NVIDIA NemoClaw Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection. NVIDIA NemoClaw is an open source TypeScript CLI plugin that simplifies running [OpenClaw](https://openclaw.ai) always on AI assistants securely. It installs and orchestrates the [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) runtime, creates policy enforced sandboxes, and routes all inference through NVIDIA cloud (Nemotron models). Network egress, filesystem access, syscalls, and model API calls are all governed by declarative policy. Status: Alpha — interfaces and APIs may change without notice. Installation Prerequisites Linux Ubuntu 22.04 LTS or later Node.js 20+ and npm 10+ (Node.js 22 recommended) Docker installed and running [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) installed One Line Installer This installs Node.js (if absent), runs the guided onboard wizard, creates a sandbox, configures inference, and applies security policies. Manual Install (from source) Environment Variables Get an API key at [build.nvidia.com](https://build.nvidia.com). Quick Start 1. Onboard a New Agent The interactive wizard prompts for: Sandbox name (e.g. my assistant ) NVIDIA API key ( $NVIDIA API KEY ) Inference model selection Network and filesystem policy configuration Expected output on success: 2. Connect to the Sandbox 3. Chat with the Agent (inside sandbox) TUI (interactive chat): CLI (single message): Key CLI Commands Host Commands ( nemoclaw ) Command Description nemoclaw onboard Interactive setup: gateway, providers, sandbox nemoclaw <name connect Open interactive shell inside sandbox nemoclaw <name status Show NemoClaw level sandbox health nemoclaw <name logs follow Stream sandbox logs nemoclaw start Start auxiliary services (Telegram bridge, tunnel) nemoclaw stop Stop auxiliary services nemoclaw deploy <instance Deploy to remote GPU instance via Brev openshell term Launch OpenShell TUI for monitoring and approvals Plugin Commands ( openclaw nemoclaw , run inside sandbox) Note: These are under active development — use nemoclaw host CLI as the primary interface. Command Description openclaw nemoclaw launch [ profile ...] Bootstrap OpenClaw inside OpenShell sandbox openclaw nemoclaw status Show sandbox health, blueprint state, and inference openclaw nemoclaw logs [ f] Stream blueprint execution and sandbox logs OpenShell Inspection Architecture NemoClaw orchestrates four components: Component Role Plugin TypeScript CLI: launch, connect, status, logs Blueprint Versioned Python artifact: sandbox creation, policy, inference setup Sandbox Isolated OpenShell container running OpenClaw with policy enforced egress/filesystem Inference NVIDIA cloud model calls routed through OpenShell gateway Blueprint lifecycle: 1. Resolve artifact 2. Verify digest 3. Plan resources 4. Apply through OpenShell CLI TypeScript Plugin Usage NemoClaw exposes a programmatic TypeScript API for building custom integrations. Import and Initialize Create a Sandbox Programmatically Connect and Send a Message Check Sandbox Status Stream Logs Apply a Network Policy Update (Hot Reload) Security / Protection Layers Layer What it protects Hot reloadable? Network Blocks unauthorized outbound connections ✅ Yes Filesystem Prevents reads/writes outside /sandbox and /tmp ❌ Locked at creation Process Blocks privilege escalation and dangerous syscalls ❌ Locked at creation Inference Reroutes model API calls to controlled backends ✅ Yes When the agent attempts to reach an unlisted host, OpenShell blocks the request and surfaces it in the TUI for operator approval. Common Patterns Pattern: Minimal Sandbox for Development Pattern: Production Strict Sandbox Pattern: Deploy to Remote GPU (Brev) Troubleshooting Error: Sandbox not found Fix: Check at the OpenShell layer — NemoClaw errors and OpenShell errors are separate: Error: NVIDIA API key missing or invalid Fix: Error: Docker not running Fix: Error: OpenShell not installed Fix: Install [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) first, then re run the NemoClaw installer. Agent blocked on outbound request When you see a blocked request notification in the TUI: View Full Debug Logs Documentation Links [Overview](https://docs.nvidia.com/nemoclaw/latest/about/overview.html) [How It Works](https://docs.nvidia.com/nemoclaw/latest/about/how it works.html) [Architecture](https://docs.nvidia.com/nemoclaw/latest/reference/architecture.html) [Inference Profiles](https://docs.nvidia.com/nemoclaw/latest/reference/inference profiles.html) [Network Policies](https://docs.nvidia.com/nemoclaw/latest/reference/network policies.html) [CLI Commands](https://docs.nvidia.com/nemoclaw/latest/reference/commands.html)

nvidia-nemoclaw