What Is NemoClaw? NVIDIA's Sandbox for OpenClaw and Hermes Agent

NemoClaw is not an AI agent. It’s NVIDIA’s open source, Apache-2.0 reference stack for running an existing agent more safely: by default it installs OpenClaw, or optionally Hermes Agent or LangChain Deep Agents Code, inside an NVIDIA OpenShell sandbox container, and controls what that agent can reach. NVIDIA released it in March 2026 and labels it alpha.

If you’ve read that OpenClaw runs commands on your host with sandboxing off by default (see Is OpenClaw safe?), NemoClaw is NVIDIA’s answer to that problem.

What it adds on top of the agent

The agent inside does the work; NemoClaw adds the walls around it (overview):

• A sandbox container. The agent runs in OpenShell with filesystem and process controls, not directly on your machine.
• Network policy. Unapproved destinations are blocked and shown to an operator, who approves or denies them. This is egress control: a prompt-injected agent can’t quietly send your data to an unknown server.
• Credential custody. Inference, messaging and MCP credentials stay with the OpenShell gateway outside the sandbox, so the agent never holds the raw keys. One exception: QR-paired sessions such as WhatsApp keep their session credentials inside the sandbox.
• Managed inference. Model calls route through OpenShell to NVIDIA Endpoints, other hosted providers, or local models through Ollama, vLLM or NVIDIA NIM (inference providers).
• Guided onboarding, a CLI and a dashboard.

What it doesn’t change is the agent’s abilities. Memory, skills, voice and the rest come from the OpenClaw or Hermes version inside, which is why several feature cells are blank for NemoClaw in the table above.

What running it takes

NemoClaw is heavier than the agent alone. NVIDIA lists 4 vCPU, 8 GB of RAM (16 GB recommended) and 20 GB of free disk, plus Docker, Docker Desktop or Colima (prerequisites). The sandbox image alone is about 2.4 GB. Linux and DGX Spark are the primary tested platforms; macOS on Apple Silicon and Windows through WSL2 work with limitations.

You install it with a script or Docker. In the installer’s express mode, pressing Enter accepts OpenClaw; answer n to choose Hermes Agent or Deep Agents Code, a sandbox name and an inference provider (README).

Chat channels are set up during onboarding: Telegram, Discord and Slack are supported, while WhatsApp, Microsoft Teams, Google Chat and WeChat are experimental.

What it costs

NemoClaw is free. You pay for inference from whichever provider you route to, or nothing per message with a local model. If you have an NVIDIA GPU, local inference through NIM, vLLM or Ollama keeps prompts on your machine, and DGX Spark is one of the primary tested platforms.

The catches

• It’s alpha. In NVIDIA’s words, maintainers review issues and pull requests “on a best effort basis” without guaranteed response times.
• It sends telemetry. The CLI and installer report operations to an NVIDIA receiver unless you set NEMOCLAW_DISABLE_TELEMETRY=1 (source). It’s one environment variable to turn off.
• Two layers to update. You track NemoClaw’s releases and the agent’s.
• Approval fatigue. Egress control only helps if someone actually reviews the blocked destinations.

OpenClaw alone vs OpenClaw in NemoClaw

	OpenClaw on its own	OpenClaw inside NemoClaw
Where commands run	On your host, unless you turn on sandboxing	In an OpenShell sandbox container
Outbound network	Unrestricted	Unapproved destinations blocked until an operator approves
Model and channel keys	Stored on your hardware alongside the agent	Held outside the sandbox by the OpenShell gateway
Telemetry by default	Daily update check	NemoClaw CLI telemetry, plus whatever the agent inside sends
Minimum hardware	Any machine that runs Node 24.16+ or 26.1+	4 vCPU, 8 GB RAM, 20 GB disk and a container runtime
Maturity	Very active development	Alpha

Should you use NemoClaw?

Use it if you already want OpenClaw or Hermes Agent, plan to connect real accounts like email, and would otherwise run it on your host. It’s also the obvious fit for teams that need an operator approving what an always-on agent can reach, and for anyone running agents on NVIDIA hardware.

Skip it if you’d rather have isolation built into the agent itself. NanoClaw runs each agent in its own container, and ZeroClaw ships with an OS sandbox on by default. Or turn on the agent’s own sandbox: OpenClaw’s uses Docker by default, and Hermes Agent can use terminal.backend: docker.

For the head-to-head, see NemoClaw vs OpenClaw. For background on the agents it wraps, see what OpenClaw is and what Hermes Agent is.