# ironclaw

ironclaw runs agent commands inside a gVisor container. Use it when a command should run without direct access to the host system.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 19
- Author: IronSecCo
- License: AGPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/IronSecCo/ironclaw
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/ironclaw

## What it does

ironclaw exposes command execution to an MCP client through a gVisor container. The project describes the sandbox as using `network=none`; model traffic goes through a host proxy, and the agent cannot alter its own configuration.

To connect it to Claude Code, the install command starts the `ghcr.io/ironsecco/ironclaw-mcp:v0.1.557` Docker image and passes `IRONCLAW_CONTROLPLANE_URL` and `IRONCLAW_API_TOKEN`. Docker, a control-plane URL, and a token are required. The project is alpha software, and its flags and storage format may change, so avoid relying on it for data you cannot afford to lose.

## Requirements
- Needs: Docker
- Environment variables: `IRONCLAW_CONTROLPLANE_URL`, `IRONCLAW_API_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env IRONCLAW_CONTROLPLANE_URL=<IRONCLAW_CONTROLPLANE_URL> --env IRONCLAW_API_TOKEN=<IRONCLAW_API_TOKEN> --transport stdio ironclaw -- docker run -i --rm -e IRONCLAW_CONTROLPLANE_URL -e IRONCLAW_API_TOKEN ghcr.io/ironsecco/ironclaw-mcp:v0.1.557
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add ironclaw --env IRONCLAW_CONTROLPLANE_URL=<IRONCLAW_CONTROLPLANE_URL> --env IRONCLAW_API_TOKEN=<IRONCLAW_API_TOKEN> -- docker run -i --rm -e IRONCLAW_CONTROLPLANE_URL -e IRONCLAW_API_TOKEN ghcr.io/ironsecco/ironclaw-mcp:v0.1.557
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "ironclaw": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "IRONCLAW_CONTROLPLANE_URL",
                "-e",
                "IRONCLAW_API_TOKEN",
                "ghcr.io/ironsecco/ironclaw-mcp:v0.1.557"
            ],
            "env": {
                "IRONCLAW_CONTROLPLANE_URL": "<IRONCLAW_CONTROLPLANE_URL>",
                "IRONCLAW_API_TOKEN": "<IRONCLAW_API_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "ironclaw": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "IRONCLAW_CONTROLPLANE_URL",
                "-e",
                "IRONCLAW_API_TOKEN",
                "ghcr.io/ironsecco/ironclaw-mcp:v0.1.557"
            ],
            "env": {
                "IRONCLAW_CONTROLPLANE_URL": "<IRONCLAW_CONTROLPLANE_URL>",
                "IRONCLAW_API_TOKEN": "<IRONCLAW_API_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e IRONCLAW_CONTROLPLANE_URL=<IRONCLAW_CONTROLPLANE_URL> -e IRONCLAW_API_TOKEN=<IRONCLAW_API_TOKEN> ironclaw docker run -i --rm -e IRONCLAW_CONTROLPLANE_URL -e IRONCLAW_API_TOKEN ghcr.io/ironsecco/ironclaw-mcp:v0.1.557
```
Replace <…> with your own values

## When to use it
- run an agent command inside a gVisor container
- limit an agent command's access to the host
- connect command execution to an MCP client through a control plane

## Example prompts
- Run this untrusted command in the isolated container: `...`
- Try the command in the sandbox and check whether it can read the host filesystem.
- Run this agent command through ironclaw without giving the container network access.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md