12K stars. An agent framework where the LLM never touches your API keys. IronClaw encrypts the credential vault. WASM-sandboxes every tool call. Rust underneath. Most agent runtimes hand your secrets…

Agent runtimes that handle credentials need memory safety. Rust fits. IronClaw runs agents in WASM sandboxes with explicit permission boundaries. Plugins cannot escape. CodeAct + RLM built in. →…

Every tool an agent invokes runs inside a wasm sandbox with explicit capability declarations, fuel metering, and memory limits. Credentials are stored in encrypted vaults, separate from the tool…