Understand Gateway and Secret Controls
NemoClaw applies gateway access controls when the selected agent runtime exposes an in-sandbox gateway or dashboard. CLI secret redaction and runtime-specific memory guidance apply across guide variants.
OpenShell Gateway Authentication
On Docker-driver deployments, NemoClaw gives host CLI calls and sandbox callbacks separate authenticated paths to the OpenShell gateway.
Gateway Compatibility Container
On Linux hosts whose glibc is older than the OpenShell gateway binary requires, NemoClaw can run openshell-gateway in a Docker compatibility container so the Docker-driver gateway still starts.
This path requires the explicit opt-in NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1.
OpenShell owns the native Linux glibc support floor. NemoClaw owns the explicit opt-in, host-networking configuration, read-only socket mount, and gateway authentication controls for this fallback. Remove the fallback when every supported Linux host meets OpenShell’s native floor and the gateway authentication and upgrade tests pass for the release candidate without the flag.
The OpenClaw gateway authenticates devices that connect to the Control UI dashboard. NemoClaw hardens these defaults at image build time.
Device Authentication
Device authentication requires each connecting device to go through a pairing flow before it can interact with the gateway.
OpenClaw’s native managed lifecycle runs the gateway and agent commands as the sandbox identity. Its authentication database and SQLite sidecars use owner-only modes, which protect them from other OS identities but do not create a privilege boundary between processes running as that same sandbox identity. The OpenShell sandbox remains the isolation boundary from the host. NemoClaw’s restored-clone approval path passes only the matching local device’s pending request, paired record, and credential to its bounded approval child; unrelated device credentials are not included.
Gateway Bind Address
NemoClaw binds the OpenShell gateway to loopback by default.
Dashboard Transport
OpenClaw 2026.9.1 retired gateway.controlUi.allowInsecureAuth, so NemoClaw no longer emits or suppresses findings for that flag. Keep non-loopback dashboards behind HTTPS; the default loopback URL remains http://127.0.0.1:18789.
NemoClaw no longer emits audit suppressions for the retired authentication flags.
For audit reporting, NemoClaw treats an onboard-time NEMOCLAW_DASHBOARD_BIND=0.0.0.0 setting or WSL’s default all-interface dashboard forward as remote dashboard exposure.
Outside WSL, a non-loopback CHAT_UI_URL changes the browser URL and its security settings but does not widen the host forward.
For an explicit NEMOCLAW_DASHBOARD_BIND=0.0.0.0 bind, use the same setting on later connect calls.
If the sandbox was created without that explicit setting, NemoClaw refuses the remote forward until you recreate it with NEMOCLAW_DASHBOARD_BIND=0.0.0.0 nemoclaw onboard --recreate-sandbox; this keeps the generated audit state aligned with the host exposure state.
On WSL, the ready summary still uses a loopback URL.
For an explicit remote bind with a loopback CHAT_UI_URL, NemoClaw enables OpenClaw’s Host-header origin fallback because the browser’s remote origin is not known at image-build time.
That setting expands access and must remain explicit; use HTTPS or an SSH local forward when possible.
In that state, NemoClaw does not add audit suppressions, so the Host-header fallback finding remains active.
Review the active findings, including the Host-header fallback finding described above:
Remove the underlying risky condition when dashboard compatibility no longer requires it.
Auto-Pair Client Allowlist
The auto-pair watcher automatically approves device pairing requests from recognized clients, so you do not need to manually approve the Control UI.
Approve Administrative Scopes Manually
NemoClaw automatically approves only the operator.pairing, operator.read, and operator.write scopes.
It never automatically approves operator.admin.
Operations that require that scope, such as creating a cron job, need your explicit approval.
From the host, open the prepared connect shell:
In that shell, run the administrative command once to create the pending request, and note the requestId in the failure.
Then inspect the pending requests:
Find that requestId, and verify that its client, device, and requested scopes match the operation you just attempted.
Approve that request by its requestId:
Retry the original administrative command after the approval succeeds.
Approve only the requestId emitted by your command and only the client, device, and scopes you expect.
Do not approve an unexpected client or an unrelated operator.admin request.
CLI Secret Redaction
The CLI automatically redacts secret patterns (API keys, bearer tokens, provider credentials) from command output and error messages before logging them.
Memory Secret Scanner
The NemoClaw plugin blocks the agent from writing likely secrets (API keys, tokens, private keys) into persistent memory files.
The scanner intercepts Write, Edit, and similar tool calls targeting memory and workspace paths before they reach disk.