IronClaw for Windows is an open-source Agent OS written in Rust, built for people who want an agent environment that keeps their data on their own computer. It suits privacy-minded users, developers and anyone who wants to read and audit the software they run. The project is distributed under the MIT license and is free to use on Windows.
The focus is on privacy, security and extensibility. IronClaw pairs a WASM sandbox with an encrypted vault and multi-channel support, so you can add capabilities without handing your information to a vendor. The most recent code update is dated September 10, 2026. The newest tagged build, ironclaw-v1.4.1-rc.2, is a release candidate, so expect it to still be settling.
What Is an Agent OS, and Where Does IronClaw Fit?
An agent OS is a software layer that runs AI-driven agents: programs that can take steps, call tools and respond to events on your behalf. Think of it as the environment that schedules that work, controls what each agent can touch, and connects it to the places where you communicate.
IronClaw takes this idea and puts privacy and security at the center. Instead of treating the agent as a cloud service that holds your data, it treats your machine as the home base. Information is stored locally, and the security layers are meant to limit what an agent can do even when it processes untrusted text.
This matters because agents read a lot of material from the outside world, such as web pages, emails and documents. Any of those can contain instructions meant to hijack the agent, which is why prompt injection is a central concern for this category. Understanding that risk helps you judge whether an agent platform is worth running on your own computer.
Real-World Scenarios for a Privacy-Focused Agent
Consider a freelance developer who wants an assistant to sort project notes, draft replies and keep track of API credentials. Keeping those credentials in an encrypted local vault is more comfortable than pasting them into a hosted chat service.
A small team might use IronClaw to build internal tools that fit its own workflow. Because new tools can be created without waiting for a vendor release cycle, the team can adjust quickly when a process changes.
A security-minded user may simply want to read the code before trusting it. The MIT-licensed source is public, so the review can start with the parts that handle storage and sandboxing. Even if you never modify anything, that openness is a practical feature.
The common thread is control. You decide what runs, where data lives and which tools exist.
How the Sandbox, Vault and Channels Work Together
A WASM sandbox is a restricted execution environment. WebAssembly code runs in an isolated space with only the capabilities it has been granted, so a tool that misbehaves cannot easily read unrelated files or reach the network. This boundary matters most when a tool comes from a source you did not write yourself.
An encrypted vault is where sensitive values are kept in scrambled form. Even if someone gains access to the storage file, the contents remain unreadable without the key. Encryption reduces risk but does not replace good habits, such as keeping your operating system updated and limiting who can log in to your PC.
Multi-channel support means the agent can receive requests and deliver results through more than one channel. That flexibility is convenient, but every channel is another entry point, so it is worth knowing which channels you have enabled.
Key features
Local, Encrypted Data Storage
Auditable, Open-Source Code
Tools You Can Build Yourself
Defense in Depth
How to install IronClaw on Windows
- 1
Choose the release tag
Open the Releases page of the project's GitHub repository and pick an ironclaw-v tag. Replace X.Y.Z in the install command with the version you selected, and include any prerelease suffix such as rc.2 if the tag has one. Download only from the official website or the GitHub Releases page.
- 2
Pick an installer for Windows
Use the Windows Installer for a standard setup, or run the PowerShell script if you prefer a scripted installation. The shell script is intended for macOS, Linux and Windows Subsystem for Linux (WSL), so use it only if you are working inside WSL.
-
Verify and run
Before running the file, compare its SHA-256 checksum or signature with the values published for that release, as described in the safety section. Then run the installer and follow the prompts. Once installed, launch IronClaw and confirm that the version matches the tag you chose.
How to use IronClaw
After installation, the workflow is mostly about setting boundaries and then letting the agent work inside them. Follow these steps for a first session:
- Launch IronClaw using the method you installed.
- Read the repository documentation for the current release, since a release candidate may change its setup flow.
- Store only the secrets you actually need inside the encrypted vault, and keep a separate offline record of any recovery information.
- Start with a small, low-risk task so you can see which tools and channels the agent uses.
- Review what the agent did and produced after each session before enabling anything broader.
Repeat the review whenever you add a new tool, because each addition widens what the agent can reach.
Pros & cons
- Free, MIT-licensed and open source
- Data stored locally and encrypted by design
- Source code can be audited on GitHub
- Multiple security layers against prompt injection and data exfiltration
- Lets you build new tools without waiting for vendor updates
- Available on Windows, macOS, Linux and Docker
- Latest tagged build is a release candidate
- Broad Agent OS scope may feel heavy for simple tasks
- The shell script route requires WSL on Windows
Is IronClaw safe?
IronClaw's code was last updated on September 10, 2026, so it is not abandoned. It still handles an encrypted vault and sensitive values, so treat it with care. Get it only from the official website or the GitHub Releases page for the nearai/ironclaw repository. Compare the file's SHA-256 checksum, or verify its signature if one is published, before running anything. Never enter a seed phrase, private key or vault passphrase on a third-party website, and be wary of tutorials that ask you to. Because the newest tag is a release candidate, check the latest version on the official website before installing.
- Official source only. Download from github.com/nearai/ironclaw. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
IronClaw sits in the Keys & Seed Tools category, but it is a different kind of product from most entries there. Ian Coleman BIP39 Tool is a focused offline utility for working with BIP39 seed phrases, and it is meant to run on an isolated computer. IronClaw is a broad Agent OS, so it suits people who want an agent environment rather than a single-purpose tool. PaperVault concentrates on printed, encrypted backups, while VanitySearch and Vaniton each generate vanity addresses for one network. John the Ripper is aimed at recovering a password to your own wallet. If you need one tool for a single seed task, pick a specialist. If you want a privacy-focused agent platform, IronClaw is the closer match.
Specifications
- Price
- Free
- Type
- Open source
- License
- MIT
- Latest version
- ironclaw-v1.4.1-rc.2
- Last update
- 10 Sept 2026
- Windows support
- Yes (Windows build or installer)
- Source code
- github.com/nearai/ironclaw
Frequently asked questions
Yes. IronClaw is free and released under the MIT license, which allows use, copying and modification under its terms. It is available as a Windows build or installer, and the source code is published on GitHub, so you can read it before installing. There is no price to pay for the software itself.
It is designed with privacy and security in mind: data is stored locally and encrypted, a WASM sandbox isolates tools, and the code is open for review. Safety still depends on how you install it. Verify the SHA-256 checksum or signature, keep seed phrases and passwords away from third-party sites, and review which tools you enable. The safety section covers the full checklist.
Yes. The Windows Installer and the PowerShell script are both Windows-native routes, so you do not need WSL for either of them. The shell script is meant for macOS, Linux and Windows Subsystem for Linux, so you would only use it inside WSL. Choose whichever method matches how you like to manage software on your PC.
The encrypted vault keeps sensitive information stored locally in encrypted form, so it is not held as readable text on disk. It is meant to keep that data under your control. Encryption protects stored values but cannot protect you from phishing or from running untrusted code, so pair it with the habits described in the safety section.
No. IronClaw is an Agent OS, even though it appears in the Keys & Seed Tools category. If your goal is to generate or check BIP39 seed phrases offline, a dedicated tool such as Ian Coleman BIP39 Tool is more direct. IronClaw is better suited to people who want an agent environment with a built-in encrypted vault.
Yes. IronClaw includes self-expanding capabilities, which means you can build new tools on the fly without waiting for vendor updates. This is practical for workflows that a general-purpose release does not cover. Start with a small tool, test it in a safe environment, and only then give it access to sensitive data.
Check the Releases page on GitHub and pick the tag that matches your needs. The newest tag at the time of writing is ironclaw-v1.4.1-rc.2, a release candidate, so keep its prerelease suffix when you substitute the version in commands. Prerelease builds can change more often than finished releases, so expect occasional updates.
Verdict
IronClaw is a strong choice for privacy-minded users, developers and anyone who wants an Agent OS that keeps data local, encrypted and auditable. It is free, MIT-licensed and recently updated. Its current tagged build is a release candidate, and its scope is broad, so it suits people comfortable with technical setup rather than casual users. If you need a single narrow seed tool, a specialist will serve you better.