Reference

Platform Support and Launch Claims

View as Markdown

This page lists NemoClaw’s platform support. Any documentation, demo, blog post, sales conversation, or support reply that describes a NemoClaw capability should match the entries below.

The tables on this page are generated from ci/platform-matrix.json. Update the JSON so the tables and partial views on other pages stay in sync with scripts/generate-platform-docs.py.

Status Vocabulary

StatusMeaning
TestedValidated by CI or QA. Safe to claim and to demo.
Tested with limitationsWorks on the listed setup with documented caveats. Caveats must be cited whenever this row is claimed.
ExperimentalAvailable only after an explicit experimental opt-in, such as NEMOCLAW_EXPERIMENTAL=1 or selecting an integration that the CLI labels experimental. Do not claim in launch-facing material without the opt-in mentioned.
DeferredPlanned but not yet validated. Roadmap-only. Do not claim as supported.
UnsupportedExplicitly out of scope. Not validated and not planned. Documented to set expectations and prevent drift.
Hermes onlyAvailable only when onboarding the Hermes agent.

Project Status

For version highlights, refer to Release Notes.

  • Stage: alpha
  • Label: Early preview
  • Since: 2026-03-16
  • Notes: Maintainers review issues, discussions, and PRs on a best-effort basis without guaranteed response timelines.

Owners

  • Engineering owner: @NVIDIA/nemoclaw-maintainer (reviews through CODEOWNERS and signs off on launch-facing claim changes before they reach demos or sales material).

The engineering owner is the GitHub team auto-assigned to review changes to ci/platform-matrix.json through CODEOWNERS, and the same team signs off on launch-facing claim changes before they reach demos, blog posts, or sales material.

Review Process

  1. A change to a status or note opens a PR that touches ci/platform-matrix.json.
  2. CODEOWNERS auto-requests review from the engineering owner team.
  3. If the change is launch-facing (any status promotion, demotion, or new public claim), the engineering owner team explicitly acknowledges the launch impact in the PR review before approval.
  4. The platform-matrix-sync pre-commit hook runs python3 scripts/generate-platform-docs.py and stages the regenerated tables on every commit that touches the matrix, the generator, or any rendered page, so commits cannot land with the tables out of sync. Run python3 scripts/generate-platform-docs.py --check locally or in CI to verify the rendered tables match the JSON without regenerating.
  5. After merge, the next NemoClaw release picks up the updated matrix automatically through the docs build.

Agents

NemoClaw supports the agent runtimes listed below. Pick the matching onboarding entry point for each agent.

AgentStatusDefaultNotes
OpenClawTestedYesDefault agent runtime. Onboard with nemoclaw onboard (no --agent flag required).
HermesTestedNoFirst-class agent with dedicated CLI (nemohermes), Dockerfile, manifest, docs, and Hermes E2E coverage in .github/workflows/e2e.yaml (hermes-e2e, hermes-*, and Hermes rebuild/switch jobs). Onboard with nemohermes onboard or nemoclaw onboard --agent hermes. Unlocks the Hermes Provider inference route. Known structural gaps: model-provider compatibility registry is empty (backfilled after failures, see nemoclaw-blueprint/model-specific-setup/hermes/README.md); no Hermes-specific unit tests in nemoclaw/src/; macOS and WSL CI suites do not differentiate agents. Suitable for evaluation and the documented onboarding paths; production parity with OpenClaw is not yet asserted.
LangChain Deep Agents CodeTestedNoTerminal-oriented coding agent runtime with no in-sandbox gateway or dashboard, built on the Deep Agents SDK. Its manifest is agents/langchain-deepagents-code/manifest.yaml, and its binary is dcode. Onboard with nemo-deepagents onboard or nemoclaw onboard --agent langchain-deepagents-code, and follow the quickstart. NemoClaw runs it as a managed agent runtime: unmanaged sandbox, Model Context Protocol (MCP) server, and shell overrides are rejected, and credential-bearing proxy URLs are dropped from persisted shell environment values. Inference routes through OpenShell’s inference.local endpoint through the Deep Agents Code OpenAI-compatible provider. Live runtime acceptance, broader launch material, and terminal-agent diagnostics are tracked at open issue #4861.

Platforms

The table below lists every platform tracked by NemoClaw, including deferred entries that are on the roadmap but not yet validated. The CI column reports whether the platform has a dedicated GitHub Actions job. A “Tested with limitations” row that is not in CI carries a stronger caveat than one that is. For install requirements and the shorter setup-oriented platform view, refer to Prerequisites.

OSContainer runtimeStatusPRD priorityCINotes
DGX OS (Spark)DockerTestedP1YesUse the standard installer and $$nemoclaw onboard. The automatic two-DGX Spark managed-vLLM profile is Experimental, and physical two-node end-to-end validation is pending. For the profile requirements and controls, see Set Up vLLM on Two DGX Sparks. For the validated single-DGX Spark walkthrough with local inference, see the NVIDIA Spark playbook.
DGX OS (Station)DockerTested with limitationsP1NoThe PRD marks this platform as P1. Physical validation on one DGX Station GB300 covers generic Ubuntu 24.04 ARM64, stock DGX OS 7.5.0, the April 2026 NVIDIA Colossus BaseOS profile, and the June 2026 NVIDIA AI Developer Tools profile. A physical no-OTA DGX OS 7.6.0 host provided the release and hardware profile used for its stable workstation-family classifier and passed read-only eligibility and runtime-command preflight. Full Station Express end-to-end qualification for the accepted no-OTA DGX OS 7.6.x profile is pending. The profile remains subject to the same physical GB300, driver, ECC, Docker, CDI, and container GPU validation. Clean-host end-to-end validation passed on generic Ubuntu and Colossus BaseOS; stock DGX OS and AI Developer Tools completed Station Express validation. The DGX OS 7.5.0 run used released OpenShell 0.0.85, local Nemotron Ultra serving, sandbox cuInit(0), and a Hermes write/read file-tool task. A dual-Station configuration has not been validated, and dedicated CI coverage is not available. Direct-GPU policies expose only the exact read-only BDF directory for each discovered display-class PCI device with NVIDIA vendor ID (0x10de) and GB300 device ID (0x31c2 or 0x31c3) plus required existing topology and module paths; they do not expose /sys, the PCI parent subtree, or sysfs write access. During physical validation, reads of /sys/fs/cgroup/cgroup.controllers and /sys/class/net/lo/address remained denied. For canonical hardware qualification, image requirements, preparation, repair limits, reboot handoff, and the explicit temporary metadata override, see Prepare DGX Station to Install NemoClaw.
LinuxDockerTestedP0YesPrimary tested path. Ubuntu 24.04 has host-level onboarding validation. A digest-pinned Ubuntu 26.04 userspace lane builds the CLI and runs preflight, installer, and platform contracts on eligible main pushes; Docker-host, AppArmor, Landlock, and live onboarding validation on 26.04 remain pending. Other distros (Ubuntu 22.04, Fedora, Rocky, Alma, NixOS, Arch) may work but are not validated.
macOS (Apple Silicon)Colima, Docker DesktopTested with limitationsP0YesStart the container runtime (Colima or Docker Desktop) before running the installer. When Homebrew is available, OpenShell uses its official formula and the gateway appears in brew services list as openshell; without Homebrew, NemoClaw uses the standalone OpenShell install and detached gateway fallback. Homebrew Colima users must install both Colima and the Docker CLI (brew install colima docker) before docker info can work. Xcode Command Line Tools (xcode-select --install) are typically required for Node native modules during install. NemoClaw recommends them but does not enforce them during preflight.
NVIDIA RTX (consumer and Pro workstation GPUs)DockerDeferredP1NoThe PRD marks this platform as P1. Covers RTX consumer cards and RTX Pro workstation cards on Linux hosts that meet the generic-Linux-GPU requirements (NVIDIA Container Toolkit + CDI present). The provider menu emits managed vLLM behind NEMOCLAW_EXPERIMENTAL=1 or NEMOCLAW_PROVIDER=install-vllm for this host class today; the end-to-end onboard path on this hardware is not yet validated in CI.
Windows WSL2Docker Desktop (WSL backend)Tested with limitationsP1NoRequires WSL2 with Docker Desktop backend.

Inference Providers

NemoClaw routes inference through the OpenShell gateway. Each row below is a provider the onboarding wizard can configure end-to-end.

ProviderStatusEndpoint typeNotes
NVIDIA EndpointsTestedOpenAI-compatibleHosted models on integrate.api.nvidia.com
OpenRouterTestedOpenAI-compatibleFirst-class onboarding route for OpenClaw, Hermes, and LangChain Deep Agents Code. NemoClaw registers the openrouter-api provider through OpenShell’s openai profile with a host runtime adapter URL; host-side validation and runtime traffic send the default OpenRouter attribution headers.
OpenAITestedNative OpenAI-compatibleUses OpenAI model IDs
Other OpenAI-compatible endpointTested with limitationsCustom OpenAI-compatibleCustom base-URL adapter for servers that implement OpenAI-compatible /v1/chat/completions or /v1/responses. Behavior on OpenAI-compatible proxies, gateways, and self-hosted implementations may vary; this row claims the adapter, not the universe of compatible endpoints.
AnthropicTestedNative AnthropicUses anthropic-messages
Other Anthropic-compatible endpointTested with limitationsCustom Anthropic-compatibleAdapter path validated with AWS Bedrock (src/lib/onboard/bedrock-runtime.ts). Behavior on other Anthropic-compatible proxies and gateways may vary; this row claims the adapter, not the universe of compatible endpoints.
Google GeminiTestedOpenAI-compatibleUses Google’s OpenAI-compatible endpoint
Hermes ProviderHermes onlyOpenAI-compatible routeAvailable when onboarding Hermes Agent through nemohermes
Local OllamaTested with limitationsLocal Ollama APIAvailable when Ollama is installed or running on the host. Validated default models: qwen3.6:35b (high VRAM), nemotron-3-nano:30b (medium VRAM), qwen3.5:9b (low VRAM fallback).
Local NVIDIA NIMExperimentalLocal OpenAI-compatibleRequires NEMOCLAW_EXPERIMENTAL=1 and a NIM-capable NVIDIA GPU. Host must have the NVIDIA Container Toolkit installed and a CDI spec present (onboard asserts CDI presence with assertCdiNvidiaGpuSpecPresent, src/lib/onboard/fatal-runtime-preflight.ts). NIM images pull from nvcr.io and require NGC registry login. NemoClaw gates this path behind the experimental flag because it does not auto-select a NIM image for the host today. You must explicitly pick from the validated image list. On Linux arm64 DGX Spark and DGX Station hosts, onboarding warns that some NIM images may not publish a linux/arm64 manifest; the warning is advisory, and the selected image pull can still fail when the registry has no matching platform manifest. Managed vLLM has host-specific default models and is not gated on the same boxes. Validated images referenced in src/lib/inference/config.ts and nemoclaw/src/index.ts: nvidia/nemotron-3-super-120b-a12b (default cloud model), nvidia/nemotron-3-nano-30b-a3b, nvidia/llama-3.3-nemotron-super-49b-v1.5.
Local vLLM (already running)Tested with limitationsLocal OpenAI-compatibleAppears in the onboarding menu when NemoClaw detects a server already on localhost:8000. No flag required. Model is whatever the existing server serves.
Local vLLM (managed install/start)Tested with limitationsLocal OpenAI-compatibleAppears by default on DGX Spark and qualifying DGX Station GB300 hosts. DGX Station is Tested with limitations across qualified profiles on one physical DGX Station GB300. Full Station Express end-to-end qualification for the accepted no-OTA DGX OS 7.6.x profile is pending. Dual-Station configurations are not yet validated, and dedicated CI coverage is not available. For canonical Station qualification and host preparation, see the Additional Setup page for OpenClaw, Hermes, or Deep Agents. Generic Linux NVIDIA GPU hosts require NEMOCLAW_EXPERIMENTAL=1 or NEMOCLAW_PROVIDER=install-vllm, NVIDIA Container Toolkit, and CDI. NemoClaw pins runtime images to immutable digests. Station Express defaults to nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4; --station-deepseek selects deepseek-ai/DeepSeek-V4-Flash. Direct managed-vLLM defaults are nvidia/Qwen3.6-35B-A3B-NVFP4 on DGX Spark, deepseek-ai/DeepSeek-V4-Flash on DGX Station, and nvidia/NVIDIA-Nemotron-3-Nano-4B-FP8 on generic Linux NVIDIA GPU hosts. Image pulls from nvcr.io require NGC registry login.

Messaging Integrations

NemoClaw configures messaging channels during onboarding. The OpenShell gateway runs each channel as a supervised process; NemoClaw supplies onboarding, credential delivery, and policy presets for the sandbox egress rules.

ChannelStatusNotes
SlackTestedConfigured through an OpenShell-managed channel during onboarding. Sandbox egress allowed by the slack policy preset.
DiscordTestedConfigured through an OpenShell-managed channel during onboarding. Sandbox egress allowed by the discord policy preset.
TelegramTestedConfigured through an OpenShell-managed channel during onboarding.
WeChatTested with limitationsChannel hook available. Verify regional account access before relying on this path.
WhatsAppTested with limitationsSupported by both OpenClaw and Hermes through the channel manifest supportedAgents declaration in src/lib/messaging/channels/whatsapp/manifest.ts. Pairing happens in the sandbox through WhatsApp Web by scanning a QR code at first run; the Hermes flow exposes this as hermes whatsapp and persists session credentials under ~/.hermes/platforms/whatsapp/session (agents/hermes/manifest.yaml:69-71). Sandbox egress goes through the whatsapp policy preset, which carries the WebSocket / Noise / h1-ALPN caveats documented in src/lib/messaging/channels/whatsapp/policy/openclaw.yaml and src/lib/messaging/channels/whatsapp/policy/hermes.yaml. No Meta Business API integration today; that path is out of scope for this matrix.
Microsoft TeamsExperimentalSupported by both OpenClaw and Hermes through the manifest-first messaging channel contract. Requires Bot Framework app credentials, a tenant ID, and a public HTTPS endpoint that reaches the sandbox webhook path /api/messages. Sandbox egress goes through the teams policy preset, and only one active Teams sandbox can use a given local MSTEAMS_PORT forward.
Google ChatExperimentalAvailable only for OpenClaw through the channel manifest contract. The onboarding picker labels Google Chat experimental, and NemoClaw enables it only after you explicitly select or add it. Requires a Google service-account credential and a public HTTPS endpoint that reaches only the /googlechat webhook path. OpenShell keeps the service-account private key outside the sandbox and supplies short-lived credentials at approved egress boundaries.

Capabilities

Each row below is a launch-facing capability claim that NemoClaw makes in docs, blog posts, or demos. Use the status to decide whether the claim is safe to repeat verbatim or needs a caveat.

CapabilityStatusNotes
Guided onboardingTestedSingle-command interactive wizard ($$nemoclaw onboard) that walks the user through inference provider selection, credential setup, and sandbox creation or update. It opens the agent dashboard when the selected runtime provides one. Non-interactive mode is supported with --non-interactive and NEMOCLAW_* environment variables for CI and scripted installs.
Sandboxed executionTested with limitationsLandlock, seccomp, network namespace isolation, no-new-privileges, privilege dropping, and process limits (ulimit -u 512 at scripts/lib/sandbox-init.sh:237) are tested and on by default. The DANGEROUS_CAPS list at scripts/lib/sandbox-init.sh:288-299 drops cap_sys_admin, cap_sys_ptrace, cap_net_raw, cap_dac_override, cap_sys_chroot, cap_fsetid, cap_setfcap, cap_mknod, cap_audit_write, cap_net_bind_service with capsh --drop when CAP_SETPCAP is present. Limitation (active issue #3280): the fail-closed bounding-set gate is opt-in via NEMOCLAW_REQUIRE_CAP_DROP=1; the default is warn-and-continue so hosts without CAP_SETPCAP still boot, which means dangerous caps can remain in the bounding set on some hosts even though the effective set is empty.
Routed inferenceTestedProvider-routed model calls through the OpenShell gateway, transparent to the agent. The agent uses inference.local inside the sandbox; provider credentials stay on the host. Supports every entry in the Providers table.
Declarative network policyTestedYAML-defined egress with policy presets. Presets include slack, discord, telegram, weather, openclaw-pricing, huggingface, npm, pypi, brew, and others. Hot-reloadable at runtime with $$nemoclaw <name> policy add.
Snapshot and restoreTestedCreate, list, and restore named snapshots of sandbox state with the $$nemoclaw <name> snapshot subcommands (create, list, restore). Credential stripping is enforced on capture. Unsafe symlinks are rejected on restore.
Agent skillsTestedPackaged agent skills are discoverable by Cursor, Claude Code, and other coding assistants under .agents/skills/. Skills also install into the sandbox with $$nemoclaw <name> skill install.
Managed MCP serversTestedOpenClaw, Hermes, and LangChain Deep Agents Code support authenticated HTTPS Streamable HTTP MCP server lifecycle through $$nemoclaw <name> mcp. NemoClaw stores only credential names and ownership metadata, while OpenShell keeps raw credential values outside the sandbox and replaces credential placeholders at approved egress boundaries.
Host readiness reportingTested$$nemoclaw host probe reports host observations, capabilities, qualifications, findings, evidence, and CLI provenance without changing host, gateway, provider, policy, credential, or sandbox state. The human-readable and JSON formats use the same schema-versioned report and deterministic exit codes.
Deep Agents trace exportTested with limitationsLangChain Deep Agents Code can opt into bounded-content OpenTelemetry Protocol (OTLP) over HTTP trace export to an operator-managed host collector. The sandbox receives no remote-backend credential, the local receiver has no authentication, trace content can contain sensitive application data, and delivery failures do not stop agent work.
State migrationTestedSandbox state migrates across rebuilds with credentials intentionally excluded. Hermes excludes auth.json and restores its SQLite session DB through the backup API. OpenClaw config merge prevents stale state from overwriting fresh values.
Blueprint versioningTestedVersioned, digest-verified, and reproducible blueprint lifecycle. Drives $$nemoclaw <name> rebuild and the migration safeguards above.
Web search backendTested with limitationsOnboarding supports Brave and Tavily for OpenClaw and Tavily for Hermes. Provider selection, agent configuration, and credential attachment are build-time inputs, so changing the provider recreates the sandbox. OpenShell replaces resolver placeholders at egress, including JSON request-body rewriting for Hermes Tavily. Users supply the backend credential; NemoClaw does not bundle a key.

Deployment Paths

Use the following table to choose how to bring up NemoClaw on a host. Pick the row that matches the target environment.

PathStatusNotes
Local CLI onboardTestedRun $$nemoclaw onboard on a tested platform with Docker available locally. Primary path.
Headless Linux serverTested with limitationsProvision a tested Linux host, connect over SSH, run the standard installer and $$nemoclaw onboard, and keep dashboards bound to loopback behind SSH port forwarding. Automatic recovery after a host reboot is not guaranteed; follow the documented manual recovery flow.

Out of Scope and Not Supported

The items below come up in conversations but are explicitly out of scope. They are listed here so launch material, sales conversations, and support triage have a clear “we do not claim to do this” reference.

ItemStatusWhy
Podman / other container runtimesUnsupportedOnboard surfaces an explicit unsupported-runtime error for Podman (src/lib/onboard/fatal-runtime-preflight.ts prints the rejection; src/lib/onboard/preflight.ts flags the unsupported runtime upstream). Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed).
Intel Mac (macOS x86_64)UnsupportedThe supported OpenShell Homebrew gateway service path is Apple Silicon only, and OpenShell does not publish macOS x86_64 standalone gateway assets. The top-level installer rejects Intel Mac hosts before release-ref resolution or downloads (install.sh:108), and the OpenShell installer retains a downstream asset guard (scripts/install-openshell.sh:689). See issue #954 (closed).
Non-Ubuntu/Debian Linux distrosUnsupportedInstaller assumes apt-get. Fedora/Rocky/Alma/Arch/NixOS are not validated and the installer’s package-manager probes do not cover them. See open issue #899 (Fedora hang).
Native Kubernetes or OpenShift deploymentsUnsupportedNemoClaw runs the sandbox as a Docker container, not a Kubernetes pod. The default Docker-driver topology does not embed k3s. Operator-managed K8s/OpenShift deployments are out of scope; see issue #407 (community OpenShift through agent-sandbox CRD).
Air-gapped / offline installsUnsupportedOnboard assumes network reachability for package fetches, container pulls, and provider validation. See open issues #4872 and #2218 (production-deployment epic covering air-gapped support, China network guidance, multi-host topology).
Windows-on-ARM GPU passthroughUnsupportedWindows-on-ARM CPU paths run under WSL2 ‘tested with limitations’, but GPU passthrough on WOA is denylisted (src/lib/onboard/wsl-docker-desktop-gpu.ts:214, src/lib/inference/gpu-trust.test.ts:70). See closed issue #4565.
Non-NVIDIA GPUs (AMD/ROCm, Intel Arc, Apple Metal)UnsupportedLocal vLLM and NIM paths assert NVIDIA CDI presence with assertCdiNvidiaGpuSpecPresent (src/lib/onboard/fatal-runtime-preflight.ts). NemoClaw does not install non-NVIDIA accelerator drivers.
Other LangChain, AutoGen, CrewAI, or non-listed agent harnessesUnsupportedLangChain Deep Agents Code is the only integrated LangChain-family agent runtime (refer to the Agents section above; status Tested). Other LangChain agent runtimes, AutoGen, CrewAI, and any agent runtime not listed in the Agents table are not integrated. Bringing more agent runtimes is tracked as a research epic (refer to open issue #4861) but is not on the current roadmap.
Multi-user host sharingUnsupportedSandboxes are scoped to a single host user. NemoClaw treats multi-user hosts as a risk and warns at onboard; see docs/security/openclaw-controls.mdx Multi-user detection.
Hosted SaaS / managed NemoClawUnsupportedThere is no managed offering. Supported deployment paths are local CLI onboarding and headless Linux server onboarding.
Native provider integrations not in the Providers tableUnsupportedVertex AI, Azure OpenAI, SageMaker, Together.ai, Replicate, and HuggingFace Inference Endpoints are not first-class onboarding entries. AWS Bedrock works through the compatible-anthropic-endpoint adapter (src/lib/onboard/bedrock-runtime.ts).
Production SLA or guaranteed response timesUnsupportedNemoClaw is an early-preview alpha project. Maintainers respond on a best-effort basis. No SLA is offered.

Known Caveats and Active Blockers

  • Sandbox bounding-set capability drop on hosts without CAP_SETPCAP is partially fixed. The agent process tree drops dangerous caps with NEMOCLAW_REQUIRE_CAP_DROP=1 (refer to #4707). The nemoclaw <name> connect shell still inherits the container’s create-time bounding set on Colossus, Docker Desktop, and WSL hosts where CAP_SETPCAP is absent. The remaining fix is upstream in NVIDIA/OpenShell#1452. Refer to tracking #3280.

Using This Matrix

  • Docs and READMEs that reference any row above should link to this page instead of restating status. Partial tables, such as the prerequisites page, generate from the same JSON and stay in sync with scripts/generate-platform-docs.py.
  • Demos and launch material should cite the status verbatim. A “Tested with limitations” row is not a “Tested” row.
  • Customer support can use the matrix to triage incoming reports. A failure on a Tested row is a bug. A failure on a Deferred row is an unsupported configuration request. A failure on an Unsupported row is a feature request that needs separate triage.
  • Roadmap changes land in the JSON first, then propagate to this page on the next generator run.

Updating the Matrix

  1. Edit ci/platform-matrix.json.
  2. Run python3 scripts/generate-platform-docs.py to regenerate this page and the partial tables on prerequisites and provider selection.
  3. Open a PR. The engineering owner team is auto-assigned through CODEOWNERS and explicitly acknowledges launch impact in the PR review for any launch-facing claim change.
  4. The platform-matrix-sync pre-commit hook regenerates and stages the rendered tables before the commit lands; run python3 scripts/generate-platform-docs.py --check to verify drift without regenerating.