Quickstart
Install NemoClaw and run your first sandboxed OpenClaw agent in minutes.
How It Works
Understand the plugin, blueprint, and sandbox lifecycle.
CLI Commands
Full reference for all
nemoclaw and openclaw nemoclaw commands.Architecture
Plugin structure, blueprint lifecycle, and sandbox environment.
What is NemoClaw?
NemoClaw is the OpenClaw plugin for NVIDIA OpenShell. It moves OpenClaw into a sandboxed environment where every network request, file access, and inference call is governed by declarative policy.NemoClaw is alpha software. Interfaces, APIs, and behavior may change without notice. It is shared to gather feedback and enable early experimentation — it is not yet production-ready.
Key capabilities
Sandboxed execution
Every agent runs inside an OpenShell sandbox with Landlock, seccomp, and network namespace isolation. No access is granted by default.
NVIDIA cloud inference
Agent traffic routes through cloud-hosted Nemotron 3 Super 120B via build.nvidia.com, transparent to the agent.
Declarative network policy
Egress rules are defined in YAML. Unknown hosts are blocked and surfaced to the operator for approval.
Blueprint lifecycle
Versioned blueprints handle sandbox creation, digest verification, and reproducible setup.
Single CLI
The
nemoclaw command orchestrates the full stack: gateway, sandbox, inference provider, and network policy.Remote GPU deployment
Deploy a sandboxed agent to a remote GPU instance via Brev for persistent operation.
How it fits together
| Component | Role |
|---|---|
| Plugin | TypeScript CLI commands for launch, connect, status, and logs. |
| Blueprint | Versioned Python artifact that orchestrates sandbox creation, policy, and inference setup. |
| Sandbox | Isolated OpenShell container running OpenClaw with policy-enforced egress and filesystem. |
| Inference | NVIDIA cloud model calls, routed through the OpenShell gateway, transparent to the agent. |