Run autonomous AI assistants on infrastructure you control, reachable from the chat apps you already use. Every agent runs sealed off from the network and cannot change its own configuration without a human approving it. Isolation you can prove, not just promise.
Open source, self-hosted, and built to be verified. If the threat model earns it, give it a star or browse the examples.
$ git clone https://github.com/IronSecCo/ironclaw.git && cd ironclaw && \
bash container/build.sh && docker compose -f docker-compose.demo.yml up --build -d
Zero credentials. No model key. Then open http://127.0.0.1:8787/ui/
and say hi — a real per-session sandbox launches and replies. Requires only Docker.
Most ways to run an AI agent assume the agent is trustworthy. IronClaw assumes the opposite — that the agent, and the box it runs on, could be compromised at any moment — and builds hard, provable walls anyway. You get the same "talk to it in Slack, it gets work done" experience, without handing an LLM a shell on your machine.
Each agent runs with network=none in a gVisor (runsc)
sandbox — read-only rootfs, dropped capabilities, no host network. It reaches the model
only through a host-side proxy it never holds the key to.
An agent cannot change its own persona, tools, packages, wiring, permissions, or mounts. Every capability change is held at a deterministic gateway until a human approves it, and every decision lands in an append-only audit log.
Every release is re-derivable from a known commit and ships cosign signatures, SBOMs
(SPDX + CycloneDX), and build-provenance attestations. Installers verify the
SHA256SUMS manifest before executing anything.
Talk to it where you already work — 12 channel adapters (Slack, Discord, Telegram, and more). Bring your own model: Anthropic, OpenAI, Bedrock, Azure, Gemini, Vertex, OpenRouter, and local Ollama.
A message arrives over a channel you connected (Slack, Discord, Telegram, …). The control-plane spins up a fresh, per-conversation sandbox to handle it.
Inside a network=none gVisor sandbox, the agent reads, writes, schedules,
and drafts a reply. It reaches the model only through the host proxy, and the outside
world only through an audited, broker-mediated egress allowlist.
Anything that would change what the agent can do is parked at the approval gateway. You approve or reject; the result is applied and written to the audit log. Nothing bypasses that choke point.
message → gateway (HELD) → approve → applied → audit log
network=none per-session sandboxes; model access via host proxy only.runsc) seal in production — read-only rootfs, dropped caps, nosuid,nodev,noexec.SHA256SUMS, SBOMs (SPDX + CycloneDX), and SLSA build-provenance; installers verify before executing."A release a user cannot verify is not a secured release." — the bar IronClaw holds itself to
The fastest way to believe any of this is to watch an agent reply on your own machine. The
offline mock-agent runs the full engage → sandbox → reply path
with no model key and no account — it launches a real per-conversation sandbox container and
routes the reply back through the encrypted per-session queue.
prefers-reduced-motion.git clone https://github.com/IronSecCo/ironclaw.git && cd ironclaw
bash container/build.sh # build the sandbox image once (~1–2 min)
docker compose -f docker-compose.demo.yml up --build -d # start the demo control-plane
Then open http://127.0.0.1:8787/ui/ → Chat tab → "Mock Agent (offline)" → say
hi. If prompted for a token, paste ironclaw-demo. Tear down with
docker compose -f docker-compose.demo.yml down.
The demo relaxes the seal for convenience — it uses runc (shared host kernel), not gVisor,
and a well-known token. The approval gateway, encrypted per-session queues, and host-side
credential custody are unchanged. The production docker compose up is the
hardened, gVisor posture.
Where the clip above stops at "it replies," this one keeps going: the one credential step (the key stays host-side), then a first real agent task — held at the approval gateway, approved by a human, and written to the append-only audit log.
prefers-reduced-motion.Yes — IronClaw is open source under AGPLv3, with a commercial license available for teams that can't meet AGPL's terms. Self-hosting needs no account and no payment.
Model credentials are held host-side only and never enter a sandbox. The demo needs no key at all; a real agent reaches a provider through the host proxy.
The full gVisor (runsc) seal is Linux-only. The whole host
side runs natively on macOS, but a real agent sandbox there falls back to runc inside
Docker Desktop's Linux VM — a weaker, kernel-shared boundary. Run production on Linux.
It's alpha. The control-plane, gateway, and encrypted-queue core have real coverage (800+ Go tests plus a black-box parity suite); channel adapters, some tools, and a live sandbox launch are exercised more lightly. Don't point it at anything you can't afford to lose yet.
Every release ships cosign signatures, SBOMs, and build-provenance attestations, and the
installers verify the SHA256SUMS manifest before running anything. The
release runbook walks through verifying it yourself.
Most frameworks trust the agent. IronClaw seals it off from the network and makes every capability change pass a human approval gateway. See the comparison page.
One command, no credentials. If you like what you see, the production path is Linux + gVisor — and every step of it is documented.
Read the comparison →