NVIDIA NemoClaw: Reference Stack for Sandboxed AI Agents in OpenShell

NVIDIA NemoClaw is an open source reference stack for running always-on AI agents more safely inside NVIDIA OpenShell sandboxes. It provides guided onboarding, a hardened blueprint, routed inference, network policy, and lifecycle management through a single CLI.

Supported agents:

• OpenClaw (default)
• Hermes
• LangChain Deep Agents Code

For capabilities, architecture, security controls, and the full feature list, see the NemoClaw documentation.

Get Started

Start with Your Coding Agent

Use the starter prompt when you want Cursor, Claude Code, Codex, Copilot, or another local coding agent to install NemoClaw with you.

Copy the NemoClaw starter prompt.

The prompt tells your agent to use NemoClaw docs and skills, ask one question at a time, run commands only with your approval, and keep secrets out of chat.

Install Using the Interactive Installer in Your Terminal

Review Prerequisites before installing. For Hermes, set NEMOCLAW_AGENT=hermes before running the installer, or use the nemohermes alias after install. When connecting to a Hermes sandbox from a light terminal, NemoClaw may install a managed nemoclaw-light Hermes skin for readable assistant text; it removes that managed skin state again when the terminal no longer needs it and preserves any user-selected Hermes skin.

Agent	Guide
OpenClaw (default)	Quickstart with OpenClaw
Hermes	Quickstart with Hermes
LangChain Deep Agents Code	Quickstart with LangChain Deep Agents Code

Documentation

Refer to the following pages on the official documentation website for more information on NemoClaw.

Page	Description
Overview	What NemoClaw does and how it fits together.
Architecture Overview	High-level overview of Plugin, blueprint, sandbox lifecycle, and protection layers.
Ecosystem	How OpenClaw, OpenShell, and NemoClaw form a stack and when to use NemoClaw versus OpenShell alone.
Architecture Details	Detailed description of Plugin structure, blueprint lifecycle, sandbox environment, and host-side state.
Prerequisites	Hardware, software, and supported platforms, with any platform-specific pre-setup.
Choose an Inference Provider	Supported providers, validation, and routed inference configuration.
Network Policies	Baseline rules, operator approval flow, and egress control.
Customize Network Policy	Static and dynamic policy changes, presets.
Security Best Practices	Controls reference, risk framework, and posture profiles for sandbox security.
Sandbox Hardening	Container security measures, capability drops, process limits.
CLI Commands	Full NemoClaw CLI command reference.
Troubleshooting	Common issues and resolution steps.

Community

Join the NemoClaw community to ask questions, share feedback, and report issues. NemoClaw is an alpha project, so maintainers review issues, discussions, and pull requests on a best effort basis without guaranteed response timelines.

Need	Channel
Setup or usage questions	GitHub Discussions or Discord
Reproducible bugs	GitHub Issues
Feature proposals	Start with GitHub Discussions, then open an issue when the scope is clear
Current priorities	Current Priorities
Contribution help	CONTRIBUTING.md
Security vulnerabilities	Use the private channels in SECURITY.md; do not open public issues

Contributing

We welcome contributions. See CONTRIBUTING.md for development setup, coding standards, and the PR process.

Prepare a source checkout without creating a runtime sandbox:

./scripts/dev-setup.sh

Or ask a compatible coding agent to use the repository's contributor-onboarding skill:

Set up this machine as a NemoClaw contributor and prepare it for a first PR.

The contributor path is separate from the end-user installer above. The default and --repair modes change only repository-local dependencies, builds, and hooks. Use ./scripts/dev-setup.sh --expose-cli only when you explicitly want a host-visible development CLI. Use ./scripts/dev-setup.sh --with-runtime only when your change needs sandbox validation; that approved flow also opts into CLI exposure.

Security

NVIDIA takes security seriously. If you discover a vulnerability in NemoClaw, DO NOT open a public issue. Use one of the private reporting channels described in SECURITY.md:

• Submit a report through the NVIDIA Vulnerability Disclosure Program.
• Send an email to psirt@nvidia.com encrypted with the NVIDIA PGP key.
• Use GitHub's private vulnerability reporting to submit a report directly on this repository.

For security bulletins and PSIRT policies, visit the NVIDIA Product Security portal.

Current Priorities

NemoClaw's current priorities are maintained here as a public orientation point for contributors and community members. This list is not a delivery commitment, support promise, or fixed roadmap; priorities can change as maintainers respond to security, quality, platform readiness, and community feedback.

• Improve install and onboarding reliability across tested platforms.
• Strengthen sandbox hardening, credential handling, and network-policy defaults.
• Validate local and routed inference behavior for supported provider paths.
• Keep documentation, troubleshooting guidance, and agent skills aligned with supported workflows.

For specific scoped work, use GitHub Issues and start broader proposals in GitHub Discussions. Security vulnerabilities must use the private reporting channels in SECURITY.md, not public issues.

Notice and Disclaimer

This software automatically retrieves, accesses or interacts with external materials. Those retrieved materials are not distributed with this software and are governed solely by separate terms, conditions and licenses. You are solely responsible for finding, reviewing and complying with all applicable terms, conditions, and licenses, and for verifying the security, integrity and suitability of any retrieved materials for your specific use case. This software is provided "AS IS", without warranty of any kind. The author makes no representations or warranties regarding any retrieved materials, and assumes no liability for any losses, damages, liabilities or legal consequences from your use or inability to use this software or any retrieved materials. Use this software and the retrieved materials at your own risk.

License

Apache 2.0. See LICENSE.