NemoClaw is NVIDIA's open-source reference stack for running always-on AI agents more safely inside NVIDIA OpenShell sandboxes. It addresses the risk of letting persistent agents run with broad host access: instead of installing an agent directly on a machine, NemoClaw wraps it in a hardened sandbox with guided onboarding, a hardened blueprint, routed inference, network egress policy, and lifecycle management, all driven through a single CLI. It currently supports OpenClaw (the default), Hermes, and LangChain Deep Agents Code.
Onboarding works two ways: an interactive terminal installer, or a starter prompt that lets a local coding agent (Cursor, Claude Code, Codex, Copilot, etc.) walk through the install using NemoClaw's docs and skills — asking one question at a time, running commands only with approval, and keeping secrets out of chat. Security controls documented in the stack include container hardening with capability drops and process limits, baseline network rules with an operator approval flow for egress, credential handling, and posture profiles. The project is in alpha, with contributor tooling kept separate from the end-user install path.
