IronClaw and OpenClaw are both free, self-hosted agent runtimes, and the split is architectural: IronClaw is a Rust reimplementation inspired by OpenClaw, isolating each tool in a WASM sandbox and requiring PostgreSQL, while OpenClaw is the older, far larger TypeScript project whose tools run on the host until you configure sandboxing. The part the feature lists miss is that IronClaw's headline privacy claim is a property of where inference runs, not of the product — and NEAR AI's own documentation already scopes it away from models it merely proxies.
One disambiguation first, because search results mix five things. This page is about github.com/nearai/ironclaw, priced at www.ironclaw.com. It is not the Corsair IRONCLAW gaming mouse, not the separate enterprise product at ironclaw.tech (which publishes no prices and is a different company), not the dormant lookalike repository under a different owner, and not the 1999 tabletop RPG. On the other side, OpenClaw here means the AI assistant at github.com/openclaw/openclaw with docs at docs.openclaw.ai, not the unrelated 1990s platform-game reimplementation of the same name.
Who should pick which
| If this is you | Pick | What it costs you |
|---|---|---|
| You need WhatsApp, iMessage, Matrix, Microsoft Teams, Google Chat or LINE today | OpenClaw | IronClaw's own parity matrix marks all six not implemented as of its May 2, 2026 review; Telegram and Slack are marked done on both |
| You want per-tool isolation switched on before you configure anything | IronClaw | OpenClaw supports Docker, Podman, SSH, OpenShell and Crabbox sandboxes, but its README says tools run on the host for the main session unless you configure sandboxing |
| You want the lightest prerequisites | OpenClaw | Node 24.16 or later below 25, or 26.1 or later, per its published package metadata — and no database; IronClaw needs a PostgreSQL instance whichever provider you use, and source builds want Rust 1.96+ and Node 22+ with Corepack/pnpm |
| You want a managed instance with no infrastructure | IronClaw hosted | Published monthly tiers on NEAR AI Cloud; OpenClaw has no hosted service to buy. Whether a hosted IronClaw instance lets you set a custom base URL is not stated anywhere this page could read |
| You want confidential inference with attestation | Neither, by itself | That is a property of NEAR AI's TEE-hosted models, and NEAR's docs say it does not extend to models it proxies — see below |
| You want one key and one balance across many models | Either | Both document an OpenAI-compatible route. OpenClaw makes you declare the model catalog by hand; IronClaw additionally gates models behind an administrator allowlist on multi-user installs |
| You already run one and are considering the other | Stay, unless a row above decides it | Neither project documents an import path from the other, so a switch is a fresh install plus re-pairing and re-authorizing every channel |
One more structural difference before the tables: IronClaw ships two runtimes in one repository, and every configuration instruction has to name which. Its environment template states that the newer Reborn binary is separate from v1 and does not share auth or middleware with the v1 channels and web stack, and that a Reborn setting does not fall back to the v1 gateway's OAUTH_BASE_URL, so a legacy v1 value cannot rewrite Reborn callback URLs. ironclaw onboard writes Reborn state under $HOME/.ironclaw/reborn. If you follow a tutorial that does not say which runtime it is configuring, assume it does not apply.
Feature parity, by IronClaw's own matrix
| Capability | OpenClaw | IronClaw |
|---|---|---|
| Telegram, Slack | Implemented | Implemented (WASM channel) |
| Discord, Feishu/Lark, WeCom, WeChat | Implemented | Partial |
| WhatsApp, iMessage, Matrix, MS Teams, Google Chat, LINE, Twitch | Implemented | Not implemented |
| Multi-agent routing, config hot-reload, Tailscale | Implemented | Not implemented |
| Prometheus and OpenTelemetry exporters | Implemented | Not implemented |
OpenAI-compatible /v1/models and /v1/embeddings routes | Implemented | Not implemented |
| WASM channels | Not implemented | Implemented (IronClaw-only) |
Read from IronClaw's FEATURE_PARITY.md on September 21, 2026. Treat it as dated evidence rather than current state: its own header says it was last reviewed against OpenClaw releases 2026.3.11 through 2026.4.30 on May 2, 2026, so anything marked missing may have landed since, and it is the vendor grading itself — the same file marks launchd/systemd integration not implemented in one section while crediting IronClaw's Reborn service install with launchd and systemd coverage in another, which is why that row is not in the table above. Read the /v1/embeddings row narrowly too: it is about IronClaw not exposing an OpenAI-compatible embeddings endpoint of its own, and the same file marks OpenAI embeddings as implemented on both sides as a consumer. Kunavo serves no embedding model, so that step needs a separate provider whichever runtime you run.
What each one costs
| Line item | IronClaw | OpenClaw |
|---|---|---|
| The software | $0 — README offers Apache-2.0 or MIT at your option | $0 — MIT, OpenClaw Foundation |
| Vendor-side plan | Hosted tiers on NEAR AI Cloud: Starter shown at $0 with $5 struck through, Basic $20/month, Pro+ $200/month | None — the README states the project has no paid tier, hosted service, or token |
| Database | A PostgreSQL instance, required: DATABASE_URL is the first setting in the environment template, and set rather than commented out | None required |
| Runtime prerequisites | Rust 1.96+ and Node.js 22+ with Corepack/pnpm for source builds; prebuilt installers avoid that | Node >=24.16.0 <25 || >=26.1.0, the engines range in the published package metadata |
| Model tokens | Whatever your chosen provider charges — the only line that scales with use | |
Prices read from www.ironclaw.com and the two repositories on September 21, 2026. Three cautions. The Starter card shows $5 with a strikethrough and $0 as the displayed figure — confirmed in the page markup — but the site states no end date and no terms, so do not assume $0 is permanent. Each tier advertises "credits included" equal to its own price, and the site never says what those credits buy in tokens, which model they assume, or whether they expire, so no per-token rate can be derived from them. And the pricing headline's "up to 130M tokens per month" is marketing copy attached to the five-agent configuration with no model or input/output split stated; it is IronClaw's claim, not an arithmetic input.
The privacy claim does not travel with the base URL
This is the part worth getting right, because it is where a reasonable reader gets misled by two accurate documents. www.ironclaw.com sells the hosted product on confidential compute: it boots inside a Trusted Execution Environment. Meanwhile NEAR AI's own model documentation draws the line explicitly — TEE-hosted models run on NEAR's GPU fleet inside Trusted Execution Environments and support attestation, signatures and verification, while third-party models are proxied to their providers through the gateway and, in its words, the TEE privacy and verifiability guarantees do not extend to the upstream provider.
So the boundary is crossed inside NEAR AI Cloud, not only when you leave it. Picking a proxied Anthropic, OpenAI or Google model on NEAR is already outside the confidential path. Pointing either runtime at an unrelated OpenAI-compatible gateway is a further step out, and no gateway inherits that guarantee by accepting the traffic. If attestation is your actual requirement, the route is a TEE-hosted model on a provider that offers one, and you should confirm a given model's status against the provider's own documentation rather than trusting any list, including this page's. On NEAR that badge lives in the docs, not in the API: the public /v1/models JSON has no dedicated TEE field, and when it was read on September 21, 2026 the nearest signals it carried were the owned_by value — nearai on nine entries, attested 3p on four — and free-text descriptions, one of which calls its model "Anonymized, not TEE-protected".
What does survive a provider change is IronClaw's local layer, and it is worth separating from the marketing. Its security documentation describes secrets encrypted at rest that never enter the container and are injected into outgoing requests at the network-proxy layer, tools that declare which credentials they need rather than reading them, and a leak detector scanning 15-plus secret patterns. Those are runtime properties. They do not depend on which model endpoint you call, so switching providers keeps them and loses only the confidential-compute claim.
One thing this page will not launder: ironclaw.com's comparison table characterises OpenClaw's secret handling as "LLM sees secrets" and its network control as "Unrestricted". That is a vendor's description of a competitor, and OpenClaw's own documentation describes an arrangement those two labels do not capture. Its secrets and storage page documents SecretRef providers backed by env, file, exec or store, a map of which files on disk hold which credentials, and log and transcript redaction that it says is always on and cannot be disabled by config; the documentation index adds an openclaw secrets CLI, an openclaw security audit command, and a shared secret store with a default-off secret egress proxy. Alongside that, its README says tools run on the host for the main session unless you configure sandboxing, and its security guide scopes the product to one trust boundary per gateway rather than hostile multi-tenancy. Different defaults, documented countermeasures on both sides, and no measured comparison of either — nothing here tests whether a given prompt can actually extract a secret from either runtime.
Pointing either one at an OpenAI-compatible endpoint
Both accept a custom base URL; the failure modes differ. These are readings of each project's published configuration documents on September 21, 2026 — Kunavo has not runtime-tested either client, and a published setup reference is not a compatibility test.
| Question | IronClaw | OpenClaw |
|---|---|---|
| Where it lives | A [llm.default] slot in config.toml with provider_id, base_url, model, api_key_env; environment variables LLM_BACKEND/LLM_BASE_URL/LLM_MODEL/LLM_API_KEY are the fallback for containers and one-off runs | models.providers in the config file or ~/.openclaw/agents/<agentId>/agent/models.json |
| How the key is stored | api_key_env names an environment variable; the docs say pasting the key itself is rejected at parse time, and ironclaw config set prompts without echoing | apiKey, with env substitution or a secret reference preferred |
| What breaks if you skip a field | The generic openai_compatible adapter has no default host — omit base_url and model resolution fails outright | Omitted cost fields default to zero on every dimension, so usage-cost reporting silently under-reports until you fill in your own rates; an omitted contextWindow stays unset, and context-budget callers fall back to 200,000 tokens only when neither discovery nor per-model context metadata supplies one |
| Do you have to list the models | Configured providers expose their catalog, but on multi-user installs an administrator must approve models under Settings, Inference, User model access before users can select them | Yes — you declare models[] yourself with at least the matching id; an alias elsewhere does not register a runtime model |
| Protocol choice | A base_url also works on a named provider such as anthropic or openai, so you can route those through a proxy rather than using the generic adapter | An api field picks one of eleven adapters including anthropic-messages; with baseUrl set and no api, it defaults to openai-completions |
| What a proxy route gives up | Less than the base URL suggests — the same doc says base_url works on any other provider when you want to route it through a proxy or a regional endpoint. What a base URL does not replace is the credential: the provider table asks for a ChatGPT subscription on openai_codex, browser OAuth on gemini_oauth, an IDE token on github_copilot and AWS credentials on bedrock, none of which is an API key you hand to a third-party gateway | compat.supportsInstructions defaults to true only on native OpenAI and xAI's main route — the two the docs call routes with confirmed contract evidence — and to false on every other route, bundled or custom; the docs also say provider catalogs own compat and warn against copying those flags into config |
Two IronClaw inconsistencies to settle on your own install rather than from any document. Its .env.example lists nine possible LLM_BACKEND values while docs/capabilities/llm-providers.md tables more than twenty provider_id entries and tells you to use the dedicated ids for OpenRouter, Together and Fireworks that the environment template still routes through the generic adapter; both files are current on main. The docs table is the longer of the two and the one that tells you to prefer the dedicated ids, but neither file is your install: run ironclaw models list for the catalog your build actually has.
A worked cost estimate for the model route
This is illustrative token arithmetic, not a measured task cost and not a bill ceiling. Assume one day of personal-assistant traffic that sends 1,000,000 uncached input tokens — a long system prompt, tool definitions and rolling history re-sent across roughly forty turns — and receives 30,000 output tokens. Both runtimes are free, so this is the only line that scales, and it is identical whichever one you run. Rates are live Kunavo catalog prices per million tokens.
| Model | Input / output per 1M | Estimated day | Same shape, 30 days |
|---|---|---|---|
| Claude Haiku 4.5 | $0.40 / $2.00 | $0.46 | $13.80 |
| Claude Sonnet 4.6 | $1.20 / $6.00 | $1.38 | $41.40 |
| Claude Opus 4.6 | $2.00 / $10.00 | $2.30 | $69.00 |
For a same-day comparison against IronClaw's default provider, three model ids appear in both catalogs. The NEAR AI Cloud public models endpoint, read on September 21, 2026, listed anthropic/claude-haiku-4-5 at $1.00 input and $5.00 output per million, anthropic/claude-sonnet-4-6 at $3.00 and $15.00, and anthropic/claude-opus-4-6 at $5.00 and $25.00, among fifty ids returned — each of the three carrying is_ready: false in that same response, so treat the figures as listed rates rather than proof the route is open. Kunavo's catalog lists Claude Haiku 4.5 at $0.40 / $2.00, Claude Sonnet 4.6 at $1.20 / $6.00 and Claude Opus 4.6 at $2.00 / $10.00. Both catalogs change, so re-read the endpoint rather than trusting either figure as permanent — and remember that the cheapest listed rate and the lowest cost to finish a task are different claims: a model that needs three attempts at a low rate can cost more than one that needs a single attempt at a higher one.
Whether the hosted IronClaw tiers' included credits cover a month shaped like the table above is not something this page can answer, because ironclaw.com publishes no conversion from credits to tokens. Kunavo's catalog amount is a billing floor rather than a cap: when the upstream reports its charge, the bill is the greater of catalog cost and upstream cost times the applicable markup. Cache charges and external tools sit outside this example. The minimum Kunavo top-up is $10 in prepaid credit, which is a funding minimum rather than a task fee or a subscription — see billing details.
Setting it up
Whichever runtime you pick, the endpoint side is the same shape: an OpenAI-compatible base URL and a key. Start with the quickstart for the base URL and key format, and the Anthropic base URL doc if you take OpenClaw's anthropic-messages route instead. Keep a working provider configured while you try it, run one bounded task, then read the charge your account actually recorded — that reconciliation matters more on OpenClaw, where an omitted cost block makes its own usage report read zero. Create a Kunavo account when you are ready to fund a key.
Comparing further afield? OpenClaw pricing covers the cost side, the best API for OpenClaw compares provider routes, NanoClaw vs OpenClaw and ZeroClaw vs OpenClaw cover two other takes on the same idea, and OpenAI-compatible API covers the endpoint mechanics.
FAQ
What is the difference between IronClaw and OpenClaw?
IronClaw is a Rust reimplementation inspired by OpenClaw, in IronClaw's own words, and its README names four differences: Rust rather than TypeScript, a WASM sandbox rather than Docker, PostgreSQL rather than SQLite, and a security-first design. OpenClaw is the older and much larger project: created November 2025 against IronClaw's February 2026, with roughly thirty times the GitHub stars on September 21, 2026. Both are free and self-hosted. The practical differences are that IronClaw requires a PostgreSQL database whichever model provider you use, that IronClaw isolates each tool in WASM while OpenClaw runs tools on the host until you configure one of its five sandbox backends, and that IronClaw's own feature-parity matrix marks several messaging channels OpenClaw ships as not implemented.
Is IronClaw free, and what does the hosted version cost?
The IronClaw software is free: the repository is dual-licensed MIT or Apache-2.0. The hosted deployment on NEAR AI Cloud is priced at www.ironclaw.com, which on September 21, 2026 showed Starter at $0 per month with a $5 price struck through, Basic at $20 per month marked Popular, and Pro+ at $200 per month, each card listing credits equal to its price. The site does not say whether the $0 Starter price is permanent or promotional, and it does not publish what those credits convert to in tokens, so no cost-per-token can be derived from them. A different company at ironclaw.tech publishes no prices at all, and the Corsair IRONCLAW is a gaming mouse — neither is this product.
Does IronClaw keep its privacy guarantees if I use a different model provider?
Partly, and the split matters. NEAR AI's documentation states that TEE-hosted models run inside Trusted Execution Environments with attestation, while third-party models are proxied to their providers and the TEE privacy and verifiability guarantees do not extend to the upstream provider. That boundary is crossed inside NEAR AI Cloud itself the moment you pick a proxied model, so it certainly is not inherited by an unrelated gateway. What does survive a provider change is IronClaw's local defense layer, which is provider-independent: the per-tool WASM sandbox, capability-based permissions, endpoint allowlisting, credential injection at the network-proxy layer so secrets never enter the container, and a leak detector its security documentation describes as scanning 15-plus secret patterns.
Can IronClaw and OpenClaw both use an OpenAI-compatible endpoint?
Both document a path for it, with different shapes. IronClaw uses a config.toml slot with provider_id, base_url, model and api_key_env, where api_key_env names an environment variable — its documentation says pasting the literal key is rejected at parse time — and the generic openai_compatible adapter has no default host, so omitting base_url makes model resolution fail. OpenClaw declares a custom provider under models.providers with baseUrl, apiKey, an api adapter that defaults to openai-completions when baseUrl is set without it, and an explicit models array you write yourself. These are readings of each project's published documentation on September 21, 2026, not a compatibility test.
How much does it cost to run either one?
The software costs nothing in both cases, so the bill is model tokens plus whatever you pay to host it. IronClaw adds a PostgreSQL instance as a hard prerequisite, since DATABASE_URL is the first setting in its environment template and is set rather than commented out, and OpenClaw does not. IronClaw also offers a hosted route with published monthly tiers; OpenClaw's README states the project has no paid tier, hosted service, or token, so there is no vendor-side cost path at all. Model rates are per provider: on September 21, 2026 the NEAR AI Cloud catalog listed anthropic/claude-haiku-4-5 at $1 per million input and $5 per million output, while Kunavo's live catalog lists Claude Haiku 4.5 at $0.40 and $2.00 per million.
Is IronClaw a drop-in replacement for OpenClaw?
Not on channels, by IronClaw's own accounting. Its FEATURE_PARITY.md marks WhatsApp, iMessage, Matrix, Microsoft Teams, Google Chat, LINE and Twitch as implemented in OpenClaw and not implemented in IronClaw, with Discord, Feishu/Lark, WeCom and WeChat partial; Telegram and Slack are marked done on both. That file's header says it was last reviewed against OpenClaw releases 2026.3.11 through 2026.4.30 on May 2, 2026, so it is roughly four and a half months stale and may understate current progress — check the repository before deciding. Neither project documents an import path from the other, so switching means a fresh install and re-pairing every channel.
Checked September 21, 2026 against the GitHub API for nearai/ironclaw and its latest release, the npm registry entry for openclaw, the raw README, .env.example, FEATURE_PARITY.md and provider documentation in both repositories, docs.openclaw.ai, docs.near.ai and the live cloud-api.near.ai model catalog, plus the rendered markup of www.ironclaw.com. Kunavo has run neither client: every configuration statement above is a reading of vendor source documents, not a compatibility test. Kunavo token rates come from the live catalog, and every dollar example here is illustrative token arithmetic rather than a measured task cost.