NemoClaw: NVIDIA’s Runtime for Secure Agent Framework Execution
NemoClaw is an open-source runtime developed by NVIDIA designed to enhance the security of agent frameworks such as Hermes, LangChain Deep Agents, and OpenClaw. The project is tailored for teams deploying open agent frameworks in production environments, where security and operational reliability are critical.
Released in 2026 under the permissive Apache 2.0 license, NemoClaw is implemented in TypeScript and integrates with NVIDIA’s broader AI tooling ecosystem, including OpenShell and the NVIDIA Agent Toolkit. Its primary purpose is to mitigate risks associated with agent execution, such as unauthorized access, data leaks, and unintended system interactions.
The runtime operates as a reference stack, providing a standardized approach to sandboxing AI agents. It ensures that only qualified and supported agents are executed within isolated environments, separating them from unsupported or experimental candidates.
NemoClaw’s architecture is built around several core components: the NemoClaw CLI, agent-specific integration layers, versioned blueprints, and lifecycle management tools. These components work together to enforce security controls, manage inference providers, and handle credential custody through OpenShell.
How It Works
The runtime begins with an onboarding process that guides users through platform-specific setup, including hardware compatibility checks, software prerequisites, and security configurations. Supported platforms include NVIDIA DGX systems, Windows Subsystem for Linux (WSL), and select Linux distributions.
During installation, NemoClaw performs a readiness check to classify the host environment, such as DGX Spark, DGX Station, or NVIDIA GB300 systems. For example, DGX Spark systems follow a dedicated Express installation workflow, while WSL environments use tailored instructions to optimize compatibility.
Once the environment is validated, users select an agent framework (OpenClaw, Hermes, or LangChain Deep Agents) and an inference provider. NemoClaw supports a range of providers, including local options like vLLM and Ollama, as well as cloud-based services such as NVIDIA Endpoints, OpenRouter, OpenAI, Anthropic, and Google Gemini.
After configuration, NemoClaw deploys the selected agent within an isolated sandbox, applying predefined network policies to control egress traffic and restrict unauthorized access. The CLI provides commands for lifecycle operations, including snapshot management, policy updates, and sandbox termination.
Use Cases
NemoClaw is primarily targeted at organizations deploying AI agent frameworks in production environments where security and operational governance are priorities.
- For example, a financial services firm deploying LangChain Deep Agents for automated reporting can restrict agent access to approved APIs and internal databases.
- This is particularly relevant in cloud-based AI services where isolation is critical.
- Research and Development with Experimental Agents: While NemoClaw focuses on supported frameworks, its architecture allows for the integration of experimental or custom agents under controlled conditions. Researchers can test new agent designs within isolated sandboxes, mitigating risks to production systems.
- Hybrid Cloud and Edge Deployments: NemoClaw supports both local inference (via vLLM or Ollama) and cloud-based providers, enabling hybrid deployment strategies. For instance, an edge device running OpenClaw can use local inference for low-latency tasks while offloading complex queries to a cloud provider through NemoClaw’s managed integrations.
Key Features & Capabilities
NemoClaw’s design centers on security, operational control, and flexibility.
- Sandboxed Execution with OpenShell: Agents run in isolated containers with restricted access to host filesystems, network interfaces, and system processes. OpenShell manages credential custody, ensuring that inference providers and integrations are authenticated securely without exposing secrets.
- Guided Onboarding and CLI Workflow: The NemoClaw CLI automates much of the setup process, including platform detection, prerequisite checks, and policy configuration. Users can install the runtime via a terminal installer or through a guided prompt designed for coding agents (e.g., Cursor, Copilot). The CLI also supports interactive configuration for custom sandboxes, inference providers, and network policies.
- Managed Inference Providers: NemoClaw integrates with a variety of inference backends, including local options like vLLM (for optimized performance on NVIDIA hardware) and Ollama (for lightweight deployments). Cloud providers such as OpenAI, Anthropic, and NVIDIA Endpoints are also supported, with credential handling abstracted to prevent exposure. The runtime validates provider configurations to ensure compatibility with the selected agent framework.
- Network Policy Enforcement: Network policies are applied at the sandbox level, controlling outbound traffic and restricting access to unauthorized endpoints. For example, a policy might block all egress traffic except to approved APIs or internal services.
- Lifecycle Management and Snapshots: NemoClaw supports sandbox snapshots, allowing users to save and restore agent states for reproducibility or rollback purposes. The CLI also provides commands for sandbox creation, termination, and status monitoring.
- Agent-Specific Integration Layers: Each supported agent (OpenClaw, Hermes, LangChain Deep Agents) has a dedicated integration layer that adapts the runtime’s security controls to the agent’s requirements. For example, Hermes may use a lightweight skin for terminal interactions, while OpenClaw enforces stricter command approval workflows. These layers ensure that agents operate within their intended constraints without requiring modifications to the frameworks themselves.
- Multi-Agent and Multi-Provider Support: NemoClaw is designed to accommodate multiple agent frameworks and inference providers simultaneously. For instance, an organization might run OpenClaw with a local vLLM backend for internal tasks and LangChain Deep Agents with OpenAI for external queries.
- These optimizations ensure compatibility with NVIDIA’s hardware acceleration features, such as GPU-optimized inference with vLLM. For example, DGX Spark systems receive tailored instructions to maximize performance while maintaining security.
- Community and Contribution Model: NemoClaw is an open-source project with active community engagement channels, including GitHub Discussions, Discord, and a dedicated CONTRIBUTING.md guide. Contributors can prepare development environments using scripts like dev-setup.sh, which separates runtime dependencies from local builds. Security vulnerabilities must be reported through private channels (e.g., NVIDIA’s Vulnerability Disclosure Program) rather than public issues.
The project’s current priorities focus on improving installation reliability, strengthening sandbox security, and validating inference provider behaviors.
Supported Agents and Workflows
NemoClaw currently supports three agent frameworks, each with distinct integration paths and use cases:
- OpenClaw (Default): The default agent framework in NemoClaw, OpenClaw is optimized for secure execution within sandboxes. It enforces strict command approval workflows, requiring user confirmation before running system-level operations.
- Hermes: Hermes integrates with NemoClaw through a dedicated nemohermes CLI alias.
- LangChain Deep Agents Code: This framework is supported via the nemo-deepagents CLI alias.
Each agent can be configured with different inference providers, allowing users to balance performance, cost, and security. For example, a user might deploy OpenClaw with a local vLLM backend for high-throughput tasks and Hermes with OpenAI for interactive queries. The runtime’s blueprint system ensures that agent-specific configurations are applied consistently across deployments.
Security and Compliance Considerations
NemoClaw’s security model is built on isolation, least-privilege access, and credential management. Key security features include:
- Credential Custody: OpenShell manages inference provider credentials and integration tokens, ensuring they are never exposed in logs or chat interfaces. Users are prompted to enter credentials securely, with no storage in plaintext or command arguments.
- Network Egress Control: All outbound traffic from sandboxes is subject to policy enforcement.
- Container Hardening: Sandboxes are configured with minimal capabilities, read-only filesystems, and process limits to reduce attack surfaces.
- Audit and Logging: While NemoClaw does not include built-in logging, its integration with OpenShell enables audit trails for agent activities.
- By isolating agents and controlling their interactions, NemoClaw helps organizations meet regulatory requirements for AI system governance.
The project’s permissive Apache 2.0 license allows organizations to adapt the runtime to their specific compliance needs without legal restrictions.
Installation and Onboarding
Installing NemoClaw begins with a platform-specific readiness check, which verifies hardware, software prerequisites, and administrator access. Users can initiate the process via the terminal or through a coding agent interface, such as Cursor or Copilot. The guided onboarding workflow ensures that only validated configurations proceed, with platform-specific instructions applied automatically.
For example, a user on a DGX Spark system will follow the DGX Spark Express instructions, while a WSL user will use the Windows WSL Express workflow. The installer prompts for agent selection (OpenClaw, Hermes, or LangChain Deep Agents) and inference provider configuration, with options ranging from local vLLM to cloud-based services like OpenAI or Anthropic.
During installation, NemoClaw collects user choices before executing any system changes. It pauses before critical operations, such as credential entry or sandbox creation, to ensure explicit user approval.
Post-installation, users can manage sandboxes through the NemoClaw CLI, including commands for snapshot creation, policy updates, and sandbox termination. For example, the nemohermes onboard command initializes a Hermes sandbox with predefined security policies, while nemo-deepagents onboard configures a LangChain Deep Agents environment.
Current Limitations and Future Directions
As an alpha project, NemoClaw is actively evolving with a focus on reliability, security, and platform support.
- Alpha Status: The project operates on best-effort maintenance, with no guaranteed response timelines for issues or pull requests. Users are encouraged to engage with the community for support and feature proposals.
- Platform Support: While NemoClaw supports DGX systems, WSL, and select Linux distributions, some hardware configurations (e.g., native N1x) remain in preview status pending full validation. Users deploying on unsupported platforms should review the documentation for explicit preview intent requirements.
- Agent and Provider Compatibility: Not all agent frameworks or inference providers are fully integrated. For example, Local Ollama is not supported for LangChain Deep Agents unless explicitly documented. Users should verify compatibility before deployment.
- Documentation and Troubleshooting: While comprehensive, the documentation is regularly updated to reflect supported workflows. Users encountering issues are directed to GitHub Issues for reproducible bugs or GitHub Discussions for broader feedback.
Future priorities for NemoClaw include improving installation reliability, enhancing sandbox hardening, and validating inference provider behaviors.