Run NemoClaw with a Local LLM

Set Up from Your Coding Agent

You can ask a local coding agent such as Cursor, Claude Code, Codex, or Copilot to guide this setup and run approved commands for you. When the agent asks which computer you are using, select Linux.

Copy the starter prompt below and paste it into your coding agent. Use the code block's copy control when available, or select the text manually.

Markdown

# NemoClaw Instructions for a Non-Technical User

Help me install and run NVIDIA NemoClaw from this coding-agent UI.
I may use Cursor, Claude Code, Codex, Copilot, or another local coding agent.
I do not know how to use a terminal.

## Interaction Rules

- Ask exactly one question at a time.
- Use clickable choices when supported; otherwise show one short numbered list and wait.
- Detect the operating system and whether it is WSL using read-only checks.
- Ask which computer I am using only if the environment cannot be determined reliably.
- Next ask which agent I want: OpenClaw, Hermes, or LangChain Deep Agents Code.
- Never ask me to run commands myself, except the one workstation-side `ssh -N -L` command needed to open a remote credential form securely.
- Explain each command in plain language, ask permission, then run it for me.
- Pause before installs, system changes, administrator access, large downloads, credentials, sandbox creation, and long-running processes.
- Summarize command output instead of asking me to copy it into chat.
- Explain errors and unfamiliar terms such as Docker, container, model, API key, port, and SSH.
- Never ask me to paste passwords, API keys, tokens, or private credentials into chat.
- Use redacted placeholders such as `` in examples.
- During long operations, give a short update at least once per minute.
- Do not start duplicate installers, downloads, or model servers.
- Verify results after important commands; do not rely only on exit codes.

## Goal

Install NemoClaw, collect onboarding choices before execution, include messaging in the first sandbox build when the selected agent supports it, launch the selected agent, and verify that it responds.

## Agent Selection

Ask: "Which NemoClaw agent would you like?"
Choices:

1. OpenClaw, the default.
2. Hermes.
3. LangChain Deep Agents Code.

Use `NEMOCLAW_AGENT=hermes` or `nemohermes onboard` for Hermes.
Use `NEMOCLAW_AGENT=langchain-deepagents-code` or `nemo-deepagents onboard` for Deep Agents.

## Hardware and Readiness

- On Linux, ask permission to run a read-only readiness check before provider selection.
- Check distribution, architecture, product and firmware identity, GPU and memory, NVIDIA driver, Container Toolkit, Docker, Node.js, disk space, existing NemoClaw, Ollama, vLLM, relevant ports, and administrator access.
- Classify the computer as DGX Spark, DGX Station, NVIDIA GB300, another NVIDIA computer, ordinary macOS/Linux, or unknown.
- Do not identify DGX Spark from the GPU name alone; combine product, firmware, architecture, and GPU evidence.
- Classify a system as DGX Station when its firmware identifies a Station GB300 platform, or when its exact OEM model is documented by NVIDIA or the manufacturer as based on DGX Station architecture.
- A confirmed NVIDIA GB300 can independently qualify for expanded local-runtime choices.
- If uncertain, explain that and let NemoClaw's official preflight make the final platform decision.

## Administrator Access

- Check administrator availability without waiting for input, such as with a non-interactive sudo check.
- If passwordless sudo works, continue without prompt mode.
- If passwordless sudo is unavailable but the coding-agent UI provides a secure visible password prompt, explain why access is needed, ask permission, and set `NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt`.
- Let the real `sudo` program collect the password; never use chat or the API-key form for the computer password.
- If neither passwordless sudo nor a secure password prompt is available, stop before the affected install or system change.
- Never pipe a password, store it in a file, generate a password helper, or put it in command arguments.
- Offer a user-local alternative only when official documentation supports it for that exact operation.
- Do not silently use user-local Ollama for a system Ollama upgrade when the old system service would remain active.

## Platform-Specific Instructions

After the readiness check, load exactly one matching instruction asset before provider selection:

- Confirmed DGX Spark: [DGX Spark Express instructions](https://raw.githubusercontent.com/NVIDIA/NemoClaw/f3682a5be7069e58303d3345e682424d5c2453b2/docs/resources/prompt-assets/dgx-spark.md).
- Confirmed DGX Station: [DGX Station installation instructions](https://raw.githubusercontent.com/NVIDIA/NemoClaw/f3682a5be7069e58303d3345e682424d5c2453b2/docs/resources/prompt-assets/dgx-station.md).
- Officially detected Windows WSL: [Windows WSL Express instructions](https://raw.githubusercontent.com/NVIDIA/NemoClaw/f3682a5be7069e58303d3345e682424d5c2453b2/docs/resources/prompt-assets/windows-wsl.md).

Read the matching raw Markdown file completely and follow it before continuing.
Do not load a platform asset for any other computer.

## Runtime and Provider Selection

If no platform asset applies, or its offered install path is declined, ask: "Which inference runtime or provider would you like?"
Choices:

1. Existing vLLM, only when a ready server is detected on `localhost:8000`.
2. Managed vLLM, optimized local inference with a large download.
3. Local Ollama, only when the selected agent and platform support it.
4. NVIDIA Endpoints, which requires an NVIDIA API key.
5. OpenRouter, which requires an OpenRouter API key.
6. OpenAI, which requires an OpenAI API key.
7. Anthropic, which requires an Anthropic API key.
8. Google Gemini, which requires a Gemini API key.
9. Model Router, which requires an NVIDIA API key.
10. Other OpenAI-compatible endpoint, which requires an endpoint, model, and usually a key.
11. Other Anthropic-compatible endpoint, which requires an endpoint, model, and usually a key.
12. Hermes Provider, only when Hermes is selected.

On ordinary supported macOS or Linux:

- Offer Local Ollama for OpenClaw or Hermes when it is installed, running, or officially installable.
- Do not offer Local Ollama for Deep Agents unless current official documentation adds support.
- Offer an existing ready vLLM server when detected.
- Also show all applicable hosted and compatible providers.
- Do not hide Ollama merely because the computer is not DGX or GB300.
- Omit managed vLLM unless current official support permits it for the detected hardware.

When a platform asset applies, follow its local-runtime eligibility and model instructions.
On other platforms, show every provider supported by the selected agent and platform.
Renumber choices after filtering and do not hide hosted providers behind another menu.
Ask required model, endpoint, credential, and download questions one at a time.

## Local Models

- Fetch current model choices from the selected agent's official Markdown documentation.
- The selected maintained NemoClaw release is authoritative for supported slugs and arguments.
- For Ollama, ask permission to inspect installed models and offer NemoClaw's memory-aware recommendation first.
- Current Ollama starter examples include `qwen3.6:35b`, `nemotron-3-nano:30b`, and `qwen3.5:9b`.
- Explain download size and storage requirements, then ask separately for permission.
- Do not request an NGC or Hugging Face credential unless the selected operation actually requires it.

## Avoid Interactive Menus

- Collect every choice before running the installer.
- Ask one question at a time for model, endpoint, sandbox name, web search, messaging when the selected agent supports it, policy when no platform-asset install path is selected, credentials, administrator access, and downloads.
- Use non-interactive environment variables whenever supported.
- Never leave a command waiting at `Choose [1]:`.
- If a choice cannot be supplied non-interactively, stop before starting and explain the supported alternative.

## Handle Tokens Securely and Visually

Before collecting secrets, determine the exact environment-variable names and exact command argv, explain them, and ask permission.
Do not generate, rewrite, or redesign the helper or form.
Use this reviewed pair without modification:

- Helper: `https://raw.githubusercontent.com/NVIDIA/NemoClaw/dd61a307d7ddf7be99de8ff1e2678fb8ef42f8e6/scripts/local-credential-helper.mts` (SHA-256 `1a42bbe8dbc9003cb79d4e641b53760571aacd85293671aee97c09c0746fef33`).
- Form: `https://raw.githubusercontent.com/NVIDIA/NemoClaw/dd61a307d7ddf7be99de8ff1e2678fb8ef42f8e6/docs/resources/local-credential-form.html` (SHA-256 `5512a256e0ad7c63a26ab82cf4f5924e98652097172ab8a5dc9d9358dd4f6ae8`).

- Treat the two immutable URL and digest pairs as one reviewed trust boundary; before executing the helper, compute the SHA-256 digest of both downloaded files and compare each result with its pinned digest.
- If either digest differs, do not execute the helper; delete both temporary files and stop.
- Store them in a private temporary directory and delete them afterward.
- The helper requires Node.js 22.19 or newer.
- If Node is unavailable, use an existing secure local application prompt or secure terminal prompt; never use chat or generated credential code.
- Keep the helper bound to `http://127.0.0.1`, accept only one valid submission, and run only the already-approved command.
- Use `:secret` for secrets and `:text` only for non-secret values.
- Use `--execution-profile isolated` for stateless commands.
- For persistent install or onboarding, use `--execution-profile account-home --cwd ` and ask permission for both.
- Pass every `--field NAME:type`, then a literal `--`, an absolute executable path, and the exact approved argv.
- Never omit the literal `--`.
- Never use a relative, alias-only, or PATH-only approved executable.
- Never put credentials in argv.
- Command shape: `node --experimental-strip-types  --execution-profile  --form  --field NAME:secret --  `.
- Use **Preview Credentials**, **Edit**, then **Confirm and Run Approved Command**.
- If the outcome is unknown, check whether the command ran; do not retry or resubmit blindly.
- Keep secrets in memory only long enough to start the command.
- Treat deletion as exposure minimization, not guaranteed erasure.
- Prefer letting an account-persistent command use its own reviewed secure credential prompt when available.
- For credential-bearing installation, use the reviewed helper only with an already-downloaded and verified installer.
- Do not hand-assemble a `curl | bash` wrapper around credentials.
- Never print, log, commit, cache, or paste secrets.

Use this provider mapping for non-interactive setup:

- NVIDIA Endpoints: `NEMOCLAW_PROVIDER=build`, `NVIDIA_INFERENCE_API_KEY`.
- OpenRouter: `NEMOCLAW_PROVIDER=openrouter`, `OPENROUTER_API_KEY`.
- OpenAI: `NEMOCLAW_PROVIDER=openai`, `OPENAI_API_KEY`.
- Anthropic: `NEMOCLAW_PROVIDER=anthropic`, `ANTHROPIC_API_KEY`.
- Gemini: `NEMOCLAW_PROVIDER=gemini`, `GEMINI_API_KEY`.
- Hermes Provider: `NEMOCLAW_PROVIDER=hermes-provider`; Hermes only.
- Model Router: `NEMOCLAW_PROVIDER=routed`, `NVIDIA_INFERENCE_API_KEY`.
- OpenAI-compatible: `NEMOCLAW_PROVIDER=custom`, endpoint, model, `COMPATIBLE_API_KEY`.
- Anthropic-compatible: `NEMOCLAW_PROVIDER=anthropicCompatible`, endpoint, model, `COMPATIBLE_ANTHROPIC_API_KEY`.
- Ollama: `NEMOCLAW_PROVIDER=ollama`, optional `NEMOCLAW_MODEL`.
- Existing vLLM: `NEMOCLAW_PROVIDER=vllm`.
- Managed vLLM: `NEMOCLAW_PROVIDER=install-vllm`; use an approved optional model override only when the selected platform supports it.

Do not offer Hermes Provider for OpenClaw or Deep Agents.

## Credential Form and SSH

Ask whether I use SSH only after the helper starts and prints its complete one-time URL: "Are you connected to this computer through SSH?"
Choices:

1. No, I am using it directly.
2. Yes, this is a remote SSH computer.
3. I am not sure.

- Treat the helper's complete URL as an opaque, sensitive, one-time capability.
- Preserve its scheme, host, port, `/local-credential-form.html` path, complete `field=` query string, and `#cap=` fragment exactly.
- Never replace it with a reconstructed bare `http://127.0.0.1:` URL.
- If local, give me the complete original URL unchanged.
- If remote, read its port and ask me to run: `ssh -N -L :127.0.0.1: @`.
- Fill in the actual port, username, and host when known.
- Explain that it runs on my workstation, normally prints nothing, and must remain open until credential entry finishes.
- After the tunnel starts, give me the helper's original complete URL unchanged.
- Require the same port on both sides; do not remap the helper to another local port.
- If that local port is occupied, stop the unused helper safely, resolve the conflict or start a fresh helper session, and use only the new complete URL.
- Never reuse an old URL or expose the form through `0.0.0.0`, LAN, public URL, shared tunnel, or unauthenticated proxy.
- Tell me when it is safe to stop the forwarding command.

## Messaging During Initial Onboarding

For OpenClaw or Hermes, ask before the first sandbox build: "Do you want to configure a messaging channel during onboarding?"
Choices: No, Telegram, Discord, Slack, WhatsApp, WeChat (experimental).
Skip messaging for Deep Agents.
Configure one channel at a time, then ask whether to add another.
Collect messaging before policy selection so the first image includes channel configuration and matching network presets.

- Telegram requires `TELEGRAM_BOT_TOKEN`; optional settings include allowed IDs, mention mode, and OpenClaw group policy.
- Discord requires `DISCORD_BOT_TOKEN`; optional settings include server ID, user ID, and mention mode.
- Slack requires `SLACK_BOT_TOKEN` and `SLACK_APP_TOKEN`; optional settings include allowed users and channels.
- WhatsApp uses documented allowed IDs for non-interactive selection, followed by QR pairing after startup.
- WeChat requires an interactive QR handshake; explain the limitation before installation and never leave an unsupported UI waiting.

Collect messaging secrets through the reviewed helper and exact-URL SSH flow.
Do not manually set `NEMOCLAW_MESSAGING_CHANNELS_B64`; let NemoClaw generate it.
Use `channels add` and rebuild only for channels omitted from initial onboarding or changed later.

## Policy, Approval, and Verification

- If a loaded platform asset selects its approved install path, follow its policy requirement and skip the policy-tier question.
- For installation outside an accepted platform-asset path, ask for Balanced, Restricted, or Open policy.
- Explain that messaging and web-search selections add required endpoints.
- Before installation outside an accepted platform-asset path, summarize platform, administrator access, agent, provider, exact model, validation warning, downloads, storage, sandbox, web search, messaging, policy, credential names without their values, and system changes.
- Ask for final permission before installation outside an accepted platform-asset path.
- For an accepted platform-asset install path, treat the asset's confirmation as final permission and do not ask again.
- Set `NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1` and `NEMOCLAW_YES=1` only after their approvals.
- Keep credentials in the approved environment and never display them.
- Verify the command and version, sandbox status, provider, model, `inference.local`, GPU access when applicable, messaging bridges when configured, and dashboard route when available.
- If `curl | bash` returns no output, verify installation; if absent, ask permission to download and inspect the official installer before retrying.
- For remote dashboards, use private loopback SSH forwarding, preserve authenticated URLs exactly, and treat them as secrets.
- Ask permission before sending a live channel test or harmless first agent prompt.
- Declare success only after the sandbox is ready and the agent responds.
- Summarize what was installed, how to reconnect, what starts after reboot, and anything skipped.

## Use Docs for Information

- Use clean `.md` pages for searching more information in the selected agent's documentation. Example URLs:
  - [Documentation index for AI clients](https://docs.nvidia.com/nemoclaw/llms.txt)
  - [OpenClaw quickstart](https://docs.nvidia.com/nemoclaw/latest/user-guide/openclaw/get-started/quickstart.md)
  - [Hermes quickstart](https://docs.nvidia.com/nemoclaw/latest/user-guide/hermes/get-started/quickstart.md)
  - [Deep Agents quickstart](https://docs.nvidia.com/nemoclaw/latest/user-guide/deepagents/get-started/quickstart.md)
- Suggest to add the docs MCP server `https://docs.nvidia.com/nemoclaw/_mcp/server` if the coding agent supports MCP.

Prompt source: NVIDIA NemoClaw starter prompt

Set Up from Your Terminal

If you prefer to perform the setup directly in a terminal, continue with Phase 1.

Phase 1: Install and Run NemoClaw

Step 1
Install NemoClaw

This single command handles everything: installs Node.js (if needed), installs OpenShell, clones the last known good (LKG) NemoClaw release automatically, builds the CLI, and creates a sandbox.

Bash

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

After you accept the third-party software notice, the installer may detect your hardware platform and offer Express Install with recommended settings (managed local vLLM, a maintained Express model, sandbox name my-assistant, and Balanced policy). Express Install is supported on DGX Spark and DGX Station. Press Enter or enter Y to accept, or enter n to choose custom onboarding in Step 2.

NOTE

Express Install selects the maintained Express model and policy for your detected hardware platform. Download size and load time vary by model — large Express models can require hundreds of GB of storage. To skip the Express prompt before running the installer, set NEMOCLAW_NO_EXPRESS=1; setting NEMOCLAW_PROVIDER also bypasses Express Install and uses that provider.

NOTE

On DGX Station, Express Install recommends NVIDIA Nemotron 3 Ultra. DeepSeek-V4-Flash is also supported. To keep the one-confirmation Express flow but use DeepSeek-V4-Flash, run:

Bash

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --station-deepseek

Or decline Express and choose DeepSeek-V4-Flash during custom onboarding.

NOTE

Express install uses the recommended default settings. If you want to customize your configuration afterward, run nemoclaw onboard.

The installer requires Node.js 22.16+ (installed automatically if missing). Allow capacity for the selected model, the vLLM container, and temporary download space. When Express Install finishes, skip to Step 3.

Step 2
NemoClaw Onboarding

NOTE

This section is for custom setup. If you accepted Express Install in Step 1, onboarding already ran with recommended settings for your hardware platform; skip to Step 3. Follow this section if you declined Express Install or later run nemoclaw onboard to customize the configuration.

During custom setup, the onboard wizard walks you through:

Select your agent -- Choose which agent to run in the sandbox. Enter 1 for OpenClaw.
Configuring inference -- Choose a local inference option to run models on your hardware platform.
Inference models -- Select a model from the installer prompts. NemoClaw will prepare any required local model artifacts when needed. On DGX Station, Nemotron 3 Ultra is the Express recommendation; DeepSeek-V4-Flash is also supported.
Sandbox name -- Pick a name (e.g. my-assistant). Each sandbox requires a unique name.
Apply this configuration -- Enter Y to confirm setting up local inference.
Enable Brave Web Search -- Optional. If you enable it, paste a Brave Search API key when prompted.
Messaging channels -- Optional. Prefer No for a first local install (Web UI / terminal only). Full Telegram setup is at the bottom of this page under Optional — Set up Messaging Channel (Telegram). If you enable a channel now, choose your desired bot (telegram, discord or slack) and paste your bot token when prompted.
Resource profiles -- Choose how much CPU and RAM the sandbox may use (creator, gamer, game-developer, developer, custom, or No profile). Press Enter to accept the default (No profile).
Policy presets -- Choose desired Policy tier (Balanced recommended) and accept/edit the suggested presets when prompted (confirm with Enter).

When complete you will see output like:

Text

 ──────────────────────────────────────────────────
  OpenClaw is ready

  Sandbox:  my-assistant
  Model:    <your-selected-model> (Local vLLM)

  Start chatting

    Browser:
      http://127.0.0.1:18789/

    Terminal:
      nemoclaw my-assistant connect
      then run: openclaw tui

  Authenticated dashboard URL, if needed:
    nemoclaw my-assistant dashboard-url --quiet

  Remote access (SSH session detected):
    On your workstation, run:
      ssh -L 18789:127.0.0.1:18789 lab@<host>
    Then open the dashboard URL above in your local browser.

  Manage later

    Status:      nemoclaw my-assistant status
    Logs:        nemoclaw my-assistant logs --follow
    Model:       nemoclaw inference set --model <model> --provider <provider> --sandbox my-assistant
    Policies:    nemoclaw my-assistant policy-add
    Credentials: nemoclaw credentials reset <KEY> && nemoclaw onboard
  ──────────────────────────────────────────────────

NOTE

If nemoclaw is not found after install, run source ~/.bashrc to reload your shell path.
Time to finish Onboarding can vary, depending on the model choice and internet speed.

NemoClaw Onboarding can be run repeatedly to create multiple sandboxes for independent use cases. Use --name <new-name> to create an additional sandbox alongside any existing ones:

Bash

nemoclaw onboard --gpu --name <new-name>

IMPORTANT

Use --name <new-name> to create an additional sandbox without affecting existing ones. The --fresh flag is a destructive option reserved for starting a completely new onboard session — if a sandbox with the same name already exists, --fresh will destroy and recreate it. Only use --fresh when you intend to wipe and re-onboard — for example, to recover from a failed or interrupted onboarding session. To add a feature such as Brave Search to an existing sandbox, use --recreate-sandbox instead (see Step 4).

Step 3
Interact with OpenClaw

There are two ways to interact with your OpenClaw: Web UI or terminal UI.

Option 1. Web UI

Get the full dashboard URL (includes the auto-assigned port and token):

Bash

nemoclaw my-assistant dashboard-url --quiet

This prints a URL like http://127.0.0.1:18790/#token=<token>. The port is auto-assigned (commonly 18789 or 18790) and may differ between installs.

If accessing the Web UI directly on the hardware platform (keyboard and monitor attached), open the dashboard URL in a browser.

If accessing the Web UI from a remote machine, you need to set up an SSH tunnel.

First, note the port number from the dashboard URL above (e.g. 18790).

Find your hardware platform's IP address:

Bash

hostname -I | awk '{print $1}'

This prints the primary IP address (e.g. 192.168.1.42). You can also find it in Settings > Wi-Fi or Settings > Network on the desktop, or check your router's connected-devices list.

From your remote machine, create an SSH tunnel using the port from above (replace <port> and <your-host-ip>):

Bash

ssh -L <port>:127.0.0.1:<port> <your-user>@<your-host-ip>

Now open the dashboard URL in your remote machine's browser.

IMPORTANT

Use 127.0.0.1, not localhost -- the gateway origin check requires an exact match.

NOTE

If the Web UI fails to load and the port forward may be stale, get the port from nemoclaw my-assistant dashboard-url --quiet and reset:

Bash

openshell forward stop <port> my-assistant || true
openshell forward start <port> my-assistant --background

Option 2. Terminal UI

Connect to the sandbox:

Bash

nemoclaw my-assistant connect

Then launch the terminal UI inside the sandbox:

Bash

openclaw tui

You can start chatting with OpenClaw. Press Ctrl+C to exit the terminal UI.

To exit the sandbox:

Bash

exit

Phase 2: Modify NemoClaw Policy

Step 4
Enable Brave Search in sandbox

To add Brave Web Search to an existing sandbox, re-run onboarding with BRAVE_API_KEY set. Get a key from the Brave Search API console:

Bash

BRAVE_API_KEY=<your-brave-search-api-key> nemoclaw onboard --name <sandbox-name>

If the sandbox already exists without web search enabled, NemoClaw needs to recreate the sandbox so the Brave configuration is baked into the agent runtime. Accept the recreate prompt when it appears.

For scripted (non-interactive) runs, pass --recreate-sandbox to perform the rebuild without prompting:

Bash

BRAVE_API_KEY=<your-brave-search-api-key> \
  nemoclaw onboard --name <sandbox-name> --recreate-sandbox --non-interactive

NOTE

--recreate-sandbox clearly describes the intentional rebuild needed to add web search. Reserve --fresh for recovery from a failed or interrupted onboarding session — it discards the wizard state and starts over, which is not the right tool for adding a feature to an already-created sandbox.

To confirm web search is enabled, relaunch your OpenClaw WebUI or terminal UI. Ask the agent for something that needs live web search. If requests still fail, recheck policy-list and re-read the onboard output for Brave/API errors.

NOTE

Messaging channels (Telegram and others) are optional. Skip them during onboarding if you only need the Web UI or terminal. Full Telegram setup (and optional cloudflared for remote Web UI) is at the bottom of this page under Optional — Set up Messaging Channel (Telegram).

Phase 3: Set Up NemoClaw Agent

Step 5
Set Up NemoClaw Agents

Setting up NemoClaw Agents generally requires three steps: Configure NemoClaw security policy, Run Agent Workflow Prompt, and Personalize the Workflow for your own use case.

Check out these Example NemoClaw Agents for reference. Consider sharing your NemoClaw agent setup with the community on the NVIDIA Developer Forums.

Phase 4: Update NemoClaw

Step 6
Update NemoClaw

To check whether a newer NemoClaw LKG release is available, run:

Bash

nemoclaw update --check

To update the host-side NemoClaw CLI to the current LKG release without prompts, run:

Bash

nemoclaw update --yes

This updates the host CLI only; it does not rebuild existing sandboxes. After updating, check whether any sandboxes need to be rebuilt:

Bash

nemoclaw upgrade-sandboxes --check

If stale sandboxes are reported, follow the command output to rebuild them.

For details, see the official NemoClaw command reference.

Phase 5: Cleanup and Uninstall

Step 7
Stop services

Stop external public access and associated services:

Bash

nemoclaw tunnel stop

NOTE

For OpenClaw, this may also stop the in-sandbox gateway and temporarily interrupt dashboard, agent, and messaging access. It does not delete persistent session data.

Stop the port forward:

Bash

openshell forward list          # find active forwards and their ports
openshell forward stop <port>   # stop the dashboard forward (use the port shown above)

Step 8
Uninstall NemoClaw

The NemoClaw CLI includes a built-in uninstaller. It removes all sandboxes, the OpenShell gateway, Docker containers/images/volumes, the CLI, and state directories. Docker, Node.js, npm, and the vLLM container image are preserved. Your ~/.nemoclaw/ user data (rebuild-backups/, backups/, sandboxes.json) is also preserved unless you pass --destroy-user-data.

Bash

nemoclaw uninstall --yes

To remove everything including the downloaded model weights:

Bash

nemoclaw uninstall --yes --delete-models

Uninstaller flags:

Flag	Effect
`--yes`	Skip the confirmation prompt
`--keep-openshell`	Leave the `openshell` binary in place
`--delete-models`	Also remove model weights pulled by NemoClaw
`--destroy-user-data`	Also remove preserved user data under `~/.nemoclaw/` (`rebuild-backups/`, `backups/`, `sandboxes.json`)

NOTE

If the nemoclaw CLI is not available (e.g. install failed partway), use the remote uninstaller as a fallback:

Bash

curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash -s -- --yes

The uninstaller runs up to 7 steps:

Stop NemoClaw helper services and port-forward processes
Delete all OpenShell sandboxes, the NemoClaw gateway, and providers
Remove the global nemoclaw npm package
Remove NemoClaw/OpenShell Docker containers, images, and volumes
Remove downloaded model weights (only with --delete-models)
Remove config/state directories (~/.config/openshell, ~/.config/nemoclaw) and the OpenShell binary
Remove preserved user data under ~/.nemoclaw/ (rebuild-backups/, backups/, sandboxes.json) — only with --destroy-user-data

NOTE

~/.nemoclaw/ user data is preserved by default and only removed in step 7 with --destroy-user-data. If you have a local clone at ~/.nemoclaw/source you want to keep, move or back it up before running the uninstaller with that flag.

Useful commands

Command	Description
`nemoclaw my-assistant connect`	Shell into the sandbox
`nemoclaw my-assistant status`	Show sandbox status and inference config
`nemoclaw my-assistant logs --follow`	Stream sandbox logs in real time
`nemoclaw list`	List all registered sandboxes
`nemoclaw tunnel start`	Start cloudflared tunnel (public URL for remote Web UI access)
`nemoclaw tunnel stop`	Stop the public tunnel; may also stop the in-sandbox OpenClaw gateway
`nemoclaw my-assistant dashboard-url --quiet`	Print the full tokenized Web UI URL (includes auto-assigned port)
`openshell term`	Open the monitoring TUI on the host
`openshell forward list`	List active port forwards
`nemoclaw uninstall --yes`	Remove NemoClaw (preserves Docker, Node.js, vLLM image)
`nemoclaw uninstall --yes --delete-models`	Remove NemoClaw and downloaded model weights

Optional — Set up Messaging Channel (Telegram)

Skip this entire section if you only need the Web UI or terminal TUI. Telegram is not required for local agent use.

These steps apply when your sandbox exists but Telegram was never configured (you skipped Messaging channels during onboarding, or the sandbox policy tier never included Telegram-related egress). Replace <sandbox-name> with your sandbox (for example my-assistant).

IMPORTANT

Telegram does not require cloudflared. The bot uses long-polling to pull messages from Telegram servers, so no public URL or tunnel is needed. cloudflared is only for exposing the dashboard/Web UI remotely (see sub-step 5 below) and is unrelated to messaging.

1. Create a Telegram bot

In Telegram, open @BotFather, send /newbot, and complete the prompts. Copy the bot token BotFather returns and keep it ready for the next step.

2. Register Telegram with NemoClaw and rebuild the sandbox

Bash

nemoclaw <sandbox-name> channels add telegram

Paste the token when prompted. NemoClaw persists credentials and rebuilds the sandbox so OpenClaw can use Telegram as a messaging channel.

3. (If needed) Allow Telegram egress in the sandbox policy

If messages fail with network or policy errors after the channel is registered, inspect presets and add Telegram-related egress if your tier omitted it:

Bash

nemoclaw <sandbox-name> policy-list
nemoclaw <sandbox-name> policy-add telegram

Preset names follow your selected tier; confirm against Network policies.

NOTE

To approve blocked network requests for new endpoints at runtime, use the OpenShell TUI. See Approve or Deny Agent Network Requests.

4. Verify Telegram

Telegram uses long-polling (getUpdates) — the sandbox actively pulls messages from Telegram servers. No public URL or cloudflared tunnel is required for Telegram to work.

Open Telegram, find your bot, and send a message. The bot should forward traffic to the agent in your NemoClaw sandbox and reply.

NOTE

The first response may take longer depending on model size (30B models respond in a few seconds; larger models may take longer on first inference).

NOTE

If the bot does not respond:

Run nemoclaw <sandbox-name> status to confirm the sandbox is running and inference is healthy.
Run nemoclaw <sandbox-name> logs --follow and look for Telegram-related errors.
If Telegram egress is missing, run nemoclaw <sandbox-name> policy-add and select telegram.
If the channel was never registered, run nemoclaw <sandbox-name> channels add telegram.

NOTE

The channels add telegram wizard also prompts for an optional Telegram User ID to restrict who can DM the bot. Send /start to @userinfobot on Telegram to get your numeric user ID. If you skip this, the bot will require device pairing (a terminal-based code confirmation) before responding to messages.

NOTE

For details on restricting which Telegram chats can interact with the agent, see the NemoClaw Telegram bridge documentation.

5. (Optional) Install cloudflared for remote Web UI access

The cloudflared tunnel provides a public URL for the Web UI dashboard — it is not related to Telegram messaging.

Install cloudflared for your host architecture. On ARM64 hardware platforms:

Bash

curl -L --output cloudflared.deb \
  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb
sudo dpkg -i cloudflared.deb

Start the tunnel:

Bash

nemoclaw tunnel start

Verify:

Bash

nemoclaw status

You should see ● cloudflared with a trycloudflare.com public URL.

Run NemoClaw with a Local LLM

Set Up from Your Coding Agent

Set Up from Your Terminal

Phase 1: Install and Run NemoClaw

Step 1Install NemoClaw

Step 2NemoClaw Onboarding

Step 3Interact with OpenClaw

Option 1. Web UI

Option 2. Terminal UI

Phase 2: Modify NemoClaw Policy

Step 4Enable Brave Search in sandbox

Phase 3: Set Up NemoClaw Agent

Step 5Set Up NemoClaw Agents

Phase 4: Update NemoClaw

Step 6Update NemoClaw

Phase 5: Cleanup and Uninstall

Step 7Stop services

Step 8Uninstall NemoClaw

Useful commands

Optional — Set up Messaging Channel (Telegram)

1. Create a Telegram bot

2. Register Telegram with NemoClaw and rebuild the sandbox

3. (If needed) Allow Telegram egress in the sandbox policy

4. Verify Telegram

5. (Optional) Install cloudflared for remote Web UI access

Resources

Step 1
Install NemoClaw

Step 2
NemoClaw Onboarding

Step 3
Interact with OpenClaw

Step 4
Enable Brave Search in sandbox

Step 5
Set Up NemoClaw Agents

Step 6
Update NemoClaw

Step 7
Stop services

Step 8
Uninstall NemoClaw