NVIDIA/NemoClaw

Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference

What it solves

NemoClaw provides a secure way to run AI agents on a host machine by isolating them within sandboxes. This prevents agents from having unrestricted access to the host system, reducing the security risks associated with letting AI agents execute code or manage files.

How it works

It acts as a reference stack that integrates with NVIDIA OpenShell to create sandboxed environments. The system uses a CLI to manage the entire lifecycle of these sandboxes, including guided onboarding, managed inference, network policy enforcement (controlling egress and ingress), and snapshots. It supports specific agent frameworks like OpenClaw, Hermes, and LangChain Deep Agents Code.

Who it’s for

Developers and researchers who want to deploy AI agents (specifically coding agents) in a controlled, secure environment on DGX systems or Windows Subsystem for Linux (WSL).

Highlights

  • Sandboxed Execution: Runs agents inside NVIDIA OpenShell sandboxes for increased safety.
  • Managed Infrastructure: Handles inference providers, network policies, and sandbox snapshots via a dedicated CLI.
  • Supported Agents: Out-of-the-box support for OpenClaw, Hermes, and LangChain Deep Agents Code.
  • Security Controls: Includes sandbox hardening, capability drops, and process limits to restrict agent behavior.

Related

  • Project
    nanocoai/nanoclaw

    NanoClaw is a minimal, open‑source AI‑assistant framework that runs each agent inside its own Docker container for strong isolation. It installs automatically, registers Anthropic (Claude) credentials via OneCLI’s secure vault, and lets you add chat‑platform adapters (Slack, Telegram, Discord, WhatsApp, etc.) on demand. Agents can be wired per‑channel, shared, or hybrid, and you can schedule recurring tasks. The default model is Claude, but you can swap in OpenAI, OpenRouter, Ollama, etc. Customization is done by asking the built‑in Claude Code AI to edit the tiny codebase, avoiding sprawling config files. Security‑focused, no user accounts, MIT‑licensed.

  • Project
    onecli/onecli

    An open-source platform for running AI agents as a team, providing secure sandboxing, centralized credential injection, and identity provider integration.

  • Project
    opensandbox-group/OpenSandbox

    OpenSandbox is an open‑source sandbox platform for AI agents and other code‑execution workloads. It offers multi‑language SDKs, a CLI, and a server that can run sandboxes on Docker locally or on Kubernetes at scale, with strong isolation (gVisor, Kata, Firecracker), network policies, and a credential vault. Use cases include coding agents, browser/desktop automation, RL training, and secure code‑execution services.

  • Project
    fastclaw-ai/fastclaw

    A lightweight AI agent runtime written in Go that allows users to create, manage, and deploy multi-agent systems with isolated sandboxes and multi-channel support.

  • Project
    automateyournetwork/netclaw

    An autonomous AI network engineering agent that automates monitoring, troubleshooting, and configuration across multi-vendor network infrastructure using hundreds of specialized skills and integrations.