# Dashboard

Your self-hosted, security-isolated agents — at a glance.

## Connect to your control plane

The daemon is reachable, but its API is gated. Paste a bearer token to load your agents, approvals, and sessions. The token stays in this browser tab only (`sessionStorage`) and is sent as `Authorization: Bearer`.

This is the `IRONCLAW_API_TOKEN` the daemon was started with. On an open loopback you can leave it blank.

—
Agents
—
Pending approvals
—
Active sessions
—
Wired channels

## Get started

## Pending approvals

Not connected.

# Agents

Create, configure, and chat with your agent groups.

# Chat playground

Talk to an agent group through the real engage / delivery path.

pick an agent group

# Approvals

Every capability change is held here until a human decides.

Not connected.

# Sessions

Live sandboxes, one per conversation.

Not connected.

# Channels & wiring

Connect chat platforms to agent groups.

1 · Connect a chat surface

Tell IronClaw about a place messages come from — a Slack channel, a Telegram chat, etc. You'll wire it to an agent in step 2.

Platform
Where on that platform

The platform's own id for the channel or chat.

Who can trigger it
Type Group chat (not a 1:1)
Inspect an existing surface
2 · Wire it to an agent

Connect a chat surface (from step 1) to one of your agents, and choose when the agent should jump in.

Agent
Chat surface
When to engage
Pattern (for pattern mode)
Conversation memory
Priority
3 · Allow the agent to reply somewhere

An agent can only send to places you approve. Add the destinations it's allowed to post back to.

Agent
Platform
Where
Channel credentials (guided)

Bot tokens are set as environment variables on the control-plane host and are never stored by this console (sealed design — there is no credential vault). Set the variable on the host, then restart the daemon.

# Skills

Install a curated, signed skill into an agent group.

Install submits a gateway change for human approval — it is never applied from here. Approved installs take effect on the next launch (enabled tools, approved egress hosts, and assets mounted at `/skills/<name>`).

Skill
For which agent
Requested by

## Curated catalog

Not connected.

# MCP servers

Connect Model Context Protocol servers and grant agents their tools.

MCP servers run host-side — a local server in a hardened, network-isolated container, a remote server over TLS. The sandbox never speaks MCP: it reaches a per-session broker socket, every call is gated against the approved grant and audited. Granting an agent access needs human approval (it lands in Approvals).

Name
Type
Command
Arguments
Image (isolation)
Environment (optional)
URL
Auth header (optional)

Secrets: write `${ENV_VAR}` to reference a host environment variable — the value is resolved host-side at connect time and is never stored, shown, or sent to the agent.

## Configured servers

Not connected.

# Setup & config

First-run checklist and the per-agent config editor.

First-run wizard (mirrors `ironctl onboard`)
Read-only checklist of the host onboarding steps (dry-run; no token is minted or shown).

Not connected.

Config editor
Agent

# Audit

The append-only record of every gateway decision.

Not connected.

# About

How this console talks to the control-plane.

The static shell is served by the control-plane at `/ui/`; all data and actions flow through the bearer-gated `/v1` API. The token you enter is kept only in this tab's `sessionStorage` and sent as `Authorization: Bearer` on each request — the API itself stays fully gated.

Dependency-free and embedded into the binary via `go:embed` — no build step, no Node, no extra port. Agents run in sealed gVisor sandboxes with `network=none`; this console only configures the host.

## Create an agent

What's your agent called?

Pick a name to get started.

Start from a template
Loading…
Persona — who it is, how it sounds, how it works (all optional)
Loading…
Model — optional
Provider — optional, advanced
What can it do? — pick its tools Enable all tools
Loading tools…

Saved instantly. Web/API tools still need an approved host. Approval-gated edits live in Setup.