Overview

NanoClaw is a small TypeScript assistant from the nanocoai project, MIT-licensed since its first commit in January 2026. It is its own codebase, not a fork: its README says it gives OpenClaw's core functionality in a codebase small enough to understand. Each agent group runs in its own Linux container, with Docker as the runtime on macOS, Linux and Windows through WSL2, and only sees the folders mounted into it; API keys stay in a credential gateway outside the container. Setup is git clone and bash nanoclaw.sh, which installs Node, pnpm and Docker if they are missing and pairs a first channel (Slack, Telegram, Discord, WhatsApp, iMessage or a local CLI). Claude runs through Anthropic's Claude Agent SDK by default; OpenAI Codex, OpenCode (OpenRouter, Google, DeepSeek and others) and local Ollama models are skills you add, per agent group. Customisation means changing the code, with Claude Code. Until October 2026 this page called NanoClaw a macOS-only community fork installed from a .pkg and sandboxed in Apple containers; none of that matches its repository.

Our take

Editorial opinion, not a test result.

Best for

A personal assistant on chat apps where every agent runs in its own container
Claude users who are happy to customise the code itself with Claude Code
macOS, Linux or Windows (WSL2) hosts that already run Docker

Not for

Hosts without Docker: containers are how it isolates agents
Teams that want configuration files: NanoClaw changes are code changes
Setups that need agents cut off from the internet without extra work: the network lockdown is off by default

Security posture

Sandbox by default	yes
Auth on dashboard	yes
Threat model documented	yes
Multi-LLM support	yes
CVEs on NVD (total)	10
CVEs in the last 30 days	0

On by default: every agent group runs in its own Linux container (Docker on macOS, Linux and WSL2) as an unprivileged user with all capabilities dropped, and sees only the folders mounted into it. API keys stay in a credential gateway outside the container. The network lockdown that cuts containers off from the internet is off by default.