# NanoClaw (slim)

> Open-source personal assistant that the owner runs on their own machine. It answers on messaging apps, runs each agent session in a Docker container, keeps Markdown memory on disk and runs scheduled tasks.

- Full: https://www.anchorterminal.com/tools/nanoclaw.md (~8,300 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/tools/nanoclaw.json · canonical https://www.anchorterminal.com/tools/nanoclaw
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 68.3/100 · rank #229 of 986 · #2 in Personal assistants · not agent-ready · confidence medium**


Assessment: Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.

## Facts

- Kind: Agent harness · vendor: NanoCo, Inc. · category: Personal assistants · legal entity: NanoCo, Inc. · provenance 53/100
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Runs on: The owner's macOS or Linux machine, or Windows through WSL2. One Node host process and one Docker container per active session. Installed by `git clone` and `bash nanoclaw.sh`
- Acts without asking: Inside its container the agent runs shell, file, web and browser tools with permission prompts off. It can send messages and files to any chat or agent its group is wired to, and call any API its group was granted a credential for, unless that secret is set to need approval
- Needs approval: Installing apt or npm packages, adding an MCP server, `ncl` writes from inside a container, creating an agent (unless the group has global CLI scope), admitting a new chat or unknown sender, and credential use where the secret is set to manual approval. No reachable approver means denial
- Accounts and credentials: No first-party Gmail or Google Calendar integration on trunk. API keys and OAuth connections are stored in a credential gateway on the host (OneCLI Agent Vault by default, Iron Proxy as the alternative) and granted per agent group. Channel tokens such as `TELEGRAM_BOT_TOKEN` stay in the host's `.env`
- Memory: Markdown files in `groups/<folder>/memory/`, shared by every session of an agent group. Two files, each capped at 16,000 characters, are loaded into every new context window. Session history is in SQLite under `data/v2-sessions/`
- Deletion: Edit or delete memory files on the host. `bash nanoclaw.sh --uninstall` removes the service, data and agents' files in three groups, each asked separately with No as the default, and leaves the shared gateway and its credentials in place
- Models: Claude through the Claude Agent SDK by default, with a subscription token or an API key. Codex, OpenCode (OpenRouter, OpenAI, Google, DeepSeek and others) and Ollama through skills, set per agent group. Message content goes to the provider chosen
- Channels: A local CLI channel on trunk. WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Microsoft Teams, Mattermost, Matrix, Google Chat, Webex, WeChat, Linear, GitHub, Delta Chat, email through Resend, and SMS and voice through Dial, each installed by an `/add-<channel>` skill
- Scheduled tasks: `ncl tasks create` with a cron expression or a one-time timestamp. A task runs an agent prompt in its own session, and a script gate can skip a run with nothing to do
- MCP client: stdio and remote Streamable HTTP servers per agent group, added by `ncl groups config add-mcp-server` or by the agent's `add_mcp_server` request, which needs approval. The built-in `nanoclaw` server has nine tools
- Sandbox: Non-root container, `--cap-drop=ALL`, `no-new-privileges`, a 2,048 process limit, and extra mounts refused unless listed in `~/.config/nanoclaw/mount-allowlist.json`. CPU and memory limits are unset by default
- Telemetry: Setup events go to PostHog under a random install id. `NANOCLAW_NO_DIAGNOSTICS=1` turns them off. No runtime telemetry was found in the host or container source
- Releases in 90 days: 5 stable (2.1.54 on 1 August to 2026.10.0 on 9 October 2026) and 2 release candidates
- Cost: Free under the MIT licence. The owner pays the model provider, and any third-party service a channel or tool uses. No monthly figure is published

- Scores: Reliability 78, Performance pending, Schema & documentation 82, Agent ergonomics 70, Security & auth 74, Payments & pricing 60, Task success pending, Maintenance & community 78, Transparency & trust 65 · negative events -5 · total over the 7 assessed categories
- Why: Reliability, Read as software the owner runs. · Schema & documentation, Harness reading, as for the agent programs we list. · Agent ergonomics, Harness reading, scored on what an owner or pipeline driving it has to supply. · Security & auth, Harness reading of the framework checklist. · Payments & pricing, No payment protocol (0). · Maintenance & community, 2026.10.0 on 9 October 2026 (30). · Transparency & trust, MIT (30).
- Sources: 33, open questions: 11, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts
- JSON: https://www.anchorterminal.com/api/v1/tools/nanoclaw.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/nanoclaw.svg` or a link to https://www.anchorterminal.com/tools/nanoclaw from a page on nanoclaw.dev or one of its subdomains, or the README of github.com/nanocoai/nanoclaw, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Install with `git clone` and `bash nanoclaw.sh`. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential
2. Set `NANOCLAW_EGRESS_LOCKDOWN=true` before giving an agent credentials or an audience of strangers. The default leaves egress open
3. Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree
4. Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured
5. On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done

## Connect

```bash
git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2 && cd nanoclaw-v2 && bash nanoclaw.sh
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| OpenClaw | B | 67.1 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/openclaw.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |
| nanobot | B | 62.4 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/nanobot.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)