IronClaw is NEAR AI’s security-first Agent OS: a personal AI assistant written in Rust that runs on your own machine, keeps your data local and encrypted, and treats every tool it uses as untrusted until proven otherwise. Launched in 2026, it has grown to about 12,700 stars on GitHub.
Personal agents usually ask for sweeping trust: your files, your credentials, your accounts. IronClaw’s design starts from the opposite assumption. Untrusted tools execute inside WebAssembly sandboxes with capability-based permissions and endpoint allowlisting; credentials are injected at the host boundary and never exposed to tool code, with leak detection scanning traffic in both directions; and incoming content passes through layered prompt-injection defenses before it can influence the agent. On top of that hardened core sits a full assistant: persistent memory with hybrid full-text and vector search, a workspace filesystem for notes and context, channels including a web gateway, Telegram and Slack, and routines that run on cron schedules, events or webhooks. IronClaw can even expand itself by building new WASM tools on request and connecting to MCP servers. All state is stored locally, secrets are encrypted with AES-256-GCM, and there is no telemetry.
IronClaw is free and open source under the Apache-2.0 and MIT licenses. You install it on your own hardware and bring your own LLM provider key; there is no subscription.
IronClaw is for users who want an always-on personal AI assistant but refuse to hand a cloud service their data and credentials โ people who value local control, auditability and defense-in-depth enough to run their own agent infrastructure.