IronClaw — Privacy-First AI Assistant Framework

Overview

IronClaw is an open-source, privacy-focused personal AI assistant built in Rust, inspired by the OpenClaw architecture. It is developed by NEAR AI and designed around one core principle: your AI assistant should work for you, not against you.

In contrast to cloud-dependent AI tools that silently harvest user data, IronClaw stores everything locally, encrypts it at rest, and gives users full control. It is self-expanding — capable of building new tools on the fly via WebAssembly — and supports multiple LLM backends including NEAR AI, OpenAI, Anthropic, Ollama, and more.

Key Features

🔒 Privacy & Security First

Local-only data storage — All notes, context, and conversation history stay on your machine, encrypted.
No telemetry — Open source, fully auditable, zero hidden data harvesting.
WASM Sandbox — Every untrusted tool runs inside an isolated WebAssembly container with capability-based permissions.
Credential Protection — Secrets are never exposed to WASM tools; injected at the host boundary with leak detection.
Defense in depth — Multiple security layers guard against prompt injection and data exfiltration.

🛠️ Dynamic Tool Building

Describe what you need in natural language, and IronClaw generates it as a WASM tool on the fly.
No waiting for vendor updates — self-expanding capability without restarting the agent.
Plugin architecture allows dropping in new WASM tools and channels at runtime.

🔌 MCP Protocol Support

Full support for Model Context Protocol (MCP) servers, allowing integration with external services.
Connect to any MCP-compatible server for extended capabilities.

🔍 Hybrid Search

Full-text + vector search using Reciprocal Rank Fusion (RRF).
Backed by PostgreSQL 15+ with the pgvector extension.

🌐 Multi-Channel Access

TUI (terminal UI via Ratatui)
HTTP webhooks
WASM channels — Telegram, Slack
Web gateway

🤖 Multi-LLM Backend Support

Backend	Value	Notes
NEAR AI	`nearai`	Default; multi-model, OAuth auth
Anthropic	`anthropic`	Claude models
OpenAI	`openai`	GPT models
Ollama	`ollama`	Local inference
OpenRouter	`openai_compatible`	300+ models
Together AI	`openai_compatible`	Fast inference
Tinfoil	`tinfoil`	Hardware-attested TEE inference
vLLM / LiteLLM	`openai_compatible`	Self-hosted

📁 Workspace & Identity

Workspace Filesystem — Flexible path-based storage for notes, logs, and context.
Identity Files — Maintain consistent personality and preferences across sessions.

⚙️ Skills System

SKILL.md-based prompt extensions with trust model and tool attenuation.
ClawHub registry for sharing and discovering community skills.

🐳 Sandbox Execution

Docker container isolation with network proxy and credential injection.
Claude Code mode — Delegate jobs to Claude CLI inside containers.
Parallel job execution with state machine and self-repair for stuck jobs.

Architecture

User Input
    │
    ▼
Agent Loop (Rust)
    │
    ├── LLM Backend (NEAR AI / OpenAI / Anthropic / Ollama / ...)
    │
    ├── Tool Manager
    │       ├── Built-in Tools
    │       └── Dynamic WASM Tools
    │               └── WASM Sandbox
    │                       ├── Capability-based permissions
    │                       ├── Endpoint allowlisting
    │                       ├── Credential injection
    │                       └── Leak detection
    │
    ├── MCP Protocol Layer
    │
    ├── Hybrid Search (Full-text + pgvector)
    │
    └── Channels (TUI / HTTP / Telegram / Slack / Web)

Security Model

IronClaw implements defense in depth:

WASM Isolation — Tools run in sandboxed containers, not on the host.
Capability Permissions — Explicit opt-in for HTTP access, secret access, and tool invocation.
Endpoint Allowlisting — HTTP requests only reach pre-approved hosts and paths.
Secret Injection — Credentials injected at host boundary; never visible inside WASM code.
Leak Detection — Scans both outgoing requests and incoming responses for credential exfiltration.
Rate & Resource Limiting — Per-tool request rate limits, memory, CPU, and execution time caps.

WASM ──► Allowlist ──► Leak Scan ──► Credential ──► Execute ──► Leak Scan ──► WASM
         Validator    (request)      Injector       Request    (response)

Installation

macOS / Linux

curl --proto '=https' --tlsv1.2 -LsSf \
  https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh

Windows (PowerShell)

irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex

npm

npm install ironclaw

Build from Source

git clone https://github.com/nearai/ironclaw.git
cd ironclaw
cargo build --release
cargo test

Requirements: Rust 1.85+, PostgreSQL 15+ with pgvector extension, NEAR AI account

Use Cases

Personal knowledge management — Store notes, logs, and context locally with AI-powered search.
Privacy-sensitive workflows — Legal, medical, or financial tasks where data must stay local.
Developer productivity — Extend the assistant with custom WASM tools tailored to your workflow.
Self-hosted AI assistant — Full control over models (via Ollama) and data.
Security-conscious enterprises — Run inside TEEs via Tinfoil for provable confidentiality.

Project Status

Active development by NEAR AI team
v0.15.0 released March 4, 2026
~4.8k GitHub stars, 97 open PRs indicating healthy community activity
Apache-2.0 licensed — fully open source

Related Projects

OpenClaw — The original project IronClaw is inspired by
NEAR AI Cloud — Hosted LLM inference backend
Tinfoil — Hardware-attested private inference