Skip to content
Agentmart
Submit a tool

Ironclaw

Sandboxed shell exec for MCP clients: run untrusted agent commands in a gVisor container.

Connector by IronSecCo · GitHub account verified by the MCP Registry

IndexedAGPL-3.0Local (stdio)★ 19
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/ironsecco-ironclaw

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Sandboxed shell exec for MCP clients: run untrusted agent commands in a gVisor container.

Use cases: code-generation, security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
0 read · 1 write · 0 delete
Secrets
1 (API keys, tokens or passwords)
Install scripts
None found
Runs as
Docker image

Tools by what they do 1

Read from the source code; the running server may list different tools.

Write 1 · Create, change, send or run things.

  • sandbox_exec

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

  • IRONCLAW_API_TOKEN

Other settings (environment variables or headers).

  • IRONCLAW_CONTROLPLANE_URL

Network hosts it talks to 35

  • acme.openai.azure.com · found in code
  • api.anthropic.com · found in code
  • api.github.com · found in code
  • api.openai.com · found in code
  • api.telegram.org · found in code
  • apple.com · found in code
  • bedrock-runtime.ap-southeast-2.amazonaws.com · found in code
  • bedrock-runtime.us-east-1.amazonaws.com · found in code
  • bedrock-runtime.us-west-2.amazonaws.com · found in code
  • blocked.test · found in code
  • cdn.jsdelivr.net · found in code
  • chat.googleapis.com · found in code
  • discord.com · found in code
  • docs.sigstore.dev · found in code
  • e.com · found in code
  • evil.test · found in code
  • example.amazonaws.com · found in code
  • example.invalid · found in code
  • example.test · found in code
  • github.com · found in code
  • graph.facebook.com · found in code
  • gvisor.dev · found in code
  • ironclaw.sh · found in code
  • ironsecco.github.io · found in code
  • json.schemastore.org · found in code
  • mintlify.com · found in code
  • my-resource.openai.azure.com · found in code
  • nivardsec.com · found in code
  • railway.com · found in code
  • raw.githubusercontent.com · found in code
Show 5 more hosts
  • schema.management.azure.com · found in code
  • slack.com · found in code
  • token.actions.githubusercontent.com · found in code
  • us-central1-aiplatform.googleapis.com · found in code
  • vault.internal · found in code

Files it touches

  • /tmp/ironclaw/onboard.env
  • /dev/mqueue
  • /dev/pts
  • /dev/shm
  • /etc/../root
  • /etc/ironclaw
  • /etc/passwd
  • /etc/profile.json
  • /opt/ironclaw/state
  • /opt/state
  • /private/var/folders/x
  • /srv/ironclaw/mounts
  • /srv/ironclaw/mounts/../../etc
  • /srv/ironclaw/mounts/data
  • /srv/mounts
  • /tmp/ic-mcp-seccomp.json
  • /tmp/s
  • /tmp/s.json
  • /Users/me/Library/Caches/ironclaw/state
  • /Users/me/state
  • /usr/local/etc/haproxy/haproxy.cfg
  • /var/folders
  • /var/lib/ironclaw/groups/g1/memory
  • /var/lib/ironclaw/groups/g1/workspace
  • /var/lib/ironclaw/shared
  • /var/lib/ironclaw/state
  • /var/lib/ironclaw/state/keys/ses_x/session.key
  • /var/lib/ironclaw/state/sessions/ses_x/inbound.db
  • /var/lib/ironclaw/state/sessions/ses_x/outbound.db
  • /var/run
  • /var/run/containerd/containerd.sock
  • /var/run/crio/crio.sock
  • /var/run/docker.sock
  • Your home directory (~)
  • C:\\x

Tools (1)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • sandbox_exec

    Run a shell command (or code snippet via `sh -c`) inside an ephemeral, hardened IronClaw sandbox box and return its stdout, stderr, exit code, and containment status. By default the box runs under gVisor (runsc), which intercepts syscalls in a user-space guest kernel; it has NO network (egress is impossible), drops all Linux capabilities, runs as a non-root user with a read-only root filesystem, no-new-privileges, a restrictive seccomp profile, and is bounded by cpu/memory/pids caps. It is torn down after the command completes. Use this to execute untrusted or model-generated code safely.

Compare and alternatives

    Featured in

    Signals

    Stars
    19
    Forks
    18
    Open issues
    12
    Last commit
    Oct 24, 2026 (4 days ago)
    Last release
    Oct 22, 2026 (6 days ago)

    From GitHub (fetched Oct 24, 2026).

    Details

    Registry name
    io.github.IronSecCo/ironclaw
    Version
    0.1.557
    Auth
    API key
    Packages
    oci ghcr.io/ironsecco/ironclaw-mcp:v0.1.557
    License
    AGPL-3.0
    Repository
    github.com/IronSecCo/ironclaw
    Website
    ironclaw.sh
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    Ironclaw MCP server. Agent Mart. https://agentmart.dev/connectors/ironsecco-ironclaw (last updated 2026-10-24)