> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# About Inference Routing

> Understand how NemoClaw routes sandbox inference through OpenShell without exposing provider credentials.

NemoClaw gives agents one managed inference route while OpenShell handles the selected upstream provider on the host.
This design keeps provider selection and credentials outside the sandbox.

## Request Path

The agent sends inference requests to `inference.local` inside the sandbox.
It does not connect to the upstream provider directly.
OpenShell intercepts the request on the host and forwards it to the provider and model selected during onboarding.

```text
Sandbox agent -> inference.local -> OpenShell -> selected provider and model
```

Host-side services such as Model Router and the OpenRouter runtime adapter remain behind the OpenShell route.
The sandbox continues to use `inference.local` instead of calling their host ports directly.

## Credential Boundary

Provider credentials stay on the host and flow through the OpenShell provider system.
The sandbox does not receive the raw upstream API key.

Local Ollama and local vLLM routes do not require the host `OPENAI_API_KEY`.
NemoClaw uses provider-specific local tokens for those routes.
Rebuilds of legacy local-inference sandboxes migrate away from stale OpenAI credential requirements.

## Related Topics

* [Choose an Inference Provider](learn-and-choose/choose-inference-provider) compares the upstream routes that OpenShell can use.
* [View the Active Inference Route](manage-inference/view-active-inference-route) shows the provider and model currently selected.
* [Verify the Sandbox Inference Route](validate-inference/verify-inference-route) tests the configured path.