Secure AI Agents with OpenShell

Agent-ready models

Agent-ready models are tuned for agentic workloads — tool calling, reasoning traces, and long multi-turn sessions. Pick the recommended model for your hardware platform, serve it with an OpenAI-compatible API (this playbook uses vLLM), then continue with the Instructions tab to wire OpenShell inference routing and launch the OpenClaw sandbox.

Recommendations by hardware platform

Hardware platform	Recommended agent-ready model	HuggingFace handle	Notes
DGX Spark	Agent-ready Qwen3.6-35B-A3B (NVFP4)	`nvidia/Qwen3.6-35B-A3B-NVFP4`	Recommended for unified-memory agentic serving; launch via Agent-ready Models
DGX Station	NVIDIA Nemotron 3 Ultra	`nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4`	Recommended for Station; launch via the DGX Station deployment guide

NOTE

DGX Spark: launch via Agent-ready Models. DGX Station: use the Nemotron 3 Ultra Station deployment guide. OpenShell requires the server to listen on all interfaces (--host 0.0.0.0) so the gateway container can reach it — keep that flag when you launch.

Before you serve

Complete Docker setup in the Instructions tab (Steps 1–2).
Export a Hugging Face token if your model requires it:

Bash

export HF_TOKEN=your_actual_token_here

Launch the recommended recipe for your hardware platform (Spark: Agent-ready Models; Station: Station deployment guide), ensuring --host 0.0.0.0 and port 8000.
Confirm the API is up:

Bash

curl -s http://0.0.0.0:8000/v1/models

Expected: a JSON "data" array that includes your model handle. If the request hangs, the model is still loading — wait for Application startup complete in the container logs and retry.

Note the exact model id from the response. You will use that string for openshell inference set and in the OpenClaw onboarding wizard.

OpenShell-specific requirements

Requirement	Why it matters
`--host 0.0.0.0`	The OpenShell gateway runs inside Docker and cannot reach a server bound only to `localhost`.
Host IP in the provider URL	Create the OpenShell provider with `http://{Machine_IP}:8000/v1`, not `localhost` or `127.0.0.1`.
Matching model id	The OpenClaw wizard Model ID must match the handle served by vLLM and configured in `openshell inference set`.

Next steps

Return to the Instructions tab starting at Step 5. Serve a model with vLLM (or skip ahead if the server is already running), then create the inference provider and deploy the sandbox.