{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "ironclaw", "name": "IronClaw", "vendor": "NEAR AI", "vendorUrl": "https://www.ironclaw.com", "kind": "harness", "category": "personal-assistants", "summary": "IronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory.", "url": "https://www.anchorterminal.com/tools/ironclaw", "markdownUrl": "https://www.anchorterminal.com/tools/ironclaw.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ironclaw.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ironclaw.json", "repo": "https://github.com/nearai/ironclaw", "license": "MIT OR Apache-2.0", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "`ironclaw onboard` writes a bearer token to `~/.ironclaw/reborn/webui-token` and prints a login link that carries it as a `token` query parameter. The same token authorises the web interface and the Responses API with operator rights. Multi-user deployments can add Google or GitHub single sign-on and per-user API tokens with owner, admin or member roles. Connected accounts use OAuth (Google, Slack), a Telegram pairing code, or keys held in the encrypted secret store. The web interface binds to 127.0.0.1:3000 unless `--host` is changed (https://docs.ironclaw.com/using/webui.md).", "pricing": "freemium", "pricingNotes": "Free to self-host under MIT or Apache-2.0, with model usage billed by whichever provider the owner selects, or nothing with Ollama. NEAR AI sells hosted instances on ironclaw.com as Starter (shown as $5 beside $0 a month, 1 agent, $5 credits), Basic at $20 a month (2 agents, $20 credits) and Pro+ at $200 a month (5 agents, $200 credits). The page does not say whether a card is needed. NEAR AI Cloud inference is priced per million tokens on near.ai/pricing (checked 2026-10-12).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the release notes (checked 2026-10-12).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 12648, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://docs.ironclaw.com", "llmsTxt": "https://docs.ironclaw.com/llms.txt", "capabilities": [ "assistant.proactive", "assistant.messaging", "assistant.accounts", "assistant.memory", "assistant.self-hosted", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "rust", "wasm", "telegram", "slack", "gmail", "mcp", "hosted-option", "llms-txt" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 66.7, "grade": "B", "agentReady": false, "rank": 288, "ranked": true, "rankOf": 986, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 74, "payments": 60, "reliability": 67, "schema": 74, "security": 66, "transparency": 75 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 67, "points": 13.4, "reason": "Read with the local-software lines, as the Goose and OpenHands dossiers are. GitHub releases carry shell, PowerShell and MSI installers for seven targets, and source builds need Rust 1.96 and Node.js 22 (20). Push runs on `main` that we saw, dated 3 to 5 September 2026, passed Code Style, Reborn E2E and Platform \u0026 Compat and failed Tests (Reborn) and Code Coverage on all five commits. A scheduled Live Canary run failed on 1 October (10 of 25). 1,363 open issues and 183 open pull requests on 12 October. Reports filed since mid-September show no comments, among them a start-up failure (#8122) and a silent web chat status bug (#8124) (8 of 25). CHANGELOG.md follows Keep a Changelog and semantic versioning, with upgrade sections that name removed settings and the Slack re-consent in 1.3.0, and the 1.0.0 entry states there is no migration from 0.29 (14 of 15). 1.4.1 is a stable 1.x release (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "Harness reading, as for Goose. Extension manifests are typed (`manifest.toml` with a JSON Schema reference per tool), and the Responses API follows the OpenAI wire format with a contract test, but the repository has no OpenAPI file (18 of 25). llms.txt with Markdown twins at docs.ironclaw.com (10). Tool descriptions say when not to use a tool (`gmail.send_message` warns against using it for the final reply), but the heartbeat, cron, shell and WASM pages of the published docs name settings that are absent from the 1.4.1 source, and the quickstart gives two different token paths (9 of 20). Permissions, effects and origin gates are enums, and network targets and scopes are declared per tool (12 of 15). The Responses page lists status codes 400, 429 and 503 with an error envelope and troubleshooting steps (10 of 15). Dated changelog in the repository and on the docs site, which says it tracks the latest stable release (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "Harness reading, scored on what a caller driving it has to supply. Extensions install one at a time, but GitHub alone declares 49 tools and turn-0 tool selection is still an open proposal (#8113) (15 of 25). Context compaction, a resource governor, a cap on autonomous wakes and bounded finalisation are in the release notes. No cost cap was found in the docs (15 of 20). `ironclaw run --message` and the Responses API serve scripts, with `previous_response_id` for state, but approval and OAuth gates fail the turn over the API (14 of 20). Lease expiry recovers safe runs, an unavailable tool call is repaired, and parked approvals persist in a notification inbox (16 of 20). One binary with guided onboarding and an OpenAI-compatible endpoint, no SDK of its own, and auto-approve on by default (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "Harness reading of the framework checklist, as for Goose and OpenHands. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The README states no telemetry, we found no analytics library in the 1.4.1 source, and Trace Commons is opt-in with no default endpoint. Message content goes to the chosen model provider (28). Tools carry allow, ask or deny defaults, owners can disable a tool or force a prompt each time, WASM tools run in Wasmtime with declared network targets, secrets are injected outside the sandbox, and the web interface binds to loopback. Against that, global auto-approve defaults to on and covers tools marked ask, so sends, trashes and deletes run unprompted, and only financial, approval and budget effects always ask. The published docs do not state that default (11 of 20). Channel context is framed as untrusted quoted content, a leak detector scans traffic for secret patterns, and tool output is wrapped, per the security page and release notes (12 of 15). Metadata-only audit events for approvals, run transcripts, and an operator debug inspector with sanitised tool arguments (11 of 15). No SECURITY.md, no security.txt on ironclaw.com, docs.ironclaw.com or near.ai, no published GitHub advisory and no bounty found. The 1.4.1 notes do record the Wasmtime security update (4 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule, scoring the hosted option where one is sold. No payment protocol (0). ironclaw.com shows three monthly plans for hosted instances without a login and near.ai/pricing lists per-token inference prices (20). The software is free under MIT or Apache-2.0 and runs with a local Ollama model (20). An agent can install and run it with no sign-up (20). The Starter plan shows $5 beside $0 and the page does not say whether a card is needed." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "reason": "1.4.1 was published on 29 September 2026, 13 days before this check (30). Six stable releases in the last 90 days, from 1.0.0 on 27 July to 1.4.1 (20). Responsiveness is weak on the evidence we saw. The `main` branch has no commit after 10 September, issue numbers moved from #8072 to #8131 in a month, and the reports filed since mid-September have no comments (8 of 25). Release binaries for seven targets are current, though we confirmed no package-manager listing (10 of 15). Dependabot runs weekly and the Wasmtime fix shipped, but Tests (Reborn) was failing on `main` when we looked (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "note": "editorial 79, provenance 71", "reason": "MIT or Apache-2.0, with the whole runtime in one public repository (30). The NEAR AI privacy policy of 4 September 2026 covers the IronClaw framework and agent hosting and names PostHog and Stripe, with no retention periods. The release notes state what the Telegram link retains. The home page credits NEAR Foundation while the legal documents name Jasnah, Inc. d/b/a NEAR AI (17 of 30). Removals are dated in the changelog with upgrade steps, and the docs note the channels dropped in 1.0, with no written deprecation policy (12 of 20). No telemetry per the README and the source, and the one upload path, Trace Commons, is documented as opt-in with local preview and revocation (20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Harness reading, scored on what a caller driving it has to supply. Extensions install one at a time, but GitHub alone declares 49 tools and turn-0 tool selection is still an open proposal (#8113) (15 of 25). Context compaction, a resource governor, a cap on autonomous wakes and bounded finalisation are in the release notes. No cost cap was found in the docs (15 of 20). `ironclaw run --message` and the Responses API serve scripts, with `previous_response_id` for state, but approval and OAuth gates fail the turn over the API (14 of 20). Lease expiry recovers safe runs, an unavailable tool call is repaired, and parked approvals persist in a notification inbox (16 of 20). One binary with guided onboarding and an OpenAI-compatible endpoint, no SDK of its own, and auto-approve on by default (9 of 15).", "maintenance": "1.4.1 was published on 29 September 2026, 13 days before this check (30). Six stable releases in the last 90 days, from 1.0.0 on 27 July to 1.4.1 (20). Responsiveness is weak on the evidence we saw. The `main` branch has no commit after 10 September, issue numbers moved from #8072 to #8131 in a month, and the reports filed since mid-September have no comments (8 of 25). Release binaries for seven targets are current, though we confirmed no package-manager listing (10 of 15). Dependabot runs weekly and the Wasmtime fix shipped, but Tests (Reborn) was failing on `main` when we looked (6 of 10).", "payments": "Read with the self-hosted rule, scoring the hosted option where one is sold. No payment protocol (0). ironclaw.com shows three monthly plans for hosted instances without a login and near.ai/pricing lists per-token inference prices (20). The software is free under MIT or Apache-2.0 and runs with a local Ollama model (20). An agent can install and run it with no sign-up (20). The Starter plan shows $5 beside $0 and the page does not say whether a card is needed.", "reliability": "Read with the local-software lines, as the Goose and OpenHands dossiers are. GitHub releases carry shell, PowerShell and MSI installers for seven targets, and source builds need Rust 1.96 and Node.js 22 (20). Push runs on `main` that we saw, dated 3 to 5 September 2026, passed Code Style, Reborn E2E and Platform \u0026 Compat and failed Tests (Reborn) and Code Coverage on all five commits. A scheduled Live Canary run failed on 1 October (10 of 25). 1,363 open issues and 183 open pull requests on 12 October. Reports filed since mid-September show no comments, among them a start-up failure (#8122) and a silent web chat status bug (#8124) (8 of 25). CHANGELOG.md follows Keep a Changelog and semantic versioning, with upgrade sections that name removed settings and the Slack re-consent in 1.3.0, and the 1.0.0 entry states there is no migration from 0.29 (14 of 15). 1.4.1 is a stable 1.x release (15).", "schema": "Harness reading, as for Goose. Extension manifests are typed (`manifest.toml` with a JSON Schema reference per tool), and the Responses API follows the OpenAI wire format with a contract test, but the repository has no OpenAPI file (18 of 25). llms.txt with Markdown twins at docs.ironclaw.com (10). Tool descriptions say when not to use a tool (`gmail.send_message` warns against using it for the final reply), but the heartbeat, cron, shell and WASM pages of the published docs name settings that are absent from the 1.4.1 source, and the quickstart gives two different token paths (9 of 20). Permissions, effects and origin gates are enums, and network targets and scopes are declared per tool (12 of 15). The Responses page lists status codes 400, 429 and 503 with an error envelope and troubleshooting steps (10 of 15). Dated changelog in the repository and on the docs site, which says it tracks the latest stable release (15).", "security": "Harness reading of the framework checklist, as for Goose and OpenHands. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The README states no telemetry, we found no analytics library in the 1.4.1 source, and Trace Commons is opt-in with no default endpoint. Message content goes to the chosen model provider (28). Tools carry allow, ask or deny defaults, owners can disable a tool or force a prompt each time, WASM tools run in Wasmtime with declared network targets, secrets are injected outside the sandbox, and the web interface binds to loopback. Against that, global auto-approve defaults to on and covers tools marked ask, so sends, trashes and deletes run unprompted, and only financial, approval and budget effects always ask. The published docs do not state that default (11 of 20). Channel context is framed as untrusted quoted content, a leak detector scans traffic for secret patterns, and tool output is wrapped, per the security page and release notes (12 of 15). Metadata-only audit events for approvals, run transcripts, and an operator debug inspector with sanitised tool arguments (11 of 15). No SECURITY.md, no security.txt on ironclaw.com, docs.ironclaw.com or near.ai, no published GitHub advisory and no bounty found. The 1.4.1 notes do record the Wasmtime security update (4 of 20).", "transparency": "MIT or Apache-2.0, with the whole runtime in one public repository (30). The NEAR AI privacy policy of 4 September 2026 covers the IronClaw framework and agent hosting and names PostHog and Stripe, with no retention periods. The release notes state what the Telegram link retains. The home page credits NEAR Foundation while the legal documents name Jasnah, Inc. d/b/a NEAR AI (17 of 30). Removals are dated in the changelog with upgrade steps, and the docs note the channels dropped in 1.0, with no written deprecation policy (12 of 20). No telemetry per the README and the source, and the one upload path, Trace Commons, is documented as opt-in with local preview and revocation (20)." }, "sources": [ { "what": "home page, hosted plans and integrations", "url": "https://www.ironclaw.com/", "seen": "2026-10-12" }, { "what": "repository and README", "url": "https://github.com/nearai/ironclaw", "seen": "2026-10-12" }, { "what": "releases", "url": "https://github.com/nearai/ironclaw/releases", "seen": "2026-10-12" }, { "what": "changelog at 1.4.1", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/CHANGELOG.md", "seen": "2026-10-12" }, { "what": "auto-approve default", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/auto_approve.rs", "seen": "2026-10-12" }, { "what": "approval gate order", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/profile_gate.rs", "seen": "2026-10-12" }, { "what": "always-ask effects", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/profile_gate_policy.rs", "seen": "2026-10-12" }, { "what": "Gmail extension manifest", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/extensions/packages/gmail/manifest.toml", "seen": "2026-10-12" }, { "what": "Slack extension manifest", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/extensions/packages/slack/manifest.toml", "seen": "2026-10-12" }, { "what": "memory extension manifest", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/extensions/packages/memory-native/manifest.toml", "seen": "2026-10-12" }, { "what": "docs index for agents", "url": "https://docs.ironclaw.com/llms.txt", "seen": "2026-10-12" }, { "what": "security docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/security.mdx", "seen": "2026-10-12" }, { "what": "web interface docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/using/webui.mdx", "seen": "2026-10-12" }, { "what": "channel docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/channels/overview.mdx", "seen": "2026-10-12" }, { "what": "Responses API docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/api/responses.mdx", "seen": "2026-10-12" }, { "what": "storage docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/database.mdx", "seen": "2026-10-12" }, { "what": "MCP docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/extensions/mcp.mdx", "seen": "2026-10-12" }, { "what": "Trace Commons docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/traces.mdx", "seen": "2026-10-12" }, { "what": "heartbeat docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/routines/heartbeat.mdx", "seen": "2026-10-12" }, { "what": "inference providers docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/llm-providers.md", "seen": "2026-10-12" }, { "what": "IronHub install docs (source)", "url": "https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/hub/installing.mdx", "seen": "2026-10-12" }, { "what": "repository metadata (GitHub API)", "url": "https://api.github.com/repos/nearai/ironclaw", "seen": "2026-10-12" }, { "what": "security advisories (GitHub API, none published)", "url": "https://api.github.com/repos/nearai/ironclaw/security-advisories", "seen": "2026-10-12" }, { "what": "workflow runs on main (GitHub API)", "url": "https://api.github.com/repos/nearai/ironclaw/actions/runs?branch=main\u0026event=push", "seen": "2026-10-12" }, { "what": "open issues", "url": "https://github.com/nearai/ironclaw/issues", "seen": "2026-10-12" }, { "what": "NEAR AI privacy policy", "url": "https://near.ai/privacy-policy", "seen": "2026-10-12" }, { "what": "NEAR AI terms of service", "url": "https://near.ai/terms-of-service", "seen": "2026-10-12" }, { "what": "NEAR AI Cloud pricing", "url": "https://near.ai/pricing", "seen": "2026-10-12" }, { "what": "RDAP record for ironclaw.com", "url": "https://rdap.verisign.com/com/v1/domain/ironclaw.com", "seen": "2026-10-12" } ], "openQuestions": [ "Kind is harness. The briefs define no assistant kind, and a self-hosted agent program the owner runs is closest to the harness listings (Goose, OpenHands), so the harness readings of Schema, Ergonomics and Security were used", "Whether development has paused or moved. `main` has no commit after 10 September 2026 while the repository's last push was 11 October and 1.4.1 shipped from another branch", "Whether the web interface tells a new owner that auto-approve is on. The default was read from the source, and the software was not run", "Whether heartbeat exists in 1.x under another name. The docs page describes it with settings the 1.4.1 source does not contain", "Unchecked: the hosted service at agent.near.ai, its sign-up, card requirement and what the Starter plan costs. Nothing was sent to it", "Unchecked: trust.near.ai and any certification for NEAR AI Cloud", "Unchecked: whether GitHub private vulnerability reporting is enabled for the repository", "Unchecked: crates.io, npm, Homebrew and the MCP registry were not searched for an IronClaw package", "Unchecked: how memory is deleted. No delete tool is declared and the docs describe none", "The NEAR AI terms forbid automated extraction of data and outputs except through the published APIs. Recorded as a fact with no deduction, and it matters before any probe is run", "The privacy policy and terms were read through a summarising reader, so their wording should be checked before any clause is quoted", "The repository was cloned before github.com's robots.txt was read. The clone path is not one that file disallows for Anthropic agents" ] }, "negative": -2, "negativeNotes": [ "2026-10-12. The ironclaw.com home page lists Discord and Signal among integrations, while the channel docs for the current release say Discord, Signal, WeChat and WeCom are not part of the 1.0 release, which shipped on 27 July 2026. The docs site also says it documents the latest stable release while its heartbeat, cron, shell and WASM pages name settings absent from the 1.4.1 source. A misleading claim, at the minimum, -2. https://www.ironclaw.com/; https://docs.ironclaw.com/channels/overview.md; https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/routines/heartbeat.mdx" ], "verdict": "Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off.", "bestFor": "One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.", "strengths": [ "Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it", "Each extension tool declares a default permission, effects, network targets and OAuth scopes in `manifest.toml`. Gmail reads use `gmail.readonly` and sends use `gmail.send`", "Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox", "No analytics library was found in the 1.4.1 source. Trace Commons is opt-in and has no default endpoint", "Six stable releases between 27 July and 29 September 2026, each with dated notes and upgrade steps" ], "weaknesses": [ "Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask", "The `main` branch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open", "Docs pages for heartbeat, cron, shell and WASM limits name settings such as `HEARTBEAT_ENABLED` and `ALLOW_LOCAL_TOOLS` that do not appear in the 1.4.1 source", "No SECURITY.md, security.txt or published GitHub advisory was found", "The home page lists Discord and Signal integrations, while the channel docs say both are not part of the 1.0 release" ], "agentNotes": [ "Open Settings and turn off global auto-approve, or set send and delete tools to ask each time, before connecting mail or chat accounts", "Install with the release installer and run `ironclaw onboard`. 1.x does not migrate 0.29 data, so use a fresh home directory", "Call `POST /api/v1/responses` with the bearer token from `~/.ironclaw/reborn/webui-token`. Keep under 30 requests in 60 seconds", "Resolve approval and OAuth gates in the web interface. The Responses API fails the turn instead of surfacing them", "Connect MCP servers over HTTP only. The stdio transport is rejected" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.7 } ], "editorialScores": { "ergonomics": 69, "maintenance": 74, "payments": 60, "reliability": 67, "schema": 74, "security": 66, "transparency": 79 }, "provenanceScore": 71 }, "connect": { "install": "IRONCLAW_RELEASE_TAG=ironclaw-v1.4.1\ncurl --proto '=https' --tlsv1.2 -LsSf \"https://github.com/nearai/ironclaw/releases/download/${IRONCLAW_RELEASE_TAG}/ironclaw-installer.sh\" | sh\nironclaw onboard" }, "letme": { "capability": "https://letme.dev/assistant.proactive", "tool": "https://letme.dev/ironclaw" }, "notable": [ "The global auto-approve setting defaults to on (`AUTO_APPROVE_DEFAULT_ENABLED: bool = true`, with the comment that new users are not prompted per tool call), and it applies to tools whose default permission is ask (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/auto_approve.rs)", "Only effects of kind Financial, ModifyApproval and ModifyBudget always need a fresh approval. No bundled extension tool declares a financial effect (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/profile_gate_policy.rs)", "`gmail.send_message`, `gmail.reply_to_message`, `gmail.create_draft` and `gmail.trash_message` are marked ask, and `gmail.list_messages` and `gmail.get_message` are marked allow, each with its own OAuth scope (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/extensions/packages/gmail/manifest.toml)", "1.0.0 of 27 July 2026 replaced the 0.29 line with a rebuilt runtime. Its notes say there is no migration for config, databases, settings or secrets (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/CHANGELOG.md)", "The channel docs say Discord, Signal, WeChat and WeCom are not part of the 1.0 release, while the home page lists Discord and Signal among integrations (https://docs.ironclaw.com/channels/overview.md; https://www.ironclaw.com/)", "1.4.1 moved Wasmtime and WASI to 48.0.3 to fix guest fuel accounting vulnerabilities (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/CHANGELOG.md)", "A paired personal Telegram account lets the agent read conversations and act as the owner. The 1.3.0 notes say no mirror of the history is kept, and that content read in a run stays in that run's transcript (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/CHANGELOG.md)", "The Responses API does not surface approval or OAuth gates. A turn that reaches one fails with an error that points to the web interface (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/api/responses.mdx)", "The docs pages for heartbeat, cron routines, shell and WASM limits name `HEARTBEAT_ENABLED`, `ROUTINES_ENABLED`, `ALLOW_LOCAL_TOOLS` and `WASM_FUEL_LIMIT`. None of these strings appears in the Rust source at the 1.4.1 tag (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/routines/heartbeat.mdx)", "The `main` branch head is a commit of 10 September 2026, and its CHANGELOG.md stops at 1.3.0. Releases 1.4.0 and 1.4.1 were cut on other branches (https://github.com/nearai/ironclaw)", "The GitHub API returned no published security advisories for the repository, and the repository has no SECURITY.md at its root (https://github.com/nearai/ironclaw/security/advisories)", "The privacy policy (updated 4 September 2026) names Jasnah Inc., d/b/a NEAR AI, and covers ironclaw.com, agent.near.ai, the IronClaw framework and the IronHub catalogue. The home page says the product is built by NEAR Foundation (https://near.ai/privacy-policy; https://www.ironclaw.com/)", "IronHub entries are signed, and community entries marked New need `--acknowledge-unverified` on the CLI. The agent cannot install them from chat (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/hub/installing.mdx)" ], "area": "frameworks", "details": [ { "label": "Version", "value": "1.4.1 of 29 September 2026 (tag `ironclaw-v1.4.1`). 1.0.0 of 27 July 2026 was a ground-up rebuild with no migration from 0.29 (https://github.com/nearai/ironclaw/releases)" }, { "label": "Where it runs", "value": "A single binary on macOS, Linux and Windows, as a launchd or systemd user service, bound to 127.0.0.1:3000 by default. State sits under `~/.ironclaw/reborn` in embedded libSQL files, or PostgreSQL 15 or later for served deployments. NEAR AI also sells hosted instances at agent.near.ai, which we did not grade" }, { "label": "Approval controls", "value": "Each tool has a default permission of allow, ask or deny. Owners can set a tool to disabled, ask each time or always allow. Global auto-approve defaults to on and covers tools marked ask. Financial, approval-changing and budget-changing effects always ask (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/profile_gate.rs)" }, { "label": "Accounts and scopes", "value": "Gmail (`gmail.readonly`, `gmail.send`, `gmail.modify`), Google Calendar (`calendar.readonly`, `calendar.events`), Drive (`drive`, `drive.readonly`), Docs, Sheets, Slides, GitHub (49 tools), Slack user OAuth (14 scopes including `chat:write` and `search:read`), Telegram bot and linked personal account, Notion over MCP. The owner supplies their own Google OAuth client" }, { "label": "Credential storage", "value": "An encrypted secret store (AES-256-GCM per the README) with the master key in the OS keychain, or `IRONCLAW_REBORN_SECRET_MASTER_KEY` on a headless host. Tools never receive the secret. The host adds it to requests bound for declared hosts" }, { "label": "Memory", "value": "Workspace documents under paths such as `daily/` and `MEMORY.md`, with tools `ironclaw.memory.read`, `write`, `search`, `tree` and `profile_set`, all allowed by default. A mem0 backend is optional. No delete tool is declared, and the docs describe no deletion procedure beyond the local files" }, { "label": "Channels", "value": "Web interface, terminal (`ironclaw repl`, `ironclaw run`), Slack and Telegram, both by webhook over public HTTPS. Discord, Signal, WeChat and WeCom were in 0.x and are not in 1.x" }, { "label": "Model providers", "value": "More than twenty per the docs, among them NEAR AI (the default), Anthropic, OpenAI, Gemini, Bedrock, OpenRouter, Groq, Mistral and Ollama for local inference. Message content goes to whichever provider the owner selects" }, { "label": "Proactive work", "value": "Scheduled and triggered automations with a validated execution contract, a run-now action, background subagents and a per-user notification inbox for parked approvals" }, { "label": "API", "value": "OpenAI-compatible `POST /api/v1/responses` and `GET /api/v1/responses/{id}`, plus a raw `/v1/chat/completions` proxy. Bearer token, 30 requests per 60 seconds per user. No OpenAPI file in the repository" }, { "label": "MCP client", "value": "HTTP(S) JSON-RPC only, packaged as extensions. stdio is rejected. Registry entries for Asana, Cloudflare, Intercom, Linear, NEAR AI, Notion, Sentry and Stripe" }, { "label": "Sandbox", "value": "WASM extensions run in Wasmtime 48.0.3 with declared network targets and egress limits. A Docker sandbox with a per-user egress proxy is available on the local-Docker profile" }, { "label": "Telemetry", "value": "The README states no telemetry or analytics, and we found no analytics library in the source. Trace Commons uploads redacted traces only after opt-in to an endpoint the owner names" }, { "label": "Hosted plans", "value": "ironclaw.com lists Starter (shown as $5 beside $0 a month, 1 agent, $5 credits), Basic at $20 a month (2 agents) and Pro+ at $200 a month (5 agents) on NEAR AI Cloud" }, { "label": "Activity", "value": "12,648 stars, 1,363 open issues and 183 open pull requests on 12 October 2026. Last commit on `main` 10 September 2026, last release 29 September 2026" } ], "unitPrices": [ { "item": "Hosted Basic plan (2 agents, $20 credits)", "unit": "month", "usd": 20, "note": "NEAR AI Cloud, per ironclaw.com" }, { "item": "Hosted Pro+ plan (5 agents, $200 credits)", "unit": "month", "usd": 200, "note": "NEAR AI Cloud, per ironclaw.com" } ], "provenance": { "legalEntity": "Jasnah, Inc. d/b/a NEAR AI", "domain": "ironclaw.com", "domainRegistered": "2018-01-04", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://near.ai/privacy-policy", "statusPage": "", "changelog": "https://github.com/nearai/ironclaw/releases", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "The NEAR AI terms of service (updated 24 September 2026) name Jasnah, Inc. d/b/a NEAR AI under Delaware law and cover NEAR AI Cloud and its API. They do not mention IronClaw or agent hosting, so no terms link is set and the MIT or Apache-2.0 licence stands in for the self-hosted software.", "The privacy policy (updated 4 September 2026) lists ironclaw.com, agent.near.ai, the IronClaw framework and IronHub among what it covers.", "The ironclaw.com home page says Built by Near Foundation and its footer says by NEAR AI.", "security.txt answered 404 on www.ironclaw.com, docs.ironclaw.com and near.ai.", "RDAP for ironclaw.com gives a registration date of 2018-01-04 and Cloudflare, Inc. as registrar, last changed 2026-04-20.", "A self-hosted instance answers on its owner's own host. Hosted instances answer at \u003cinstance-id\u003e.agents.near.ai per the quickstart." ], "score": 71, "checks": [ { "check": "Legal entity named", "value": "Jasnah, Inc. d/b/a NEAR AI", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ironclaw.com, registered 2018-01-04 (8 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT OR Apache-2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://near.ai/privacy-policy", "state": "read", "readAt": "2026-10-12", "words": 4314, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy (“Privacy Policy” or “Policy”) explains how we collect, use, disclose, and store Personal Data about individuals (“you” or “User”) who interact with our websites, including www.near.ai, https://cloud.near.ai/, https://agent.near.ai/, https://www.ironclaw.com/, and https://hub.ironclaw.com/, (collec…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain Personal Data only for as long as needed to provide and secure the Services, or as required to comply with law.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We engage vendors and service providers to perform business purposes on our behalf, including analytics, hosting, payment processing, fraud prevention and security, customer support tools, email and communications services, and database and archival services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "8Your Rights8.1General Rights8.2Exercising Your Rights8.3Marketing Communications8.4Notice of Right to Opt Out of Sales and Targeted Advertising8.5Additional Rights for Users in the EEA, UK, and Other Applicable Jurisdictions" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "8Your Rights8.1General Rights8.2Exercising Your Rights8.3Marketing Communications8.4Notice of Right to Opt Out of Sales and Targeted Advertising8.5Additional Rights for Users in the EEA, UK, and Other Applicable Jurisdictions" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "You may exercise your rights through in-product settings where available, or by emailing us at privacy@near.ai or legal@near.ai.", "says": "privacy@near.ai" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "We may rely on European Commission-approved standard contractual clauses, UK International Data Transfer Addenda, or similar instruments.", "says": "Relies on standard contractual clauses" } ], "notes": [ { "date": "2026-10-08", "text": "Google user data reached through a connected integration is not used to train, retrain or fine-tune AI models.", "quote": "We do not use Google user data to train, retrain, or fine-tune any AI models." }, { "date": "2026-10-08", "text": "Google API responses are handled in memory during the active conversation and are not saved unless the user chooses to save them to the workspace.", "quote": "Google API responses are processed in-memory within your active conversation session and are not persisted to disk or database unless you explicitly choose to save information to your workspace." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ironclaw.json" } }