NVIDIA NemoClaw
A secure reference stack for operating always-on agents in NVIDIA OpenShell sandboxes.
- Source repo
- NVIDIA/NemoClaw
- Stars
- ★ 23k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 65/100 · Some gaps
At a glance
- How it runs
- Works with
- Platform-specific
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An operations team running OpenClaw continuously and wanting its lifecycle managed inside an NVIDIA OpenShell sandbox.
- Not a fit if
- Teams not already using NVIDIA OpenShell, since execution depends on it
- Users needing stable production support; it is alpha with best-effort responses
- Anyone wanting zero-config agents; network policy and inference routing need decisions
- Source review
- 65/100 · Some gaps
What does this agent do, and when should you use it?
NVIDIA NemoClaw is an open-source reference stack for running always-on AI agents inside NVIDIA OpenShell sandboxes. It supports OpenClaw by default, plus Hermes and LangChain Deep Agents Code, with guided onboarding, a hardened blueprint, routed inference, network policy, and lifecycle management through one CLI. Its deployment boundary is the OpenShell sandbox rather than a standalone hosted agent service, and it distinguishes end-user installation from contributor setup. It fits teams that have chosen OpenShell and need a managed security envelope for persistent agent workloads.
NemoClaw installs and configures a runtime that runs a supported agent inside an NVIDIA OpenShell sandbox. Its single CLI manages the sandbox lifecycle, applies a hardened blueprint, routes inference, and governs egress through network policy. OpenClaw is the default agent; for Hermes, users set NEMOCLAW_AGENT=hermes before the installer or use the nemohermes alias after installation. Contributors can run ./scripts/dev-setup.sh to prepare a checkout; its default and --repair modes affect repository-local dependencies, builds, and hooks.
- An operations team running OpenClaw continuously and wanting its lifecycle managed inside an NVIDIA OpenShell sandbox.
- A Hermes user who needs to select Hermes before installation and access the installed workflow through the nemohermes alias.
- A team using LangChain Deep Agents Code that wants to place it within the same OpenShell-based security boundary.
- A security owner who needs to control an agent's network egress through policies and an operator approval flow.
- A first-time contributor preparing a NemoClaw pull request with ./scripts/dev-setup.sh before making code changes.
How do you install or deploy this agent?
The available material does not include the exact interactive-installer command, so a verified copyable end-user install command cannot be provided. Review Prerequisites first; to select Hermes, set NEMOCLAW_AGENT=hermes before running the documented installer. Contributors can run ./scripts/dev-setup.sh. Use ./scripts/dev-setup.sh --expose-cli only when a host-visible development CLI is explicitly wanted, and use ./scripts/dev-setup.sh --with-runtime only when sandbox validation is needed.
How do you use this agent?
The available material does not specify CLI subcommands, the first sandbox-creation command, inference-provider credentials, or a full configuration example. The documented path is to choose OpenClaw, Hermes, or LangChain Deep Agents Code and follow that agent's quickstart, then use the unified CLI for sandbox management, routed inference, and network policy. Hermes users can use the nemohermes alias after installation; provider setup follows the documented “Choose an Inference Provider” flow.
What are this agent's strengths and limitations?
- Brings OpenClaw, Hermes, and LangChain Deep Agents Code under one OpenShell-based sandbox and lifecycle-management model.
- Concentrates hardened blueprints, routed inference, and network policy in a single CLI control surface.
- Explicitly includes egress control and an operator approval flow for environments that govern agent network access.
- Separates contributor setup from end-user runtime installation, and the default development setup does not create a runtime sandbox.
- Its core execution model depends on NVIDIA OpenShell; the material does not establish a deployment path outside that environment.
- It is an alpha project, with issues, discussions, and pull requests handled on a best-effort basis and no guaranteed response timeline.
- The material does not provide the installer command, CLI command list, supported inference-provider list, or credential configuration format.
- Network policy, inference routing, and sandbox hardening introduce runtime configuration and security decisions beyond a zero-config agent wrapper.
How does this agent compare with similar options?
NemoClaw is layered on OpenShell sandboxes: OpenShell supplies the sandbox foundation, while NemoClaw adds guided onboarding, hardened blueprints, routed inference, network policy, and lifecycle management for supported agents. The available material does not provide a feature-by-feature comparison with using OpenShell alone.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| NVIDIA NemoClaw This agent | 65 · Some gaps | CLIFree + model costs | ★ 23k | today | TypeScript | — |
| Greywall Agent Sandbox | 80 · Good | CLIFree | ★ 313 | 2mo ago | Go | Codex · Claude Code |
| HermesClaw | 53 · Major gaps | Self-hosted serviceFree + model costs | ★ 758 | 16d ago | Python | — |
| h5i — A Security-First Headless Browser for AI Agents | 84 · Good | CLIFree | ★ 893 | today | Rust | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows emphasis on least privilege: sandboxing, capability drops, process limits, network policies, credential handling (e.g., Ollama proxy bind probe, read-only tools). User confirmation: install requires confirmation, agent commands require approval. Data flow transparency: docs describe architecture and data flow. Sensitive data handling: credential handling has compensating controls. Dependency security: npm audit and patches. External effects: network policies and sandbox restrictions. Rollback: snapshots and lifecycle operations mentioned but details thin. Source attribution: clear NVIDIA attribution.
Self-consistency: docs and code align. Dependency availability: lock files and audit. Failure messages: structured errors and exit codes.
Audience and scenarios: developers and multiple agents. Capability boundaries: clear which agents supported. Trigger precision: CLI commands and skills clear. Environment fit: supports DGX and WSL.
Information architecture: clear docs structure. Install notes: detailed guides. Naming stability: CLI names stable. Examples and FAQ: quickstarts. Known limitations: documented. License: Apache-2.0. Versioning and changelog: version scripts but no CHANGELOG. Maintenance responsibility: community support clear.
Output usability: structured CLI output. Marginal value: provides secure sandbox. Cost benefit: open source free.
Claim traceability: docs and code correspond. Cross-source corroboration: tests exist. Fact/inference separation: docs distinguish.
- Static review, no execution, low confidence.
- Rollback mechanism details insufficient, need further verification.
- Versioning and changelog incomplete, missing CHANGELOG.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Pinned CI toolchains for NemoClaw's native Podman E2E jobs. These assets preserve existing reviewed binaries so E2E startup no longer depends on expiring GitHub Actions artifacts. Recovered without modification from trusted main E2E run 36537895087, generate-matrix job 109331743180, at commit 2272c5c15dd873c79436120ac0bfd21f70ae962e. That job staged the original toolchains through action 8d7409d66a0e664829f9ddab177aa8460974291f before candidate checkout, verifying source run 33211526093 and its artifact identities. The original source artifacts have since expired. …View on GitHub ↗