How to Get Your Tool Used by NemoClaw (NVIDIA's Secure Agent Stack) (2026)

NemoClaw is NVIDIA's open-source reference stack (Apache 2.0, in alpha preview since March 2026) for running the OpenClaw agent securely as an always-on local assistant. OpenClaw is the agent; NemoClaw is the cage around it — OpenClaw runs inside NVIDIA's OpenShell sandbox, driven by Nemotron open models, on local RTX or DGX hardware, with policy guardrails, a hardened image, and routed inference layered on top. So NemoClaw does not replace OpenClaw; it governs it. Anything that influences which tools OpenClaw reaches for still applies inside NemoClaw.

No — and this is the most important thing to get right. Unlike Claude Code (MCP) or OpenClaw's own ClawHub skills registry, NemoClaw exposes neither an MCP server nor a marketplace for tool discovery. Tool and service access is granted through network-policy presets — pre-built allowlists for things like Slack, Discord, Docker, or Hugging Face, managed with commands such as policy-add and policy-list — and through a sandboxed TypeScript skill model where every third-party skill is treated as untrusted code with constrained filesystem and network access. Access is policy-gated, not registry-driven. Any guide claiming otherwise is describing a feature that does not exist yet.

Two conditions both have to hold. First, the OpenClaw agent inside has to choose your tool — that is the ordinary agent-recommendation problem, where training-data presence, a ClawHub skill, and clean public docs matter (see the OpenClaw playbook). Second, NemoClaw has to allow it — your tool's network calls have to fall within an enabled policy preset, and any skill that wraps it has to pass the sandbox's constraints. A tool that is recommended but not allowed gets blocked at the gateway; a tool that is allowed but never recommended is never reached. You need both.

Make your tool easy to permit. Document the exact network endpoints and ports it needs, so an operator can map it to an existing policy preset or write a tight one — vague or sprawling network requirements are what get a tool denied. Request the minimum permissions, avoid demanding broad filesystem or outbound access, and behave predictably so the sandbox does not flag anomalous behaviour. If your service is common enough, contributing a clean, least-privilege policy preset (or a reference config) is the most direct way to become allowable by default.

NemoClaw exists partly because third-party agent skills are an unreviewed-code risk — each one can have filesystem and network access. So a skill that wants to survive in the sandbox should be least-privilege by design: narrow scope, declared and minimal permissions, no surprising outbound calls, and transparent about what it does. Treat the sandbox as an adversarial reviewer. The skills that get kept are the ones an operator can read, understand, and trust quickly; the ones that get removed are the ones that ask for more than they obviously need.

No, it is positioned as complementary. NVIDIA frames the difference as where the security lives: Claude Code and Cursor ship guardrails inside the agent, while NemoClaw enforces security outside the agent, at the infrastructure and runtime layer, so the same agent can be run with stronger data-governance guarantees. For a tool author that means the in-agent recommendation work you do for Claude Code is not wasted — but reaching a NemoClaw deployment additionally requires clearing the external policy and sandbox layer.

Less than for the established agents, and this guide flags it throughout. NemoClaw is an alpha NVIDIA project whose APIs may change, and its policy and skill models are lightly documented. The architecture — OpenClaw inside OpenShell, Nemotron models, policy-preset allowlists, sandboxed skills — is well-supported by NVIDIA's own blog and repo. The finer tactical specifics are informed inference and should be verified against the live GitHub README before you build against them.

NemoClaw is NVIDIA's open-source reference stack (Apache 2.0, in alpha preview since March 2026) for running the OpenClaw agent securely as an always-on local assistant. OpenClaw is the agent; NemoClaw is the cage around it — OpenClaw runs inside NVIDIA's OpenShell sandbox, driven by Nemotron open models, on local RTX or DGX hardware, with policy guardrails, a hardened image, and routed inference layered on top. So NemoClaw does not replace OpenClaw; it governs it. Anything that influences which tools OpenClaw reaches for still applies inside NemoClaw.

No — and this is the most important thing to get right. Unlike Claude Code (MCP) or OpenClaw's own ClawHub skills registry, NemoClaw exposes neither an MCP server nor a marketplace for tool discovery. Tool and service access is granted through network-policy presets — pre-built allowlists for things like Slack, Discord, Docker, or Hugging Face, managed with commands such as policy-add and policy-list — and through a sandboxed TypeScript skill model where every third-party skill is treated as untrusted code with constrained filesystem and network access. Access is policy-gated, not registry-driven. Any guide claiming otherwise is describing a feature that does not exist yet.

Two conditions both have to hold. First, the OpenClaw agent inside has to choose your tool — that is the ordinary agent-recommendation problem, where training-data presence, a ClawHub skill, and clean public docs matter (see the OpenClaw playbook). Second, NemoClaw has to allow it — your tool's network calls have to fall within an enabled policy preset, and any skill that wraps it has to pass the sandbox's constraints. A tool that is recommended but not allowed gets blocked at the gateway; a tool that is allowed but never recommended is never reached. You need both.

Make your tool easy to permit. Document the exact network endpoints and ports it needs, so an operator can map it to an existing policy preset or write a tight one — vague or sprawling network requirements are what get a tool denied. Request the minimum permissions, avoid demanding broad filesystem or outbound access, and behave predictably so the sandbox does not flag anomalous behaviour. If your service is common enough, contributing a clean, least-privilege policy preset (or a reference config) is the most direct way to become allowable by default.

NemoClaw exists partly because third-party agent skills are an unreviewed-code risk — each one can have filesystem and network access. So a skill that wants to survive in the sandbox should be least-privilege by design: narrow scope, declared and minimal permissions, no surprising outbound calls, and transparent about what it does. Treat the sandbox as an adversarial reviewer. The skills that get kept are the ones an operator can read, understand, and trust quickly; the ones that get removed are the ones that ask for more than they obviously need.

No, it is positioned as complementary. NVIDIA frames the difference as where the security lives: Claude Code and Cursor ship guardrails inside the agent, while NemoClaw enforces security outside the agent, at the infrastructure and runtime layer, so the same agent can be run with stronger data-governance guarantees. For a tool author that means the in-agent recommendation work you do for Claude Code is not wasted — but reaching a NemoClaw deployment additionally requires clearing the external policy and sandbox layer.

Less than for the established agents, and this guide flags it throughout. NemoClaw is an alpha NVIDIA project whose APIs may change, and its policy and skill models are lightly documented. The architecture — OpenClaw inside OpenShell, Nemotron models, policy-preset allowlists, sandboxed skills — is well-supported by NVIDIA's own blog and repo. The finer tactical specifics are informed inference and should be verified against the live GitHub README before you build against them.