What it does NemoClaw is NVIDIA’s open-source installer and CLI for deploying persistent AI agents more safely. It wraps OpenShell sandboxes around agents like OpenClaw or Hermes, adds routed inference, network egress controls, and lifecycle management, then exposes everything through a single command-line tool.

The interesting bit The “reference stack” framing is honest—this is glue and hardening, not a from-scratch runtime. The value is in the opinionated defaults: pre-configured sandbox blueprints, operator approval flows for network policy changes, and container hardening with capability drops. NVIDIA is essentially packaging “secure by default” for agents that otherwise run with kitchen-sink permissions.

Key highlights

• Supports OpenClaw (default) and Hermes agents via NEMOCLAW_AGENT=hermes or the nemohermes alias
• Single CLI handles onboarding, blueprint deployment, and lifecycle management
• Routed inference with provider validation—external LLM calls don’t just blast out
• Network policies with baseline rules, egress control, and operator approval workflow
• Sandbox hardening includes container security measures, capability drops, and process limits

Caveats

• Heavy external dependency: requires NVIDIA OpenShell, and most operational detail lives in off-repo documentation
• The README is essentially a table of contents; architecture specifics, hardware prerequisites, and supported platforms are all linked out
• “Reference stack” means you’ll likely need to adapt rather than drop-in deploy

Verdict Worth evaluating if you’re already in the NVIDIA/OpenShell ecosystem and need to productionize always-on agents without building your own security wrapper. Skip if you want a standalone, fully self-contained agent runtime or aren’t prepared to navigate NVIDIA’s documentation sprawl.