Ironclaw MCP server
io.github.IronSecCo/ironclaw·v0.1.569·19 starsSandboxed shell exec for MCP clients: run untrusted agent commands in a gVisor container.
not scanned yet
19 stars
Reviews
Write oneNobody has reviewed Ironclaw yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Ironclaw tools
No tool declarations could be read from the package source. They show once the server is installed.
How Ironclaw compares
Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 70/100
- higher than 37% of 4,460 AI and agents servers
- GitHub stars
- 19
- more than 89% of 2,711 AI and agents servers
Release history: 8 versions in the registry since 2026-09-16, latest 2026-11-02, typically one every 8 days.
Install Ironclaw in Claude Code, Cursor or VS Code
claude mcp add ironclaw -- docker run -i --rm ghcr.io/ironsecco/ironclaw-mcp:v0.1.569
What the publisher says
From the Ironclaw repository's README, as published. We do not edit it. Read it on GitHub
Self-hosted AI agents you do not have to trust.
Each one runs sealed in a sandbox that provably cannot phone home, read your host, or rewrite its own rules.
<!-- Security & supply-chain trust cluster — lead with what makes this project different -->
IronClaw runs autonomous AI agents on infrastructure you control, reached through the chat apps you already use. Each agent can read, write, schedule, and reply like any assistant, but it lives inside a sealed sandbox with network=none: it reaches the model only through a host proxy, and it cannot change its own configuration. It is for anyone who wants what agents can do without handing an autonomous program the keys to their machine.
Now on the GitHub Marketplace. The ironctl scan containment grader ships as a
GitHub Action: drop one
line into a workflow and every pull request gets a 0 to 100 sandbox isolation scorecard as
a sticky comment. Local, read-only, credential-free.
yaml
# .github/workflows/scan.yml
- uses: IronSecCo/ironclaw@v1
with:
target: my-container # a container, compose service, or k8s manifest
Report-only by default; set min-score: 90 to gate merges. See scan in CI.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Ironclaw: common questions
- Is Ironclaw MCP server safe?
- Mostly: it is graded B (70/100). Read the Ironclaw safety report
- How do I install Ironclaw?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Ironclaw need an API key?
- Yes. The registry entry asks for
IRONCLAW_API_TOKEN. - Is Ironclaw maintained?
- The last commit was 35 days ago (2026-09-30). The latest release is v0.1.569.
- What can I use instead of Ironclaw?
- Servers from other publishers that do the same job: LLM Sandbox MCP server, Commands MCP server and Shellward MCP server.
- How does Ironclaw compare with other AI and agents MCP servers?
- safety score 70/100 (higher than 37% of 4,460 AI and agents servers); github stars 19 (more than 89% of 2,711 AI and agents servers). Full comparison.
Alternatives to Ironclaw
Same job from other publishers: the closest match first, then the best rated.
- LLM SandboxSecurely run LLM-generated code in isolated containers across 7 languages and 3 container backends.not reviewedWidely usedA
- CommandsModel Context Protocol server to run commands (tool: `runProcess`)not reviewedEstablishedA
- ShellwardAI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.not reviewedEstablishedA
