# IronClaw > IronClaw is an open-source personal AI assistant written in Rust by NEAR AI. The owner runs it as a local service with a web interface, Slack and Telegram channels, Google and GitHub extensions, scheduled automations and persistent memory. - Canonical: https://www.anchorterminal.com/tools/ironclaw - Markdown: https://www.anchorterminal.com/tools/ironclaw.md (~8,750 tokens) - Slim: https://www.anchorterminal.com/tools/ironclaw.min.md (~2,130 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/ironclaw.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-12 ## Overview **Grade B · 66.7/100 · rank #288 of 986 · #5 in Personal assistants · not agent-ready · confidence medium** ## Assessment Credentials stay in an encrypted store and are injected at the host boundary, and extensions declare per-tool permissions, network targets and OAuth scopes. The global auto-approve setting defaults to on in the 1.4.1 source, so tools marked ask, such as `gmail.send_message`, run unprompted until the owner turns it off. ## Facts | Field | Value | | --- | --- | | Vendor | NEAR AI (https://www.ironclaw.com) | | Kind | Agent harness | | Category | Personal assistants (https://www.anchorterminal.com/categories/personal-assistants) | | Transport | HTTP | | Auth | OAuth or key · `ironclaw onboard` writes a bearer token to `~/.ironclaw/reborn/webui-token` and prints a login link that carries it as a `token` query parameter. The same token authorises the web interface and the Responses API with operator rights. Multi-user deployments can add Google or GitHub single sign-on and per-user API tokens with owner, admin or member roles. Connected accounts use OAuth (Google, Slack), a Telegram pairing code, or keys held in the encrypted secret store. The web interface binds to 127.0.0.1:3000 unless `--host` is changed (https://docs.ironclaw.com/using/webui.md). | | Pricing | Freemium ($20 / mo) · Free to self-host under MIT or Apache-2.0, with model usage billed by whichever provider the owner selects, or nothing with Ollama. NEAR AI sells hosted instances on ironclaw.com as Starter (shown as $5 beside $0 a month, 1 agent, $5 credits), Basic at $20 a month (2 agents, $20 credits) and Pro+ at $200 a month (5 agents, $200 credits). The page does not say whether a card is needed. NEAR AI Cloud inference is priced per million tokens on near.ai/pricing (checked 2026-10-12). | | x402 | No · No x402, MPP or L402 in the docs or the release notes (checked 2026-10-12). | | Licence | MIT OR Apache-2.0 | | Source | https://github.com/nearai/ironclaw | | Docs | https://docs.ironclaw.com | | llms.txt | https://docs.ironclaw.com/llms.txt | | Last release | 2026-09-29 | | GitHub stars | 12,648 (as of 2026-10-12) | | Version | 1.4.1 of 29 September 2026 (tag `ironclaw-v1.4.1`). 1.0.0 of 27 July 2026 was a ground-up rebuild with no migration from 0.29 (https://github.com/nearai/ironclaw/releases) | | Where it runs | A single binary on macOS, Linux and Windows, as a launchd or systemd user service, bound to 127.0.0.1:3000 by default. State sits under `~/.ironclaw/reborn` in embedded libSQL files, or PostgreSQL 15 or later for served deployments. NEAR AI also sells hosted instances at agent.near.ai, which we did not grade | | Approval controls | Each tool has a default permission of allow, ask or deny. Owners can set a tool to disabled, ask each time or always allow. Global auto-approve defaults to on and covers tools marked ask. Financial, approval-changing and budget-changing effects always ask (https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/crates/kernel/ironclaw_approvals/src/profile_gate.rs) | | Accounts and scopes | Gmail (`gmail.readonly`, `gmail.send`, `gmail.modify`), Google Calendar (`calendar.readonly`, `calendar.events`), Drive (`drive`, `drive.readonly`), Docs, Sheets, Slides, GitHub (49 tools), Slack user OAuth (14 scopes including `chat:write` and `search:read`), Telegram bot and linked personal account, Notion over MCP. The owner supplies their own Google OAuth client | | Credential storage | An encrypted secret store (AES-256-GCM per the README) with the master key in the OS keychain, or `IRONCLAW_REBORN_SECRET_MASTER_KEY` on a headless host. Tools never receive the secret. The host adds it to requests bound for declared hosts | | Memory | Workspace documents under paths such as `daily/` and `MEMORY.md`, with tools `ironclaw.memory.read`, `write`, `search`, `tree` and `profile_set`, all allowed by default. A mem0 backend is optional. No delete tool is declared, and the docs describe no deletion procedure beyond the local files | | Channels | Web interface, terminal (`ironclaw repl`, `ironclaw run`), Slack and Telegram, both by webhook over public HTTPS. Discord, Signal, WeChat and WeCom were in 0.x and are not in 1.x | | Model providers | More than twenty per the docs, among them NEAR AI (the default), Anthropic, OpenAI, Gemini, Bedrock, OpenRouter, Groq, Mistral and Ollama for local inference. Message content goes to whichever provider the owner selects | | Proactive work | Scheduled and triggered automations with a validated execution contract, a run-now action, background subagents and a per-user notification inbox for parked approvals | | API | OpenAI-compatible `POST /api/v1/responses` and `GET /api/v1/responses/{id}`, plus a raw `/v1/chat/completions` proxy. Bearer token, 30 requests per 60 seconds per user. No OpenAPI file in the repository | | MCP client | HTTP(S) JSON-RPC only, packaged as extensions. stdio is rejected. Registry entries for Asana, Cloudflare, Intercom, Linear, NEAR AI, Notion, Sentry and Stripe | | Sandbox | WASM extensions run in Wasmtime 48.0.3 with declared network targets and egress limits. A Docker sandbox with a per-user egress proxy is available on the local-Docker profile | | Telemetry | The README states no telemetry or analytics, and we found no analytics library in the source. Trace Commons uploads redacted traces only after opt-in to an endpoint the owner names | | Hosted plans | ironclaw.com lists Starter (shown as $5 beside $0 a month, 1 agent, $5 credits), Basic at $20 a month (2 agents) and Pro+ at $200 a month (5 agents) on NEAR AI Cloud | | Activity | 12,648 stars, 1,363 open issues and 183 open pull requests on 12 October 2026. Last commit on `main` 10 September 2026, last release 29 September 2026 | | Capabilities | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | | Tags | open-source, self-hosted, rust, wasm, telegram, slack, gmail, mcp, hosted-option, llms-txt | | JSON | https://www.anchorterminal.com/api/v1/tools/ironclaw.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-12 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 67 | 13.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 74 | 12.0 | | Agent ergonomics | 13% | 16.2 | 69 | 11.2 | | Security & auth | 14% | 17.5 | 66 | 11.6 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 74 | 6.5 | | Transparency & trust (editorial 79, provenance 71) | 7% | 8.8 | 75 | 6.6 | | Negative events | up to −15 | up to −15 | 2026-10-12. The ironclaw.com home page lists Discord and Signal among integrations, while the channel docs for the current release say Discord, Signal, WeChat and WeCom are not part of the 1.0 release, which shipped on 27 July 2026. The docs site also says it documents the latest stable release while its heartbeat, cron, shell and WASM pages name settings absent from the 1.4.1 source. A misleading claim, at the minimum, -2. https://www.ironclaw.com/; https://docs.ironclaw.com/channels/overview.md; https://github.com/nearai/ironclaw/blob/ironclaw-v1.4.1/docs/capabilities/routines/heartbeat.mdx | -2 | | **Total** | | | | **66.7 → B** | ### Why each score - Reliability 67: Read with the local-software lines, as the Goose and OpenHands dossiers are. GitHub releases carry shell, PowerShell and MSI installers for seven targets, and source builds need Rust 1.96 and Node.js 22 (20). Push runs on `main` that we saw, dated 3 to 5 September 2026, passed Code Style, Reborn E2E and Platform & Compat and failed Tests (Reborn) and Code Coverage on all five commits. A scheduled Live Canary run failed on 1 October (10 of 25). 1,363 open issues and 183 open pull requests on 12 October. Reports filed since mid-September show no comments, among them a start-up failure (#8122) and a silent web chat status bug (#8124) (8 of 25). CHANGELOG.md follows Keep a Changelog and semantic versioning, with upgrade sections that name removed settings and the Slack re-consent in 1.3.0, and the 1.0.0 entry states there is no migration from 0.29 (14 of 15). 1.4.1 is a stable 1.x release (15). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 74: Harness reading, as for Goose. Extension manifests are typed (`manifest.toml` with a JSON Schema reference per tool), and the Responses API follows the OpenAI wire format with a contract test, but the repository has no OpenAPI file (18 of 25). llms.txt with Markdown twins at docs.ironclaw.com (10). Tool descriptions say when not to use a tool (`gmail.send_message` warns against using it for the final reply), but the heartbeat, cron, shell and WASM pages of the published docs name settings that are absent from the 1.4.1 source, and the quickstart gives two different token paths (9 of 20). Permissions, effects and origin gates are enums, and network targets and scopes are declared per tool (12 of 15). The Responses page lists status codes 400, 429 and 503 with an error envelope and troubleshooting steps (10 of 15). Dated changelog in the repository and on the docs site, which says it tracks the latest stable release (15). - Agent ergonomics 69: Harness reading, scored on what a caller driving it has to supply. Extensions install one at a time, but GitHub alone declares 49 tools and turn-0 tool selection is still an open proposal (#8113) (15 of 25). Context compaction, a resource governor, a cap on autonomous wakes and bounded finalisation are in the release notes. No cost cap was found in the docs (15 of 20). `ironclaw run --message` and the Responses API serve scripts, with `previous_response_id` for state, but approval and OAuth gates fail the turn over the API (14 of 20). Lease expiry recovers safe runs, an unavailable tool call is repaired, and parked approvals persist in a notification inbox (16 of 20). One binary with guided onboarding and an OpenAI-compatible endpoint, no SDK of its own, and auto-approve on by default (9 of 15). - Security & auth 66: Harness reading of the framework checklist, as for Goose and OpenHands. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The README states no telemetry, we found no analytics library in the 1.4.1 source, and Trace Commons is opt-in with no default endpoint. Message content goes to the chosen model provider (28). Tools carry allow, ask or deny defaults, owners can disable a tool or force a prompt each time, WASM tools run in Wasmtime with declared network targets, secrets are injected outside the sandbox, and the web interface binds to loopback. Against that, global auto-approve defaults to on and covers tools marked ask, so sends, trashes and deletes run unprompted, and only financial, approval and budget effects always ask. The published docs do not state that default (11 of 20). Channel context is framed as untrusted quoted content, a leak detector scans traffic for secret patterns, and tool output is wrapped, per the security page and release notes (12 of 15). Metadata-only audit events for approvals, run transcripts, and an operator debug inspector with sanitised tool arguments (11 of 15). No SECURITY.md, no security.txt on ironclaw.com, docs.ironclaw.com or near.ai, no published GitHub advisory and no bounty found. The 1.4.1 notes do record the Wasmtime security update (4 of 20). - Payments & pricing 60: Read with the self-hosted rule, scoring the hosted option where one is sold. No payment protocol (0). ironclaw.com shows three monthly plans for hosted instances without a login and near.ai/pricing lists per-token inference prices (20). The software is free under MIT or Apache-2.0 and runs with a local Ollama model (20). An agent can install and run it with no sign-up (20). The Starter plan shows $5 beside $0 and the page does not say whether a card is needed. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 74: 1.4.1 was published on 29 September 2026, 13 days before this check (30). Six stable releases in the last 90 days, from 1.0.0 on 27 July to 1.4.1 (20). Responsiveness is weak on the evidence we saw. The `main` branch has no commit after 10 September, issue numbers moved from #8072 to #8131 in a month, and the reports filed since mid-September have no comments (8 of 25). Release binaries for seven targets are current, though we confirmed no package-manager listing (10 of 15). Dependabot runs weekly and the Wasmtime fix shipped, but Tests (Reborn) was failing on `main` when we looked (6 of 10). - Transparency & trust 75: MIT or Apache-2.0, with the whole runtime in one public repository (30). The NEAR AI privacy policy of 4 September 2026 covers the IronClaw framework and agent hosting and names PostHog and Stripe, with no retention periods. The release notes state what the Telegram link retains. The home page credits NEAR Foundation while the legal documents name Jasnah, Inc. d/b/a NEAR AI (17 of 30). Removals are dated in the changelog with upgrade steps, and the docs note the channels dropped in 1.0, with no written deprecation policy (12 of 20). No telemetry per the README and the source, and the one upload path, Trace Commons, is documented as opt-in with local preview and revocation (20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (24 items): https://www.anchorterminal.com/fixes/ironclaw.md (JSON https://www.anchorterminal.com/fixes/ironclaw.json) ### What we couldn't check - Kind is harness. The briefs define no assistant kind, and a self-hosted agent program the owner runs is closest to the harness listings (Goose, OpenHands), so the harness readings of Schema, Ergonomics and Security were used - Whether development has paused or moved. `main` has no commit after 10 September 2026 while the repository's last push was 11 October and 1.4.1 shipped from another branch - Whether the web interface tells a new owner that auto-approve is on. The default was read from the source, and the software was not run - Whether heartbeat exists in 1.x under another name. The docs page describes it with settings the 1.4.1 source does not contain - Unchecked: the hosted service at agent.near.ai, its sign-up, card requirement and what the Starter plan costs. Nothing was sent to it - Unchecked: trust.near.ai and any certification for NEAR AI Cloud - Unchecked: whether GitHub private vulnerability reporting is enabled for the repository - Unchecked: crates.io, npm, Homebrew and the MCP registry were not searched for an IronClaw package - Unchecked: how memory is deleted. No delete tool is declared and the docs describe none - The NEAR AI terms forbid automated extraction of data and outputs except through the published APIs. Recorded as a fact with no deduction, and it matters before any probe is run - The privacy policy and terms were read through a summarising reader, so their wording should be checked before any clause is quoted - The repository was cloned before github.com's robots.txt was read. The clone path is not one that file disallows for Anthropic agents ### Sources - home page, hosted plans and integrations: (seen 2026-10-12) - repository and README: (seen 2026-10-12) - releases: (seen 2026-10-12) - changelog at 1.4.1: (seen 2026-10-12) - auto-approve default: (seen 2026-10-12) - approval gate order: (seen 2026-10-12) - always-ask effects: (seen 2026-10-12) - Gmail extension manifest: (seen 2026-10-12) - Slack extension manifest: (seen 2026-10-12) - memory extension manifest: (seen 2026-10-12) - docs index for agents: (seen 2026-10-12) - security docs (source): (seen 2026-10-12) - web interface docs (source): (seen 2026-10-12) - channel docs (source): (seen 2026-10-12) - Responses API docs (source): (seen 2026-10-12) - storage docs (source): (seen 2026-10-12) - MCP docs (source): (seen 2026-10-12) - Trace Commons docs (source): (seen 2026-10-12) - heartbeat docs (source): (seen 2026-10-12) - inference providers docs (source): (seen 2026-10-12) - IronHub install docs (source): (seen 2026-10-12) - repository metadata (GitHub API): (seen 2026-10-12) - security advisories (GitHub API, none published): (seen 2026-10-12) - workflow runs on main (GitHub API): (seen 2026-10-12) - open issues: (seen 2026-10-12) - NEAR AI privacy policy: (seen 2026-10-12) - NEAR AI terms of service: (seen 2026-10-12) - NEAR AI Cloud pricing: (seen 2026-10-12) - RDAP record for ironclaw.com: (seen 2026-10-12) ## Who's behind it (provenance 71/100, checked 2026-10-12) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Jasnah, Inc. d/b/a NEAR AI | 20/20 | | Domain age | ironclaw.com, registered 2018-01-04 (8 years) | 11/15 | | Endpoint on the vendor's domain | no hosted endpoint | n/a | | Terms of service | nothing hosted, so the MIT OR Apache-2.0 licence stands in | 10/10 | | Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The NEAR AI terms of service (updated 24 September 2026) name Jasnah, Inc. d/b/a NEAR AI under Delaware law and cover NEAR AI Cloud and its API. They do not mention IronClaw or agent hosting, so no terms link is set and the MIT or Apache-2.0 licence stands in for the self-hosted software. The privacy policy (updated 4 September 2026) lists ironclaw.com, agent.near.ai, the IronClaw framework and IronHub among what it covers. The ironclaw.com home page says Built by Near Foundation and its footer says by NEAR AI. security.txt answered 404 on www.ironclaw.com, docs.ironclaw.com and near.ai. RDAP for ironclaw.com gives a registration date of 2018-01-04 and Cloudflare, Inc. as registrar, last changed 2026-04-20. A self-hosted instance answers on its owner's own host. Hosted instances answer at .agents.near.ai per the quickstart. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The MIT OR Apache-2.0 licence stands in and the check scores in full. **Privacy policy** (https://near.ai/privacy-policy), read 2026-10-12, gives no date, states 7 of the 8 things a reader expects. - Not found in the text. Gives the date it was last updated. - Says how long data is kept. For as long as needed, with no period named. - Gives a privacy contact. privacy@near.ai. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-10-08). Google user data reached through a connected integration is not used to train, retrain or fine-tune AI models. "We do not use Google user data to train, retrain, or fine-tune any AI models." - Also in the text (2026-10-08). Google API responses are handled in memory during the active conversation and are not saved unless the user chooses to save them to the workspace. "Google API responses are processed in-memory within your active conversation session and are not persisted to disk or database unless you explicitly choose to save information to your workspace." ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Hosted Basic plan (2 agents, $20 credits) | $20 | per month (plan) | NEAR AI Cloud, per ironclaw.com | | Hosted Pro+ plan (5 agents, $200 credits) | $200 | per month (plan) | NEAR AI Cloud, per ironclaw.com | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - Dual MIT or Apache-2.0 licence, with installers for seven targets on GitHub releases and no account needed to run it - Each extension tool declares a default permission, effects, network targets and OAuth scopes in `manifest.toml`. Gmail reads use `gmail.readonly` and sends use `gmail.send` - Secrets are encrypted with AES-256-GCM per the README, with the master key in the OS keychain, and are injected into requests outside the sandbox - No analytics library was found in the 1.4.1 source. Trace Commons is opt-in and has no default endpoint - Six stable releases between 27 July and 29 September 2026, each with dated notes and upgrade steps ## Weaknesses - Global auto-approve defaults to on in the 1.4.1 source, so tools marked ask (send, trash, delete) run without a prompt. Only financial, approval and budget effects always ask - The `main` branch has had no commit since 10 September 2026, and open reports filed since mid-September show no replies. 1,363 issues and 183 pull requests are open - Docs pages for heartbeat, cron, shell and WASM limits name settings such as `HEARTBEAT_ENABLED` and `ALLOW_LOCAL_TOOLS` that do not appear in the 1.4.1 source - No SECURITY.md, security.txt or published GitHub advisory was found - The home page lists Discord and Signal integrations, while the channel docs say both are not part of the 1.0 release ## Before you call it (notes for agents) 1. Open Settings and turn off global auto-approve, or set send and delete tools to ask each time, before connecting mail or chat accounts 2. Install with the release installer and run `ironclaw onboard`. 1.x does not migrate 0.29 data, so use a fresh home directory 3. Call `POST /api/v1/responses` with the bearer token from `~/.ironclaw/reborn/webui-token`. Keep under 30 requests in 60 seconds 4. Resolve approval and OAuth gates in the web interface. The Responses API fails the turn instead of surfacing them 5. Connect MCP servers over HTTP only. The stdio transport is rejected ## Connect Install: ```bash IRONCLAW_RELEASE_TAG=ironclaw-v1.4.1 curl --proto '=https' --tlsv1.2 -LsSf "https://github.com/nearai/ironclaw/releases/download/${IRONCLAW_RELEASE_TAG}/ironclaw-installer.sh" | sh ironclaw onboard ``` ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | ZeroClaw | BB | 70.2 | 161 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/zeroclaw.md | | NanoClaw | B | 68.3 | 229 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | no | https://www.anchorterminal.com/tools/nanoclaw.md | | Hermes Agent | B | 67.9 | 244 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/hermes-agent.md | | OpenClaw | B | 67.1 | 270 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/openclaw.md | | nanobot | B | 62.4 | 446 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | no | https://www.anchorterminal.com/tools/nanobot.md | | QwenPaw | B | 62.2 | 454 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | no | https://www.anchorterminal.com/tools/qwenpaw.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The global auto-approve setting defaults to on (`AUTO_APPROVE_DEFAULT_ENABLED: bool = true`, with the comment that new users are not prompted per tool call), and it applies to tools whose default permission is ask (source: ) - Only effects of kind Financial, ModifyApproval and ModifyBudget always need a fresh approval. No bundled extension tool declares a financial effect (source: ) - `gmail.send_message`, `gmail.reply_to_message`, `gmail.create_draft` and `gmail.trash_message` are marked ask, and `gmail.list_messages` and `gmail.get_message` are marked allow, each with its own OAuth scope (source: ) - 1.0.0 of 27 July 2026 replaced the 0.29 line with a rebuilt runtime. Its notes say there is no migration for config, databases, settings or secrets (source: ) - The channel docs say Discord, Signal, WeChat and WeCom are not part of the 1.0 release, while the home page lists Discord and Signal among integrations (source: , ) - 1.4.1 moved Wasmtime and WASI to 48.0.3 to fix guest fuel accounting vulnerabilities (source: ) - A paired personal Telegram account lets the agent read conversations and act as the owner. The 1.3.0 notes say no mirror of the history is kept, and that content read in a run stays in that run's transcript (source: ) - The Responses API does not surface approval or OAuth gates. A turn that reaches one fails with an error that points to the web interface (source: ) - The docs pages for heartbeat, cron routines, shell and WASM limits name `HEARTBEAT_ENABLED`, `ROUTINES_ENABLED`, `ALLOW_LOCAL_TOOLS` and `WASM_FUEL_LIMIT`. None of these strings appears in the Rust source at the 1.4.1 tag (source: ) - The `main` branch head is a commit of 10 September 2026, and its CHANGELOG.md stops at 1.3.0. Releases 1.4.0 and 1.4.1 were cut on other branches (source: ) - The GitHub API returned no published security advisories for the repository, and the repository has no SECURITY.md at its root (source: ) - The privacy policy (updated 4 September 2026) names Jasnah Inc., d/b/a NEAR AI, and covers ironclaw.com, agent.near.ai, the IronClaw framework and the IronHub catalogue. The home page says the product is built by NEAR Foundation (source: , ) - IronHub entries are signed, and community entries marked New need `--acknowledge-unverified` on the CLI. The agent cannot install them from chat (source: ) - #5 of 20 in Best AI personal assistants that act for one person: https://www.anchorterminal.com/best/personal-assistants/index.md - All 190 assistants comparisons: https://www.anchorterminal.com/compare/personal-assistants/index.md ## Compare - [AstrBot vs IronClaw](https://www.anchorterminal.com/compare/astrbot-vs-ironclaw.md): C 58.8 vs B 66.7 - [CowAgent vs IronClaw](https://www.anchorterminal.com/compare/cowagent-vs-ironclaw.md): C 58.5 vs B 66.7 - [GAIA vs IronClaw](https://www.anchorterminal.com/compare/gaia-vs-ironclaw.md): D 49.5 vs B 66.7 - [Gemini Spark vs IronClaw](https://www.anchorterminal.com/compare/gemini-spark-vs-ironclaw.md): F 24.5 vs B 66.7 - [Grok Bot vs IronClaw](https://www.anchorterminal.com/compare/grok-bot-vs-ironclaw.md): E 45.2 vs B 66.7 - [Haven vs IronClaw](https://www.anchorterminal.com/compare/haven-vs-ironclaw.md): F 22.2 vs B 66.7 - [Hermes Agent vs IronClaw](https://www.anchorterminal.com/compare/hermes-agent-vs-ironclaw.md): B 67.9 vs B 66.7 - [Instinct vs IronClaw](https://www.anchorterminal.com/compare/instinct-vs-ironclaw.md): F 11.4 vs B 66.7 - [IronClaw vs Leon](https://www.anchorterminal.com/compare/ironclaw-vs-leon.md): B 66.7 vs E 41 - [IronClaw vs Lindy](https://www.anchorterminal.com/compare/ironclaw-vs-lindy.md): B 66.7 vs F 32.3 - [IronClaw vs nanobot](https://www.anchorterminal.com/compare/ironclaw-vs-nanobot.md): B 66.7 vs B 62.4 - [IronClaw vs NanoClaw](https://www.anchorterminal.com/compare/ironclaw-vs-nanoclaw.md): B 66.7 vs B 68.3 - [IronClaw vs Dots](https://www.anchorterminal.com/compare/ironclaw-vs-openai-dots.md): B 66.7 vs F 28.3 - [IronClaw vs OpenClaw](https://www.anchorterminal.com/compare/ironclaw-vs-openclaw.md): B 66.7 vs B 67.1 - [IronClaw vs PicoClaw](https://www.anchorterminal.com/compare/ironclaw-vs-picoclaw.md): B 66.7 vs D 46.1 - [IronClaw vs Poke](https://www.anchorterminal.com/compare/ironclaw-vs-poke.md): B 66.7 vs F 37.6 - [IronClaw vs QwenPaw](https://www.anchorterminal.com/compare/ironclaw-vs-qwenpaw.md): B 66.7 vs B 62.2 - [IronClaw vs ZeroClaw](https://www.anchorterminal.com/compare/ironclaw-vs-zeroclaw.md): B 66.7 vs BB 70.2 - [IronClaw vs Zo Computer](https://www.anchorterminal.com/compare/ironclaw-vs-zo-computer.md): B 66.7 vs E 43.1 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on ironclaw.com or one of its subdomains, or the README of github.com/nearai/ironclaw. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "ironclaw", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html IronClaw on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![IronClaw on Anchor Terminal](https://www.anchorterminal.com/badges/ironclaw.svg)](https://www.anchorterminal.com/tools/ironclaw) ``` Plain link: ```html IronClaw on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say IronClaw is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/ironclaw-dark.png - Light: https://www.anchorterminal.com/assets/share/ironclaw-light.png