Get an audit

Head to head · Assistant proactive · October 2026 research run

IronClaw vs OpenClaw

OpenClaw and IronClaw score within a point of each other on agent readiness, 67.1 (B) and 66.7 (B). IronClaw leads on transparency & trust. Both do assistant proactive.

Best AI personal assistants that act for one person · All 190 assistants comparisons

IronClawNEAR AI · Agent harness B66.7/100#288 of 986 OpenClawOpenClaw Foundation · Agent harness B67.1/100#270 of 986

Which one, for what

IronClaw B

Best for One technical owner who wants a self-hosted assistant over Gmail, Calendar, Slack and Telegram with credentials kept out of the model's reach.

Ahead on

  • Transparency & trust, 75 against 68

Watch for

Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask

OpenClaw B

Best for A technical owner who wants an assistant on their own machine across many chat apps, with their choice of model and files they can read and delete.

Ahead on

  • Reliability, 75 against 67
  • Schema & documentation, 84 against 74
  • Agent ergonomics, 77 against 69
  • Security & auth, 74 against 66
  • Maintenance & community, 86 against 74

Watch for

Without configuration the default is full access. Host exec runs with no approval and sandboxing is off

Score by category

CategoryWeight this runIronClawOpenClawEdge
Reliability16%206775OpenClaw +8
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27484OpenClaw +10
Agent ergonomics13%16.26977OpenClaw +8
Security & auth14%17.56674OpenClaw +8
Payments & pricing10%12.56060even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87486OpenClaw +12
Transparency & trust7%8.87568IronClaw +7
Negative events≤15-2-8
TotalB 66.7/100B 67.1/100

Facts side by side

FactIronClawOpenClaw
KindAgent harnessAgent harness
VendorNEAR AIOpenClaw Foundation
Hosted endpointno (local only)no (local only)
TransportsHTTP
AuthOAuth or keyOAuth or key
PricingFreemiumFree
x402nono
LicenceMIT OR Apache-2.0MIT
Read-only variant documentednoyes
llms.txtyesyes
Last release2026-09-292026-10-12
Terms last updatedno document linkedno document linked
Privacy policy last updatedno date givenno document linked
Customer content may train models
Terms restrict automated access
Terms restrict benchmarking
Terms or service can change without notice
Arbitration or class-action waiver
Popularity13k stars392k stars

Verdicts

IronClaw

Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as gmail.send_message, run unprompted until the owner turns it off.

OpenClaw

Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

Before you call either

IronClaw

  1. Open Settings and turn off global auto-approve, or set send and delete tools to ask each time, before connecting mail or chat accounts
  2. Install with the release installer and run ironclaw onboard. 1.x does not migrate 0.29 data, so use a fresh home directory
  3. Call POST /api/v1/responses with the bearer token from ~/.ironclaw/reborn/webui-token. Keep under 30 requests in 60 seconds
  4. Resolve approval and OAuth gates in the web interface. The Responses API fails the turn instead of surfacing them
  5. Connect MCP servers over HTTP only. The stdio transport is rejected

OpenClaw

  1. Set a session permission mode of guarded or workspace, or tools.exec.mode, before connecting mail. The default runs host commands without approval
  2. Turn on agents.defaults.sandbox for any agent that reads mail, web pages or attachments. Sandboxing is off by default
  3. Set tools.message.crossContext.allowAcrossProviders and allowWithinProvider to false to confine sends to the current conversation
  4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny gateway, cron, sessions_spawn and sessions_send for it
  5. Run openclaw security audit after setup, and treat the Gateway token as an owner credential. POST /tools/invoke accepts it with full operator access

Questions

Which is better for AI agents, IronClaw or OpenClaw?

OpenClaw and IronClaw score within a point of each other on agent readiness, 67.1 (B) and 66.7 (B). IronClaw leads on transparency & trust.

Are IronClaw and OpenClaw open source?

Yes. IronClaw is open source (MIT OR Apache-2.0). OpenClaw is open source (MIT).

Other comparisons with IronClaw or OpenClaw

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report