NVIDIA NemoClaw: OpenClaw Plugin for OpenShell

NVIDIA NemoClaw is an open source reference stack that simplifies running OpenClaw always-on assistants safely. It installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, a secure environment for running autonomous agents, and open source models such as NVIDIA Nemotron.

Alpha software

NemoClaw is available in early preview starting March 16, 2026. Interfaces, APIs, and behavior may change without notice as we iterate on the design. The project is shared to gather feedback and enable early experimentation. We welcome issues and discussion from the community while the project evolves.

Quick Start

Follow these steps to get started with NemoClaw and your first sandboxed OpenClaw agent.

ℹ️ Note

NemoClaw creates a fresh OpenClaw instance inside the sandbox during onboarding.

Prerequisites

Check the prerequisites before you start to ensure you have the necessary software and hardware to run NemoClaw.

Hardware

The sandbox image is approximately 2.4 GB compressed. During image push, the Docker daemon, k3s, and the OpenShell gateway run alongside the export pipeline, which buffers decompressed layers in memory. On machines with less than 8 GB of RAM, this combined usage can trigger the OOM killer. If you cannot add memory, configuring at least 8 GB of swap can work around the issue at the cost of slower performance.

Software

Container Runtime Support

💡 Tip

For DGX Spark, follow the DGX Spark setup guide. It covers Spark-specific prerequisites, such as cgroup v2 and Docker configuration, before running the standard installer.

Install NemoClaw and Onboard OpenClaw Agent

Download and run the installer script. The script installs Node.js if it is not already present, then runs the guided onboard wizard to create a sandbox, configure inference, and apply security policies.

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

If you use nvm or fnm to manage Node.js, the installer may not update your current shell's PATH. If nemoclaw is not found after install, run source ~/.bashrc (or source ~/.zshrc for zsh) or open a new terminal.

When the install completes, a summary confirms the running environment:

──────────────────────────────────────────────────
Sandbox      my-assistant (Landlock + seccomp + netns)
Model        nvidia/nemotron-3-super-120b-a12b (NVIDIA Cloud API)
──────────────────────────────────────────────────
Run:         nemoclaw my-assistant connect
Status:      nemoclaw my-assistant status
Logs:        nemoclaw my-assistant logs --follow
──────────────────────────────────────────────────

[INFO]  === Installation complete ===

Chat with the Agent

Connect to the sandbox, then chat with the agent through the TUI or the CLI.

Connect to the Sandbox

Run the following command to connect to the sandbox:

nemoclaw my-assistant connect

This connects you to the sandbox shell sandbox@my-assistant:~$ where you can run openclaw commands.

OpenClaw TUI

In the sandbox shell, run the following command to open the OpenClaw TUI, which opens an interactive chat interface.

openclaw tui

Send a test message to the agent and verify you receive a response.

ℹ️ Note

The TUI is best for interactive back-and-forth. If you need the full text of a long response such as a large code generation output, use the CLI instead.

OpenClaw CLI

In the sandbox shell, run the following command to send a single message and print the response:

openclaw agent --agent main --local -m "hello" --session-id test

This prints the complete response directly in the terminal and avoids relying on the TUI view for long output.

Uninstall

To remove NemoClaw and all resources created during setup, in the terminal outside the sandbox, run:

curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash

The script removes sandboxes, the NemoClaw gateway and providers, related Docker images and containers, local state directories, and the global nemoclaw npm package. It does not remove shared system tooling such as Docker, Node.js, npm, or Ollama.

For example, to skip the confirmation prompt:

curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash -s -- --yes

How It Works

NemoClaw installs the NVIDIA OpenShell runtime and Nemotron models, then uses a versioned blueprint to create a sandboxed environment where every network request, file access, and inference call is governed by declarative policy. The nemoclaw CLI orchestrates the full stack: OpenShell gateway, sandbox, inference provider, and network policy.

The blueprint lifecycle follows four stages: resolve the artifact, verify its digest, plan the resources, and apply through the OpenShell CLI.

When something goes wrong, errors may originate from either NemoClaw or the OpenShell layer underneath. Run nemoclaw <name> status for NemoClaw-level health and openshell sandbox list to check the underlying sandbox state.

Inference

Inference requests from the agent never leave the sandbox directly. OpenShell intercepts every call and routes it to the NVIDIA cloud provider.

Get an API key from build.nvidia.com. The nemoclaw onboard command prompts for this key during setup.

Local inference options such as Ollama and vLLM are still experimental. On macOS, they also depend on OpenShell host-routing support in addition to the local service itself being reachable on the host.

Protection Layers

The sandbox starts with a strict baseline policy that controls network egress and filesystem access:

When the agent tries to reach an unlisted host, OpenShell blocks the request and surfaces it in the TUI for operator approval.

Key Commands

Host commands (nemoclaw)

Run these on the host to set up, connect to, and manage sandboxes.

Plugin commands (openclaw nemoclaw)

Run these inside the OpenClaw CLI. These commands are under active development and may not all be functional yet.

See the full CLI reference for all commands, flags, and options.

Known limitations:

• The openclaw nemoclaw plugin commands are under active development. Use the nemoclaw host CLI as the primary interface.
• Setup may require manual workarounds on some platforms. File an issue if you encounter blockers.

Learn More

Refer to the documentation for more information on NemoClaw.

• Overview: Learn what NemoClaw does and how it fits together.
• How It Works: Learn about the plugin, blueprint, and sandbox lifecycle.
• Architecture: Learn about the plugin structure, blueprint lifecycle, and sandbox environment.
• Inference Profiles: Learn about the NVIDIA cloud inference configuration.
• Network Policies: Learn about egress control and policy customization.
• CLI Commands: Learn about the full command reference.
• Troubleshooting: Troubleshoot common issues and resolution steps.
• Discord: Join the community for questions and discussion.

License

This project is licensed under the Apache License 2.0.