About NemoClaw

Ecosystem

View as Markdown

NemoClaw provides onboarding, lifecycle management, policy, and inference routing for LangChain Deep Agents Code in OpenShell containers. Use the nemo-deepagents CLI alias when you work from the Deep Agents guide; it is equivalent to nemoclaw with langchain-deepagents-code pre-selected.

This page explains how Deep Agents, OpenShell, and NemoClaw fit together, and when to choose NemoClaw or a custom OpenShell integration.

How the Stack Fits Together

A NemoClaw deployment for Deep Agents combines three pieces with distinct scopes: LangChain Deep Agents Code, OpenShell, and NemoClaw. The following diagram shows how they fit together.

NemoClaw sits above OpenShell in the operator workflow. It calls OpenShell APIs and CLI commands to create and configure the sandbox that runs dcode. Models and endpoints sit behind OpenShell’s inference routing. NemoClaw onboarding connects your provider choice to that route and writes the managed Deep Agents configuration under /sandbox/.deepagents.

The following table shows the scope of each component in the stack.

ProjectScope
LangChain Deep Agents CodeThe terminal coding agent runtime, interactive TUI, headless dcode -n mode, skills, memory, and tool approval UI inside the container.
OpenShellThe execution environment: sandbox lifecycle, network, filesystem, process policy, inference routing, and the operator-facing openshell CLI for those primitives.
NemoClawThe NVIDIA reference stack on the host: nemo-deepagents and nemoclaw CLI paths, versioned blueprint, managed Deep Agents integration layer, managed inference and Model Context Protocol (MCP) servers, host readiness reporting, trace export, and lifecycle operations.

NemoClaw Path versus OpenShell Path

Both paths assume OpenShell can sandbox a workload. The difference is who owns the integration work.

PathWhat it means
NemoClaw pathYou adopt the reference stack. NemoClaw’s Deep Agents blueprint encodes the image, managed dcode launchers, default policies, inference configuration, and state handling so nemo-deepagents onboard creates a tested Deep Agents-on-OpenShell setup with less custom integration work.
OpenShell pathYou use OpenShell as the platform and supply your own container, Deep Agents install steps, policy YAML, provider setup, and runtime wrappers. OpenShell stays the sandbox and policy engine; nothing requires NemoClaw’s blueprint or CLI.

What NemoClaw Adds Beyond Custom OpenShell

You can run Deep Agents inside OpenShell without NemoClaw by building your own image, writing policy YAML, registering providers, and wiring inference routes yourself. That path is valid when you need full control over the container layout.

NemoClaw builds on OpenShell with additional security hardening, automation, and lifecycle tooling for Deep Agents. The following table compares custom OpenShell integration with nemo-deepagents onboard.

CapabilityCustom OpenShell + Deep Agentsnemo-deepagents onboard
Sandbox isolationYou define and apply OpenShell seccomp, Landlock, network namespace isolation, and no-new-privileges policy.NemoClaw applies the managed Deep Agents policy through the blueprint and requires the runtime checks that the managed agent runtime depends on.
Credential handlingYou create OpenShell providers manually and decide how dcode receives endpoint credentials.NemoClaw creates OpenShell providers during onboarding, points Deep Agents at https://inference.local/v1, and keeps provider credentials outside the sandbox.
Image hardeningDepends on your base image and install steps.NemoClaw installs the pinned Deep Agents Code package in /opt/venv, uses managed launchers, and rejects unsupported runtime paths such as unmanaged MCP autoloading, nested sandbox providers, and alternate model routes.
Filesystem policyYou define read-only and read-write paths in policy YAML.NemoClaw defines a targeted layout: system paths are read-only, /sandbox and /tmp are writable, and Deep Agents state lives under /sandbox/.deepagents.
Inference setupYou configure OpenShell inference routing and Deep Agents provider settings manually.NemoClaw validates the selected provider from the host, configures the OpenShell route, and writes /sandbox/.deepagents/config.toml for the managed OpenAI-compatible path.
Managed MCPYou decide how MCP servers enter the sandbox and how they receive credentials.NemoClaw manages authenticated HTTPS Streamable HTTP MCP server lifecycle, ownership records, policy, credential placeholders, and the Deep Agents MCP projection through host-side commands.
Optional integrationsYou decide how web search, tracing, and other integrations enter the sandbox.NemoClaw supports an explicit Tavily policy and credential path plus opt-in bounded trace export to an operator-managed host collector. Native LangSmith tracing and ambient OpenTelemetry exporter configuration remain disabled inside the sandbox.
Blueprint versioningNo NemoClaw blueprint; your image tag is whatever you built locally.NemoClaw downloads the blueprint artifact, checks version compatibility, and verifies its digest before applying.
Lifecycle stateNot included unless you build it.NemoClaw preserves manifest-declared Deep Agents state and omits credential-bearing user files from snapshots and rebuilds.
Host readiness and operationsYou inspect host prerequisites and operate OpenShell resources directly.NemoClaw provides read-only host readiness reporting, sandbox status and logs, recovery guidance, rebuild, snapshot, restore, and uninstall workflows.

When to Use Which

Use the following table to choose NemoClaw or custom OpenShell integration.

SituationPrefer
You want Deep Agents with NVIDIA defaults, managed inference routing, and the documented install and onboard flow.NemoClaw (nemo-deepagents)
You need maximum flexibility for custom images, a layout that does not match the NemoClaw Deep Agents blueprint, or an unsupported Deep Agents extension path.OpenShell with your own integration
You are standardizing on a managed terminal coding agent with sandbox policy and OpenShell-managed credentials.NemoClaw (nemo-deepagents)
You are building internal platform abstractions where the NemoClaw CLI or blueprint is not the right fit.OpenShell and your orchestration