IronClaw

Secure-by-default AI Agent Framework with Zero Trust Architecture

Quick Start • Architecture • Security Layers • Providers • Channels • Differentials • Contributing

IronClaw is a production-grade AI agent framework written in Rust, engineered from the ground up with security as its primary concern. Every tool execution is validated, sandboxed, and audited. No implicit trust — every action requires explicit permission.

25+ LLM providers | 20+ communication channels | 13-step security pipeline | 432+ tests | ~25,000 lines of Rust

Quick Start

Prerequisites

• Rust 1.75+ — curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
• SQLite3 (bundled in the build)
• Docker (optional, for container sandbox)
• Ollama (optional, for local models with no API key)

Build & Run

# Clone and build
git clone https://github.com/CyberSecurityUP/ironclaw.git
cd ironclaw
cargo build --release

# Run the onboarding wizard (easiest way to get started)
./target/release/ironclaw onboard

# Or run directly with a provider
./target/release/ironclaw run --provider ollama --model llama3.3

# Run with the Web UI
./target/release/ironclaw run --provider anthropic --ui

# Check your security posture
./target/release/ironclaw doctor

Provider Presets

Use preset aliases for quick selection:

ironclaw run --provider fast    # Groq ultra-fast
ironclaw run --provider local   # Ollama local
ironclaw run --provider smart   # Claude best quality

Provider Setup Examples

# Ollama (free, local)
ollama serve && ollama pull llama3.3
ironclaw run --provider ollama

# Anthropic (Claude)
export ANTHROPIC_API_KEY="sk-ant-api03-..."
ironclaw run --provider anthropic

# OpenAI (GPT)
export OPENAI_API_KEY="sk-..."
ironclaw run --provider openai

# Google (Gemini)
export GOOGLE_API_KEY="AIza..."
ironclaw run --provider google

# OpenRouter (100+ models, single API key)
export OPENROUTER_API_KEY="sk-or-..."
ironclaw run --provider openrouter --model google/gemini-2.5-pro

See QUICKSTART.md for detailed setup instructions for all 25 providers.

Architecture

┌──────────────────────────────────────────────────────────────┐
│                     CLI / Web UI / Channels                   │
├──────────────────────────────────────────────────────────────┤
│                        Core Engine                            │
│  ┌────────────┬────────────┬────────────┬──────────────────┐ │
│  │  Provider   │    Tool    │   Memory   │     Workflow     │ │
│  │  Router     │  Registry  │   Store    │     Engine       │ │
│  ├────────────┼────────────┼────────────┼──────────────────┤ │
│  │  Skill      │   Cost     │  Context   │   Agent          │ │
│  │  Verifier   │  Tracker   │  Chunking  │  Orchestrator    │ │
│  └────────────┴────────────┴────────────┴──────────────────┘ │
├──────────────────────────────────────────────────────────────┤
│                    Security Pipeline (13 steps)               │
│  ┌──────────┬──────────┬──────────┬──────────┬───────────┐  │
│  │ Command  │   RBAC   │ Sandbox  │  Audit   │   DLP     │  │
│  │ Guardian │  Policy  │ Enforcer │   Log    │  Engine   │  │
│  ├──────────┼──────────┼──────────┼──────────┼───────────┤  │
│  │  Anti-   │   SSRF   │  Skill   │Community │ Session   │  │
│  │ Stealer  │  Guard   │ Scanner  │ Scanner  │   Auth    │  │
│  └──────────┴──────────┴──────────┴──────────┴───────────┘  │
├──────────────────────────────────────────────────────────────┤
│         Sandbox (Docker / Bubblewrap / Native)                │
│  ┌──────────────────────────────────────────────────────┐    │
│  │ Multi-Level Profiles: Minimal → Standard → Elevated  │    │
│  └──────────────────────────────────────────────────────┘    │
├──────────────────────────────────────────────────────────────┤
│      Communication Channels (20+) & Gateway (JWT/OAuth2)      │
└──────────────────────────────────────────────────────────────┘

Core Modules

Security Layers

IronClaw follows Zero Trust principles with 13 overlapping security layers:

1. Command Guardian

Every shell command is validated against 45+ blocklist patterns and heuristic rules. Blocks reverse shells, privilege escalation, data exfiltration, credential access, and injection attacks.

2. Role-Based Access Control (RBAC)

Full role-based permission model for filesystem, network, and system access. Deny rules always take precedence. Rate limiting per role.

3. Sandbox Isolation

All tool execution runs in isolated environments (Docker rootless, Bubblewrap, or Native) with seccomp profiles, no host access by default, and explicit network policies.

4. Multi-Level Sandbox Profiles

Per-skill isolation levels — Minimal, Standard, Elevated, Unrestricted, Custom — with fine-grained control over filesystem access, network access, resource limits, and environment variables.

5. Skill Signature Verification

All skills must be cryptographically signed (Ed25519) with SHA-256 content hashing. Only skills signed by trusted keys can execute.

6. Skill Static Analyzer

Scans skill/plugin source code for 27 dangerous patterns (eval, exec, crypto mining, exfiltration, env harvesting, obfuscated code, privilege escalation, persistence mechanisms) with CWE mapping.

7. Community Skill Security Scanner

Typosquatting detection via Levenshtein distance against known packages (npm, PyPI, crates.io), reputation database, dependency analysis, and quarantine for untrusted packages.

8. Memory Protection

All memory encrypted at rest (AES-256-GCM), segregated by context, sanitized against injection attacks. Multiple backends: SQLite, file, Redis, Postgres.

9. Anti-Stealer Detection

Dedicated module detecting credential harvesting, sensitive file access (SSH keys, cloud creds, crypto wallets, browser profiles, keychains), multi-step exfiltration correlation, and stealer-like command patterns.

10. SSRF Protection

Blocks private/reserved IP ranges (RFC 1918, CGNAT, link-local), cloud metadata endpoints (AWS/GCP/Azure), DNS rebinding, IP obfuscation (decimal, hex, octal), and dangerous URL schemes.

11. Data Loss Prevention (DLP)

Scans all tool outputs for sensitive data (private keys, AWS/GCP/Azure credentials, database URIs, JWT tokens, API keys, /etc/shadow) with configurable actions: block, redact, warn.

12. Observability & Audit

Structured JSON logging with automatic PII redaction, security audit trail, and SIEM export capability. OpenTelemetry integration for metrics and tracing.

13. LLM Session Authentication

Active LLM session as proof of identity — HMAC-SHA256 signed tokens with configurable TTL, provider health-check validation, rate-limited session creation.

Providers

IronClaw supports 25+ LLM providers out of the box:

# List all providers and models
ironclaw models

# Show only providers with available API keys
ironclaw models --available

Channels

IronClaw supports 20 communication channels, each with rate limiting, sender validation, input sanitization, and credential redaction:

Channel Security Pipeline

All messages pass through a security pipeline:

Inbound: Rate limiting → Sender validation → Input sanitization (null bytes, ANSI escapes, role injection)

Outbound: Credential redaction (API keys, AWS keys, tokens) → PII redaction (emails, card numbers) → Internal URL / SSRF detection

Workflow Engine

DAG-based automation engine with 10 action types:

• LlmCall — Send prompts to any provider
• ToolExec — Execute registered tools
• ChannelSend — Send messages to any channel
• WaitForEvent — Pause until an external trigger
• Transform — Map/filter data with templates
• Branch — Conditional branching with 8 operators
• SubWorkflow — Nest workflows
• HttpRequest — External API calls
• Delay — Time-based delays
• Log — Structured logging

Features: {{variable}} template resolution, cycle detection via topological sort, conditional execution, retry policies with exponential backoff, 6 trigger types (manual, scheduled, webhook, channel_message, event, on_completion).

Collaborative Agents

Multi-agent orchestration with 6 built-in roles and 5 coordination patterns:

Roles

Coordination Patterns

• Sequential — Agents execute one after another, passing results forward
• Parallel — All agents work simultaneously, results aggregated
• Debate — Agents propose, critique, and refine answers
• Hierarchical — Lead agent delegates tasks to sub-agents
• Pipeline — Each agent transforms and passes data to the next

Native Multimodal Support

Process images, audio, video, and files natively:

• Images: JPE