What Is NemoClaw?
NemoClaw is NVIDIA's open-source reference stack for running AI coding agents inside a hardened sandbox. It installs the agent (OpenClaw by default, plus Hermes and LangChain Deep Agents Code), the NVIDIA OpenShell sandbox runtime, and a routed inference layer in one command. Jensen Huang announced it at GTC 2026 on March 16, 2026.
The point is that policy lives outside the agent. NVIDIA's architecture docs put it plainly: rules are enforced at the sandbox boundary rather than in a system prompt, so a compromised agent cannot talk its way past them.
Who this is for. Teams already running OpenClaw on a server that holds something they care about: customer data, source code, internal APIs, PHI. If the agent can browse, shell out, and call APIs, a bad skill has a wide blast radius, and base OpenClaw has no mechanism to narrow it.
When not to use it. NemoClaw is Alpha, with no tagged releases on GitHub as of 2026-09-10. Skip it if you need a stable API surface, if you are running on anything outside the documented platform list (DGX OS on Spark or Station, Linux, macOS on Apple Silicon, Windows WSL2), or if you want it to be your only control for a regulated workload. The Cloud Security Alliance's March 2026 research note found it strong on runtime isolation and silent on behavioural drift, goal misalignment, and agent-to-agent trust, so it needs a monitoring layer beside it.
- GitHub: github.com/NVIDIA/NemoClaw
- License: Apache 2.0
- Status: Alpha. Maintainers review issues and PRs on a best-effort basis, and no release tags are published
- Agent support: OpenClaw (default), Hermes, LangChain Deep Agents Code
- Announced hardware: GeForce RTX PCs and laptops, RTX PRO workstations, DGX Station, DGX Spark (nvidianews.nvidia.com, March 2026)
Updated 2026-09-10: corrected the CLI from openshell inference set to nemoclaw inference set, replaced the invented /etc/nemoclaw/*.yaml paths with the real blueprint policy file, replaced the three-provider list with the documented provider set, corrected Node.js from 20+ to 22.19+, and rebuilt the hardware section around NVIDIA's published compute-capability requirements. The previous Liquid Web VPS recommendation was below NemoClaw's own minimum spec.
Why does NemoClaw exist?
Two things in early 2026 made enterprise-grade OpenClaw security urgent: a governance question about who controls the project, and a supply-chain problem in its extension marketplace. NVIDIA's answer was to stop trusting the agent process at all and enforce filesystem, network, and credential rules from outside it.
The OpenAI move (February 2026). OpenClaw's creator Peter Steinberger announced on February 14, 2026 that he was joining OpenAI "to work on bringing agents to everyone." OpenAI already sponsors the project, and Steinberger said he is working on moving OpenClaw to a foundation so it stays open and independent. That is a real commitment, but it is a personal hire plus a sponsorship deal, not a guarantee written into code.
The ClawHub supply chain problem. Independent security researchers reported malicious skills in the ClawHub marketplace (OpenClaw's community extension registry), plus a large number of OpenClaw instances reachable from the internet with no authentication. The exact counts vary by outlet and the original report is no longer online, so this page will not repeat a number it cannot stand behind. The mechanism is not in dispute: a single compromised skill can exfiltrate any file the agent process can read, make arbitrary outbound calls, and persist across restarts.
NVIDIA also built OpenShell to slot into tooling enterprises already run. It worked with Microsoft Security, CrowdStrike, and Cisco on compatibility so OpenShell telemetry reaches existing EDR and SIEM pipelines rather than forming a second, parallel governance stack.
What does NemoClaw add over bare OpenClaw?
Five things: a filesystem confinement boundary, a network egress allowlist, syscall filtering, a structured audit trail, and credential brokering so the agent never holds a raw provider key. None of them require you to change how you write skills or prompts.
| Capability | OpenClaw (bare) | OpenClaw + NemoClaw |
|---|---|---|
| Filesystem access control | None: agent reads any file the process user can access | Landlock confines the agent to /sandbox and /tmp read-write; system paths are read-only |
| Network egress control | None: agent can call any host | Named network_policies routes with per-host, per-port, per-method allow rules |
| Provider credentials | Agent process holds the API key | L7 proxy injects credentials at egress. "NemoClaw never gives the sandbox a raw provider key" |
| Malicious skill containment | No: a compromised skill runs with full process privileges | Sandboxed: Landlock + seccomp + network namespace limit blast radius |
| Skills supply chain risk | High: malicious skills have shown up on ClawHub | Mitigated: a skill can only reach allowlisted hosts and its own workspace |
| Inference portability | Fixed per config restart | nemoclaw inference set swaps provider or model in place |
| Behavioural monitoring | None | Still none. CSA flags this as the main residual gap |
That last row matters. NemoClaw contains what an agent can reach. It does not judge whether what the agent is doing inside those bounds is what you wanted.
How does NemoClaw relate to OpenClaw?
NemoClaw is not a fork or a replacement. It is a wrapper with three parts: a Node.js host CLI that orchestrates OpenShell, the OpenShell gateway process that manages credentials and sandbox lifecycle on the host, and a Docker container that runs the agent runtime. OpenClaw runs inside that container.
It is not OpenClaw-only, either. NVIDIA's README lists Hermes and LangChain Deep Agents Code as supported runtimes alongside OpenClaw, which is just the default. The wrapping mechanism is the same whichever agent you point it at.
Configuration is not scattered across /etc. The sandbox image, its policies, and its inference profiles come from a versioned YAML blueprint that ships with the project, with the OpenClaw defaults in nemoclaw-blueprint/policies/openclaw-sandbox.yaml.
NemoClaw host CLI → OpenShell gateway (credentials, L7 proxy) → Sandbox container (agent runtime)
↓
Routed inference (NVIDIA endpoints / Ollama / vLLM / OpenAI / Anthropic / ...)
How does the OpenShell sandbox actually contain an agent?
Three kernel mechanisms plus one userspace one. Landlock restricts which paths the process can open. seccomp restricts which syscalls it can make. A per-sandbox network namespace isolates its traffic. On top of those, an L7 proxy inspects outbound requests and substitutes real credentials at the boundary.
Landlock: filesystem confinement
Landlock is a Linux kernel feature that restricts which files and directories a process can read or write. The shipped OpenClaw policy grants read-write access to a short list and leaves everything else read-only:
/sandbox/.openclawand/sandbox/.nemoclawfor agent and plugin state/tmpfor scratch files/dev/ptsfor PTY slave devices, which tmux sessions need/home/linuxbrewfor Homebrew package installs
Read-only paths cover /usr, /lib, /etc, the application binaries in /app, and package metadata in /var/lib/dpkg. The agent cannot write to system paths or read a home directory outside the sandbox. The policy file also carries a landlock key that sets kernel compatibility mode, which matters on hosts whose kernel predates the Landlock features the policy wants.
seccomp: syscall filtering
seccomp restricts which Linux system calls the sandboxed process can make. It runs alongside Landlock as the second kernel-level control in the same sandbox definition, so a skill cannot reach for raw sockets or process tracing to work around the filesystem and network rules.
Network policies: egress allowlist
Outbound traffic is expressed as named routes in network_policies. Each route names endpoints (host, port, protocol), an enforcement mode of enforce or best_effort, per-method and per-path rules, and the binaries allowed to use it. The shipped OpenClaw policy allowlists a deliberately short set:
| Endpoint | Purpose |
|---|---|
integrate.api.nvidia.com:443 | NVIDIA inference API |
inference.local:443 | Managed inference gateway |
clawhub.ai:443 | Plugin registry (GET/POST) |
openclaw.ai:443 | Platform API (GET/POST) |
docs.openclaw.ai:443 | Documentation (GET only) |
registry.npmjs.org:443 | npm packages (GET only, restricted to the openclaw binary) |
Note what is absent: no general-purpose web egress. Add hosts with nemoclaw <name> policy add rather than by hand-editing a running sandbox, and keep the per-binary restriction if you can. A route that only the openclaw binary may use is much harder for injected skill code to abuse than one open to every process in the container.
Which inference providers can NemoClaw use?
More than the NVIDIA ones. NVIDIA documents NVIDIA endpoints, NIM and NIM-local, OpenRouter, OpenAI,
Anthropic, Google Gemini, Model Router, Ollama, vLLM, llama.cpp, the Hermes provider, and any custom
OpenAI-compatible or Anthropic-compatible endpoint. Check NVIDIA's provider-selection page for the
current list before you plan around a specific one. Local inference runs through provider paths such
as ollama-local, vllm-local and compatible-endpoint.
All of them route the same way. Inference requests never leave the sandbox directly. OpenShell intercepts them, injects the credential at the L7 proxy, and forwards to whichever upstream you selected.
Cloud (NVIDIA endpoints). No GPU required. The default path, and the one worth starting on while you tune policy.
Ollama (local). The default local option, auto-detected by the onboarding wizard if it is already running. NemoClaw picks qwen3.6:35b from its starter list when GPU memory can fit it, and falls back to the largest starter model that does fit otherwise.
vLLM (local). Either a managed container NemoClaw installs, or a server you already run. The endpoint is http://host.openshell.internal:8000/v1. Non-interactive setup looks like this:
NEMOCLAW_PROVIDER=install-vllm \
NEMOCLAW_VLLM_MODEL=qwen3.6-35b-a3b-nvfp4 \
nemoclaw onboard --non-interactive
Model Router. Selecting this points the gateway at a host-side router process instead of a single upstream, which is how you get per-task local-versus-cloud routing rather than an all-or-nothing choice.
Can you switch inference providers without downtime?
Mostly yes. One command changes the route, and whether anything restarts depends on what you changed. Staying inside the same API family hot-reloads without replacing the gateway process. Crossing API families commits the route, restarts only the OpenClaw gateway, and verifies its health.
# Point a sandbox at a local vLLM model
nemoclaw inference set --provider vllm-local --model qwen3.6-27b --sandbox my-assistant
# List registered providers and their canonical IDs
nemoclaw credentials list
# Check the current sandbox and inference state
nemoclaw status
If you registered more than one sandbox, either set a default with nemoclaw use <name> or pass --sandbox <name> on every nemoclaw inference set call.
This is the main lever for cost control: run local during the working day when the GPU is already paid for, and fail over to a cloud endpoint overnight rather than idling a rented H100.
What hardware do you need, and what does it cost?
The sandbox itself needs no GPU. NVIDIA's prerequisites list 4 vCPU, 8 GB RAM and 20 GB free disk as the minimum, 16 GB RAM and 40 GB disk recommended, with the sandbox image at roughly 2.4 GB compressed. A GPU only enters the picture when you move inference on-premises, and then the model, not NemoClaw, sets the bar.
Host requirements (any provider)
| Resource | Minimum | Recommended |
|---|---|---|
| Platforms with a documented install path | DGX OS (Spark), DGX OS (Station), Linux, macOS (Apple Silicon), Windows WSL2 | — |
| CPU | 4 vCPU | 4+ vCPU |
| RAM | 8 GB | 16 GB |
| Disk | 20 GB free | 40 GB free |
| Node.js | 22.19 or later | — |
| npm | 10 or later | — |
| Python | Python 3 at a trusted system location | — |
| Container runtime | Docker Engine, Docker Desktop, Colima, or rootless Podman (platform-dependent) | Docker is the primary onboarding path |
Below 8 GB of RAM the OOM killer becomes a real risk during pipeline use; NVIDIA suggests at least 8 GB of swap as a workaround if you cannot add memory.
Cost for a cloud-inference deployment. A Liquid Web managed VPS at 8 GB RAM and 4 vCPU with 240 GB SSD costs $50/mo subject to change · verified 2026-09-10 on the current 50%-off-for-two-months promo and $100/mo subject to change · verified 2026-09-10 at list. Do not size down to their 4 GB plan: it ships 2 vCPU, which is below NemoClaw's stated 4 vCPU minimum.
GPU requirements for local inference
NemoClaw's managed vLLM profiles publish a minimum CUDA compute capability per model. Match that number against the GPU you are about to rent, because a card that is merely large enough will still be refused:
| Model slug | Min. compute capability | Cheapest Liquid Web GPU that clears it |
|---|---|---|
nemotron-3-nano-4b | 8.9 | L4 Ada 24 GB, $0.80/hr subject to change · verified 2026-09-10 |
qwen3.6-27b | 8.9 | L40S Ada 48 GB, $1.44/hr subject to change · verified 2026-09-10 |
nemotron-3.5-lightning-30b | 9.0 (Linux) | H100 NVL 94 GB, $2.98/hr subject to change · verified 2026-09-10 |
muse-glimmer-30b | 12.0 (Linux) | Not available. Needs Blackwell (RTX PRO 6000, RTX 5090, per NVIDIA's CUDA GPU list) |
qwen3.6-35b-a3b-nvfp4 | 12.1, DGX Spark and N1x only | Not available on rented server GPUs |
nemotron-3-ultra-550b-a55b | 10.0, DGX Station only | Not available |
Liquid Web's GPU fleet is L4 and L40S (compute capability 8.9) plus H100 NVL and H200 NVL (9.0). That covers the first three rows and nothing below them. NVIDIA's own CUDA GPU list puts RTX PRO 6000 Blackwell and GeForce RTX 5090 at 12.0, which is why the Blackwell-only profiles are a workstation or DGX story, not a rented-server one.
Running the clock. An L40S at $1.44/hr subject to change · verified 2026-09-10 left on continuously is about $1,050 a month at 730 hours. An H100 NVL at $2.98/hr subject to change · verified 2026-09-10 is about $2,175. Those are the numbers to compare against your cloud inference bill before deciding local is cheaper.
About Nemotron 3 Super 120B-A12B. It is a 120B mixture-of-experts model with roughly 12.7B parameters active per token, so people assume it fits one big card. NVIDIA's own NIM deployment doc says otherwise: the self-hosted Docker path calls for 3× H100, 3× B200, or 3× RTX PRO 6000, and the Helm path for nine of them. Liquid Web's largest single-node option is 2× H200 NVL at 282 GB, $5.39/hr subject to change · verified 2026-09-10, so confirm a tensor-parallel profile exists for your exact GPU count before you commit. For most teams, Super belongs on NVIDIA's hosted endpoints and a 27B or 30B model belongs on your own GPU.
How do you install NemoClaw?
One command, then two decisions. The installer script sets the agent and sandbox name via environment variables and runs readiness checks before it touches anything. Full walkthrough is in the VPS deployment guide.
curl -fsSL https://www.nvidia.com/nemoclaw.sh | \
NEMOCLAW_AGENT=openclaw \
NEMOCLAW_SANDBOX_NAME=my-assistant \
NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 \
bash -s -- --non-interactive
The installer's own --help lists exactly seven options: --non-interactive, --station-deepseek,
--yes-i-accept-third-party-software, --defer-onboarding, --fresh, --force-station-install,
plus --version and --help. There is no flag that selects the local model runtime, so pick the
inference provider during onboarding rather than on the install line. If you plan to use managed
vLLM, export HF_TOKEN before the curl so the model download can authenticate. After onboarding: nemoclaw status to confirm the sandbox and route, nemoclaw resources to see what hardware NemoClaw detected, and nemoclaw <name> policy add to extend the egress allowlist. nemoclaw launch <name> starts the agent.
Manage the sandbox through the NemoClaw CLI, not OpenShell directly. NVIDIA's command reference specifically warns against running openshell sandbox create or openshell self-update against a NemoClaw-managed environment.
What should you know before adopting an Alpha?
Three things: there is no version to pin to, the security review that exists is a research note rather than an audit, and the gaps it names are the ones that matter for regulated work. Treat NemoClaw as one layer, not the control.
- There are no release tags. The GitHub repository publishes no releases as of 2026-09-10, and the docs site's earliest published version is 0.0.1. Pin by commit SHA and record which one you deployed, because
latestwill move under you. - Test upgrades in staging. NVIDIA's own stated priorities are installation reliability, sandbox hardening, and keeping docs aligned with supported workflows, which is Alpha-speak for expect churn.
- Provider switches have rough edges. Open issues track provider-specific behaviour differences, for example #2403, where the
compatible-endpointprovider ignoresNEMOCLAW_LOCAL_INFERENCE_TIMEOUTand a 60-second default leaks through to reasoning-model streams. Re-runnemoclaw statusafter every route change. - No third-party audit exists. The Cloud Security Alliance published a draft research note on 2026-03-27 that describes NemoClaw as meaningful but architecturally incomplete: strong on runtime isolation, with no baseline profiling for behavioural drift, no detection of goal misalignment inside authorised policy bounds, no trust model for agent-to-agent communication, and no persistent agent identity across sessions. Its recommendations are to instrument in parallel with a SIEM, scope policy before rollout, and review policy quarterly. Layer NemoClaw with infrastructure controls (see the HIPAA deployment guide).
No. NemoClaw is Alpha. NVIDIA's own repository states that maintainers review issues, discussions and pull requests on a best-effort basis, and no release tags are published as of 2026-09-10. Use it in development and staging, pin to a specific commit, and plan for breaking changes between versions.
Only for local inference. The sandbox and OpenShell runtime are CPU-only: NVIDIA's prerequisites list 4 vCPU, 8 GB RAM and 20 GB free disk, with no GPU line. If you route inference to NVIDIA endpoints, OpenAI, Anthropic or any other hosted provider, a plain Linux VPS meeting that spec is enough. A Liquid Web 8 GB / 4 vCPU managed VPS is $50/mo on promo and $100/mo at list, verified 2026-09-10.
It depends on the model, and NemoClaw publishes a minimum CUDA compute capability for each of its managed vLLM profiles. nemotron-3-nano-4b and qwen3.6-27b need 8.9, which an L4 or L40S clears. nemotron-3.5-lightning-30b needs 9.0 on Linux, so H100 or H200 class. muse-glimmer-30b and qwen3.6-35b-a3b-nvfp4 need 12.0 and 12.1, which means Blackwell workstation or DGX hardware, not a rented server GPU.
Yes. The documented provider set includes OpenAI, Anthropic, Google Gemini, OpenRouter, Ollama, vLLM, and any custom OpenAI-compatible or Anthropic-compatible endpoint, alongside NVIDIA endpoints. Local vLLM and Ollama routes use local provider tokens rather than OPENAI_API_KEY. You are not locked into Nemotron.
OpenShell is NVIDIA's sandbox runtime that NemoClaw uses to isolate agent processes. It combines Landlock filesystem confinement, seccomp syscall filtering, and per-sandbox network namespaces, plus a host-side gateway that runs an L7 proxy. The proxy injects provider credentials at the network boundary, so the sandbox never holds a raw API key.
They share brand lineage but are separate projects. NVIDIA NeMo is a software suite for building and optimising AI models and agents. NemoClaw is a reference stack that runs an existing agent runtime inside an OpenShell sandbox with policy-enforced filesystem, network and credential boundaries. The naming reflects NVIDIA's agent-stack branding, not a technical dependency.
Substantially, within its remit. Landlock confines the agent and anything it loads to /sandbox and /tmp for writes, with system paths read-only, so a skill cannot read a home directory or write to system paths. Network policies allow only named hosts, ports and methods, and can restrict a route to a specific binary. The L7 proxy means a skill that does exfiltrate something never sees your provider API key. What it does not do is judge intent: the Cloud Security Alliance's March 2026 note flags that NemoClaw has no behavioural-drift or goal-misalignment detection inside authorised policy bounds.
Related articles
- NemoClaw policy cookbook: Colang policy recipes for content DLP, HIPAA, and skill gating
- HIPAA deployment guide: add Liquid Web HIPAA-ready environment alongside NemoClaw
- vs Alternatives: NemoClaw vs open-source guardrail alternatives
Common mistakes and fixes
NemoClaw install fails a readiness check.
`nemoclaw onboard` runs readiness checks covering distribution, architecture, product and firmware identity, GPU and memory, NVIDIA driver, Container Toolkit, Docker, Node.js and disk space. Run `nemoclaw host probe` to see which check failed, then fix that dependency. Node.js must be 22.19 or later and npm 10 or later.
vLLM inference provider returns connection refused.
NemoClaw reaches a self-run vLLM server at `http://host.openshell.internal:8000/v1`, so vLLM must bind to 0.0.0.0 rather than 127.0.0.1. Start it with `--host 0.0.0.0 --port 8000` and allow the container bridge subnet to reach port 8000 on the host firewall.
Sandbox image download is slow on first run.
The sandbox image is approximately 2.4 GB compressed, per NVIDIA's prerequisites page, and downloads once. Budget 20 GB of free disk minimum and 40 GB if you plan to keep snapshots.