeps raw secrets outside tool code. [1]
- **Computer use** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Controls your computer** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Its own computer** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Works while your computer is off** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Browser control** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Voice & ambient listening** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Background work & triggers** `documented` — Cron, events, webhooks, and heartbeat. [1]

## Apps & access

*Where you reach it and on what. A messaging integration is not a native app, so the two are tracked apart; an app listed here is a real first-party client.*

- **Native desktop apps** `limited` (partial or conditional only) — Web interface and terminal on macOS, Linux, and Windows; native desktop app not specified. [1]
- **iPhone & Android apps** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Web & messaging** `documented` — REPL, web gateway, webhooks, Telegram, Slack. [1]
- **Messaging services** `documented` — Telegram, Slack [1]
- **Native hardware** `unknown` — Not specified — no reviewed source answers this, which is a gap in the catalogue rather than a "no".
- **Developer API** `limited` (partial or conditional only) — Self-hosted Chat Completions and Responses API routes, described in implementation docs. [4]

## Models & plans

*What you pay and what runs underneath. Where an agent is bundled into a larger subscription, the price shown is that subscription's — there is no separate fee for the agent.*

- **Models & providers** `documented` — NEAR AI, Anthropic, OpenAI, Gemini, Copilot, Ollama, Bedrock, and compatible endpoints. [5]
- **Bring your own model** `documented` — Own keys for Anthropic, OpenAI, Gemini and other providers; Ollama and compatible endpoints. [5]
- **Included in another plan** `documented` — Can use a ChatGPT subscription through the OpenAI Codex provider. [5]
- **Price & usage costs** `documented` — Open-source software with no software subscription. Supply your own model access and deployment; their costs and limits vary. [1, 5]

## Vendor lock-in

*How hard it is to leave, and what survives if the company does. Almost no hosted vendor publishes a shutdown commitment, so an answer here is usually read from the architecture rather than from a promise.*

- **If the vendor stops** `documented` — Open-source software you run yourself, so it keeps running if the project stops; it still depends on whichever model provider you point it at. [1]
- **Remote shut-off** `documented` — Runs on hardware you control, with no vendor activation or licence check described. [1]
- **What you keep** `documented` — State lives on hardware you control, but a documented full export and restore path is not established. [1]

## Ownership & control

*What it asks before acting, what it remembers, and who else can see it. These are the questions that decide whether you would hand it your inbox.*

- **Open source & license** `documented` — MIT OR Apache-2.0 [1]
- **Where it runs** `documented` — Self-hosted; background service and browser interface. [1]
- **Passwords & credentials** `limited` (partial or conditional only) — Built-in encrypted credential store; website-password autofill is not specified. [3]
- **Approval before actions** `documented` — Scoped approval requests, durable denials, and configurable always-allow policies. [6]
- **What it remembers** `documented` — Persistent workspace, identity files, hybrid full-text/vector search. [1]
- **Edit & export your data** `limited` (partial or conditional only) — Native installers and editable local configuration. Full state export / restore not verified. [1]
- **Privacy & isolation** `documented` — WASM capabilities, credential injection, endpoint allowlists, Docker isolation. [1]
- **Availability & access** `documented` — Available for self-hosting. [1]

## Plans

| Plan | Price | Billing | Includes | Limits | Sources |
| --- | --- | --- | --- | --- | --- |
| Self-hosted | Free software | Model access and hosting are supplied separately. | MIT OR Apache-2.0 open-source license; Own keys for Anthropic, OpenAI, Gemini and other providers; Ollama and compatible endpoints. | Usage limits and running costs depend on your chosen provider and deployment. | 1, 5 |

## Native apps and web access

*Messaging services are channels, not native apps, and are listed separately below.*

| Platform | Status | Detail | Sources |
| --- | --- | --- | --- |
| Web | Available | Web interface and terminal on macOS, Linux, and Windows; native desktop app not specified. | 1 |

## Messaging services

| Service | Status | Detail | Sources |
| --- | --- | --- | --- |
| Telegram | Available | REPL, web gateway, webhooks, Telegram, Slack. | 1 |
| Slack | Available | REPL, web gateway, webhooks, Telegram, Slack. | 1 |

## Hardware

`unknown` — no dedicated hardware is established by the reviewed sources.

## Data reach

*What personal data this agent can reach, and whether anyone else could reach the same source.*

unknown — no first-party or exclusive data reach is recorded for this agent.

## Discussion

unknown — no dated public threads are recorded for this agent.

## Feedback snapshot

unknown — no attributed feedback snapshot is recorded for this agent.

## Updates

**Where updates come from:** unknown — no update source has been recorded for this agent.

- 2026-09-29 · Release · [IronClaw 1.4.1](https://github.com/nearai/ironclaw/releases/tag/ironclaw-v1.4.1) · NEAR AI — Stable promotion of a release candidate, fixing Google OAuth activation so Gmail and Calendar extensions work when the operator supplies their own OAuth client, and taking a Wasmtime security update.

## Sources

1. [IronClaw README](https://raw.githubusercontent.com/nearai/ironclaw/main/README.md) — checked 2026-10-21
2. [IronClaw official repository](https://github.com/nearai/ironclaw) — checked 2026-10-21
3. [IronClaw encrypted secret store](https://github.com/nearai/ironclaw/blob/main/crates/substrates/ironclaw_secrets/README.md) — checked 2026-10-21
4. [IronClaw OpenAI-compatible API contract](https://github.com/nearai/ironclaw/blob/main/docs/internal/reborn/contracts/openai-compatible-api.md) — checked 2026-10-21
5. [IronClaw inference providers](https://github.com/nearai/ironclaw/blob/main/docs/capabilities/llm-providers.md) — checked 2026-10-21
6. [IronClaw approval system](https://github.com/nearai/ironclaw/blob/main/crates/kernel/ironclaw_approvals/README.md) — checked 2026-10-21
7. [NEAR AI introduces IronClaw at NEARCON](https://near.ai/blog/near-ai-launches-ironclaw-confidential-gpu-marketplace-and-multimodal-confidential-inference) — checked 2026-10-21