IronClaw — Frameworks & SDKs

IronClaw is a self-hosted platform for running autonomous AI agents in sealed sandboxes that cannot phone home, read the host, or modify their own configuration. It solves the trust problem of autonomous agents by enforcing a verifiable security boundary, and is for developers who want AI agent capabilities without giving an autonomous program access to their machine.

agent-platform ai-agents ai-assistant claude golang gvisor llm mcp

🐙 View on GitHub ↗ 🌐 Website 📦 Install

IronClaw demo — 🎞️ Demo from the project README

✨ Key features

Sealed sandbox with network=none and gVisor
Human approval gateway for all capability changes
Per-session encrypted message queues
CLI-first and API-first design
ironctl scan grades container isolation 0-100
GitHub Action for PR sandbox scorecards

🎯 Use cases

Run autonomous AI agents on your own infrastructure
Chat with agents via chat apps you already use
Audit container isolation of any running container
Gate CI on Dockerfile security with ironctl scan
Deploy a hardened control-plane on a PaaS

📦 Installation

🧰 Requirements: Requires Docker daemon for sandbox; Linux with gVisor for full isolation, macOS weaker, native Windows unsupported (use WSL2). No API key needed for demo.

1. Install — detects your OS/arch and verifies the SHA-256 checksum before installing

curl -fsSL https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.sh | sh

2. Start the control-plane in dev mode — API base URL: http://127.0.0.1:8787

export IRONCLAW_API_TOKEN=$(openssl rand -hex 32)
ironclaw-controlplane --dev --api-addr 127.0.0.1:8787 &

3. Your first command — submit a change; it is HELD at the gateway for a human decision

ironctl change submit --kind persona --group dev-agent --by you
ironctl change pending                       # see it waiting
ironctl change approve <change-id> --by you   # apply it

On Windows, use irm https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.ps1 | iex.

🚀 Usage

git clone https://github.com/IronSecCo/ironclaw.git && cd ironclaw
examples/live-containment/run.sh   # builds the sandbox once, engages a real sandbox, proves it holds

⚠️ Good to know

Alpha software, work in progress; flags, on-disk format, and HTTP/contract surfaces can change without notice; not every feature is tested end-to-end; macOS has weaker sandbox boundary than Linux+gVisor; native Windows cannot run the agent sandbox.

❓ FAQ

Do I need an API key to try IronClaw?

No, the demo and quickstart run with zero credentials using an offline mock-agent.

How does IronClaw prevent agents from exfiltrating data?

Each sandbox runs with network=none and reaches the model only through a host proxy, so it cannot phone home.

Can I use IronClaw on Windows?

Native Windows cannot run the agent sandbox; you need WSL2 or Linux.

What does ironctl scan do?

It grades the containment posture of any running container, compose service, or Kubernetes pod on a 0-100 scale, and can also statically grade Dockerfiles.

📊 Repository

GitHub github.com/IronSecCo/ironclaw

Stars★ 19

Forks🍴 15

Open issues🐛 15

Last commit🕒 Sep 3, 2026

Created📅 Jun 2026

Language💻 Go

License⚖️ AGPL-3.0

Websiteironsecco.github.io/ironclaw

Topics agent-platform ai-agents ai-assistant claude golang gvisor llm mcp open-source personal-assistant sandbox security

🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.