IronClaw vs nanobot

IronClaw

Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as gmail.send_message, run unprompted until the owner turns it off.

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

IronClaw

1. Open Settings and turn off global auto-approve, or set send and delete tools to ask each time, before connecting mail or chat accounts
2. Install with the release installer and run ironclaw onboard. 1.x does not migrate 0.29 data, so use a fresh home directory
3. Call POST /api/v1/responses with the bearer token from ~/.ironclaw/reborn/webui-token. Keep under 30 requests in 60 seconds
4. Resolve approval and OAuth gates in the web interface. The Responses API fails the turn instead of surfacing them
5. Connect MCP servers over HTTP only. The stdio transport is rejected

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat