Open-source platform that runs Claude agents in isolated per-session containers, connects them to messaging channels, keeps per-agent memory and scheduled tasks, and routes credentials through a vault so keys never enter containers.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
63
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
4 prerequisites to line up before setup.
Safety & privacy surface
4 safety and 4 privacy notes across 6 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.
Disclosure: editorial
git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2
cd nanoclaw-v2
bash nanoclaw.shNanoClaw is a lightweight, open-source platform for running Claude agents safely. It orchestrates per-session agent containers that receive incoming messages, run Claude through Anthropic's Agent SDK, and deliver responses back through messaging channels. It is positioned as a security-focused alternative that gives agents only the access they explicitly need.
It is released under the MIT license and is primarily TypeScript, running on Node.js with Docker (or Apple Container on macOS) for isolation and SQLite for message storage.
Clone the repository and run the setup script:
git clone https://github.com/nanocoai/nanoclaw.git nanoclaw-v2
cd nanoclaw-v2
bash nanoclaw.sh
Editorial listing. No paid placement or affiliate relationship. NanoClaw is open source under the MIT license.
Show that NanoClaw is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/tools/nanoclaw)NanoClaw side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Open-source platform that runs Claude agents in isolated per-session containers, connects them to messaging channels, keeps per-agent memory and scheduled tasks, and routes credentials through a vault so keys never enter containers. Open dossier | Open-source infrastructure for securely running AI-generated code in isolated sandboxes that start in milliseconds, with SDKs for Python, TypeScript, and other languages, persistent snapshots, and an optional managed cloud. Open dossier | Open-source infrastructure for running AI-generated code in secure, isolated cloud sandboxes, with Python and JavaScript SDKs, a Code Interpreter package, and self-hosting options. Open dossier |
|---|---|---|---|
| Next steps | |||
| Trust | |||
| Review status | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed |
| Submitter | JPette1783 | JPette1783 | JPette1783 |
| Install risk | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | |||
| Category | tools | tools | tools |
| Source | Source-backed | Source-backed | Source-backed |
| Author | nanocoai | Daytona | E2B |
| Added | 2026-06-05 | 2026-06-05 | 2026-06-05 |
| Platforms | |||
| Harness | |||
| Source repo | — | — | — |
| Safety notes | ✓Agents run in OS-level container isolation (Docker or Apple Container) with explicit filesystem mounts; bash commands execute inside containers, not on the host. Each agent group gets its own container, isolated CLAUDE.md memory, and selective mounts, limiting what a single agent can reach. Scheduled tasks run Claude on a recurring basis and can message users automatically; review schedules and message permissions. Messaging channels are installed on demand and can send outbound messages on your behalf, so scope which channels and agents are enabled. | ✓Daytona is purpose-built to execute arbitrary, AI-generated code; only run untrusted code inside its isolated sandboxes, never on the host. Each sandbox has its own kernel, filesystem, and network stack, but sandboxes can make outbound network requests unless network limits are configured. Sandboxes support computer use, Git operations, and command execution; scope what an agent can do and review declarative builder configurations before use. Self-hosting runs runner compute nodes and Docker services that need elevated host privileges; isolate the deployment from production systems. Persistent snapshots retain sandbox filesystem state across sessions, which can preserve secrets or sensitive files written during execution. | ✓E2B is built to execute arbitrary, AI-generated code; run such code only inside its isolated cloud sandboxes, never directly on a developer machine. Sandbox network and filesystem access depend on configuration; review and restrict sandbox capabilities before running untrusted code. Generated code can still perform destructive or unexpected actions within a sandbox, so treat sandbox outputs and side effects with caution. Self-hosting deploys cloud infrastructure via Terraform that you are responsible for securing, patching, and isolating from production systems. |
| Privacy notes | ✓API keys never enter containers; outbound requests route through OneCLI's Agent Vault, which enforces per-agent policies and rate limits. Messages flow through inbound/outbound SQLite databases rather than shared memory, and each agent group only accesses explicitly mounted directories. Channels can be configured for full per-channel privacy, unified memory with separate conversations, or a single shared session; choose the mode that matches your privacy needs. Running Claude through the Anthropic Agent SDK sends conversation context to Anthropic's API. | ✓Using the managed cloud sends your code, files, and execution data to Daytona-operated infrastructure; review their terms before processing sensitive data. The platform emits OpenTelemetry metrics, log streaming, and audit logs that can capture command output and activity. API keys grant access to your sandboxes and organization; store them as secrets and never commit them to source control. Self-hosting keeps execution data on your own infrastructure but you become responsible for log retention, access control, and isolation. | ✓On the managed cloud, your code and execution data are sent to and run on E2B-operated infrastructure; review their privacy terms before processing sensitive data. API keys grant access to your sandboxes; store them in environment variables or a secrets manager and never commit them to source control. Data passed into a sandbox (files, inputs, environment variables) lives in that sandbox for its lifetime; avoid sending secrets you do not need there. Self-hosting keeps execution data on your own infrastructure, making log retention, access control, and isolation your responsibility. |
| Prerequisites |
|
|
|
| Install | — | — | — |
| Config | — | — | — |
| Citations | |||
| Claim | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Set autoMode.hard_deny rules to block risky actions in auto mode.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.