Overview of NVIDIA NemoClaw

NVIDIA NemoClaw is an open-source reference stack for running AI coding agents more safely inside OpenShell containers.

NemoClaw provides onboarding, lifecycle management, and agent operations for supported agent runtimes in OpenShell sandboxes. It combines a host CLI, a versioned blueprint, and an agent-specific integration layer. The OpenShell gateway coordinates sandbox lifecycle, managed inference, credentials, and policy enforcement.

The primary tested platforms are Linux and DGX Spark. NemoClaw also documents platform limitations for macOS, Windows Subsystem for Linux (WSL), DGX Station, and headless Linux servers. Refer to Platform Support for current agent, platform, provider, integration, and deployment-path status.

What NemoClaw Provides

NemoClaw groups its supported capabilities around running, connecting, controlling, and operating agents.

Area	Capability
Run supported agents	Onboards OpenClaw, Hermes, or LangChain Deep Agents Code into an agent-specific sandbox image and configuration.
Route inference	Connects supported hosted inference and local inference providers through `inference.local`. OpenShell keeps provider credentials outside the sandbox.
Control sandbox access	Applies network policy, filesystem policy, process controls, and managed inference through OpenShell.
Operate the lifecycle	Reports host readiness, creates or updates sandboxes, reports status and logs, rebuilds or recovers sandboxes, and creates or restores snapshots.
Connect Model Context Protocol (MCP) servers	Manages authenticated HTTPS Streamable HTTP MCP servers for all supported agent runtimes. OpenShell replaces credential placeholders at approved egress boundaries.
Extend agent workflows	Installs agent skills and publishes Markdown documentation that coding agents can use for setup, operation, security review, and troubleshooting.
Operate a terminal agent	Runs the managed `dcode` terminal agent interactively or through its headless JSON workflow.
Export traces	Optionally sends bounded Deep Agents Code traces to an operator-managed host collector. The receiver and exported content require the documented trust controls.

Benefits of Using NemoClaw

Autonomous AI agents can make arbitrary network requests, access the host filesystem, and call any inference endpoint. Without controls, this creates security, cost, and compliance risks that grow as agents run unattended.

NemoClaw provides these controls and lifecycle tools to reduce those risks.

Benefit	Description
Sandboxed execution	Runs each agent in an OpenShell sandbox with documented filesystem, process, and network controls. Enforcement limitations vary by host.
Credential custody	Keeps inference credentials and managed MCP bearer values outside the sandbox through OpenShell.
Operator-controlled egress	Uses YAML network policy and policy presets. OpenShell blocks unapproved destinations and surfaces requests for operator review.
Repeatable lifecycle	Uses versioned, digest-verified blueprints and manifest-declared state to support onboarding, rebuild, recovery, snapshot, and restore operations.
Agent-specific workflows	Provides dedicated CLI aliases, configuration, lifecycle adapters, documentation, and validation for each supported agent runtime.

Use Cases

Use NemoClaw when you need a supported agent runtime with managed inference, network policy, and lifecycle operations.

Use Case	Description
Controlled agent evaluation	Test agent behavior with explicit filesystem and network boundaries before you add more access.
Managed tool access	Connect authenticated MCP servers without storing raw service credentials in agent configuration.
Headless server deployment	Run a sandboxed agent on a remote Linux server through SSH. Refer to Deploy to a Headless Server.
Terminal coding agent	Run `dcode` inside an OpenShell sandbox with OpenShell-managed inference credentials and a managed terminal workflow.

Product Scope

NemoClaw is an early-preview reference stack for a trusted operator on one host. It is not a hosted NemoClaw service, a multi-tenant enterprise control plane, or an enterprise identity system. Refer to Enterprise Readiness for supported, manual, platform-owned, roadmap-only, and out-of-scope capabilities.

Next Steps

Use these topics to learn more about NemoClaw and how to install and use it.

Read Platform Support before you repeat an agent, platform, provider, integration, or deployment claim.
Read Architecture Overview to understand the host CLI, integration layer, blueprint, OpenShell gateway, and sandbox lifecycle.
Read About Managed MCP Servers for the managed MCP security and lifecycle boundary.
Read System Readiness to inspect a host before onboarding without changing host state.
Read Use NemoClaw Docs with Your Coding Agents to give an AI coding agent the NemoClaw Markdown documentation entry points.
Read Ecosystem to understand how Deep Agents, OpenShell, and NemoClaw relate in the wider stack, and when to use NemoClaw versus OpenShell.
Follow Quickstart with Deep Agents to install NemoClaw and run your first Deep Agents sandbox with nemo-deepagents.
Read Understand Deep Agents Trace Export before you enable managed trace export.
Read Choose an Inference Provider to check the inference providers that NemoClaw supports and how inference routing works.