NanoClaw

NanoClaw is an MIT-licensed personal AI agent harness that runs each agent inside a Docker container rather than directly on your machine. Built by NanoCo as a security-focused alternative to OpenClaw, it connects to messaging apps like WhatsApp, Slack and Telegram, keeps persistent memory, and runs scheduled jobs on Anthropic's Claude Agent SDK.

NanoClaw is an open-source AI agent harness created in February 2026 by brothers Gavriel and Lazer Cohen, whose Tel Aviv company NanoCo pivoted from AI marketing to build it. Its premise is deliberately austere: the software hosting a powerful agent should be small enough to read end to end, so the TypeScript codebase spans roughly fifteen core source files against OpenClaw's half-million lines and seventy-plus dependencies. Architecturally it is a three-tier system. A host process routes messages down an entity hierarchy from user to messaging group to agent group to session; two per-session SQLite databases, inbound.db and outbound.db, act as a bridge with single-writer semantics that avoids cross-mount contention and complex IPC; and a per-agent-group Docker container runs the agent itself on Bun and Anthropic's Claude Agent SDK. The security model is isolation rather than permission-checking — agents see only what is explicitly mounted, and credentials never sit in the container as raw API keys because requests route through OneCLI's Agent Vault, which injects authentication at the proxy layer. In March 2026 Docker partnered with NanoCo to run NanoClaw agents inside MicroVM-based Docker Sandboxes for isolation stronger than a process jail. Channels install on demand via /add-<channel> skills and cover WhatsApp, Telegram, Discord, Slack, Microsoft Teams, iMessage, Matrix, Google Chat, Webex, Linear, GitHub, WeChat and email. The project has passed 30,000 GitHub stars and 250,000 downloads; NanoCo raised a $12M seed in May 2026 after turning down a roughly $20M buyout.

Category

AI Agents & Orchestration

Pricing

Free, Contact for pricing

Target Market

CTOs, CISOs, Enterprise Developers, Platform Engineers

Deployment

Open-source, Self-hosted

Founded

2026

Headquarters

Tel Aviv, Israel

Customers

Over 250,000 downloads and 30,500+ GitHub stars; employees at Amazon, Google, Meta, SentinelOne, Accenture and Gap reported as users, though no formal customer deals have been named

• ✓
  Per-agent Docker container isolation

  Every agent group runs in its own container with filesystem isolation, so an agent sees only what is explicitly mounted.

• ✓
  Auditable minimal codebase

  Roughly fifteen core source files in TypeScript, deliberately kept small enough that a reviewer can read the whole harness.

• ✓
  SQLite message bridge

  Two per-session databases with single-writer semantics move messages in and out, avoiding cross-mount contention and complex inter-process communication.

• ✓
  Docker Sandboxes MicroVM support

  Optional MicroVM-based sandboxes from the Docker partnership give a stronger isolation boundary than a standard container process jail.

• ✓
  On-demand channel skills

  Messaging channels install individually through /add-<channel> skills rather than shipping built in, keeping the trunk minimal.

• ✓
  Agent Vault credential injection

  Containers never hold raw API keys; OneCLI's Agent Vault injects authentication at the proxy layer on outbound calls.

• ✓
  Persistent memory and scheduled jobs

  Per-agent-group memory via CLAUDE.md plus recurring tasks with script gates that avoid waking containers unnecessarily.

• •
  Personal assistant over messaging apps

  Reach a private agent through WhatsApp or Telegram that retains context and can act on live data safely.

• •
  One sandboxed agent per employee

  NanoCo's enterprise service gives each employee an isolated agent, routing Slack or Teams requests through a bridge and credential vault.

• •
  Safe autonomous execution

  Docker Sandboxes let teams run aggressive modes such as skipping permission prompts because actions stay contained in a disposable MicroVM.

• •
  Scheduled operational checks

  Recurring jobs poll systems or summarize activity on a schedule, gated by scripts so containers wake only when needed.

• •
  Auditable agent deployment in regulated teams

  Security reviewers can read the entire harness before approval, which is impractical with half-million-line alternatives.

The harness itself is free and MIT-licensed, but it is not free to run: NanoClaw executes on Anthropic's Claude Agent SDK and requires either a Claude API key, billed by Anthropic on token consumption, or a Claude Code subscription. You also supply the host machine and Docker runtime. NanoCo separately sells a managed enterprise service that provisions one sandboxed agent per employee with centralized policy, credential vaulting and forward-deployed engineers for implementation; no list pricing for that service has been published, and the company was still booking early enterprise customers as of mid-2026.

This page was written from 6 sources, 5 on domains other than nanoclaw.dev.

1. 1.github.com — nanoclaw
2. 2.nanoclaw.dev — nanoclaw.devvendor
3. 3.docker.com — nanoclaw docker sandboxes agent security
4. 4.techtarget.com — NanoClaw AI agents find a home in Docker Sandboxes
5. 5.techcrunch.com — nanoclaw creator turns down 20m buyout offer raises 12m seed
6. 6.thenewstack.io — nanoco nanoclaw sandboxed agent