Index / NanoClaw · updated Sep 1, 2026
NanoClaw
qwibitai/nanoclaw · healthy · rank 8 of 43 by stars
A security-first, radically minimal OpenClaw alternative that isolates each agent in its own Linux container instead of relying on app-level permission checks. It pairs a tiny auditable codebase with multi-channel messaging (Slack, Telegram, Discord, WhatsApp, Gmail) on Anthropic's Agents SDK.
Facts
Repository
Runtime
Posture
Community
Security breakdown
Composite 92 / 100 · how these are scored
higher is safer
higher is safer
higher is safer
higher is safer
higher is riskier
Model access
Read from the repository, not written by a model · 26 files examined
1 provider
Only Anthropic was found, with no gateway, local runtime or configurable endpoint alongside it. Switching providers would mean changing code.
Pinned models
None pinned in the repository.
Evidence
Decision
Why choose NanoClaw over OpenClaw?
Why choose this
- True OS-level container isolation vs app-level allowlists
- Codebase small enough to read and fully understand
- Hardened container images with active CVE elimination
Tradeoffs
- Far smaller feature surface and skill ecosystem
- Requires Docker/container runtime on the host
- Younger project with less battle-testing at scale
Best fit
- Security-conscious users who want OS-level agent isolation
- Developers who want a small, fully auditable codebase
- Teams spawning per-agent Slack bots with separate identities
Avoid if
- You need OpenClaw's full feature breadth and large skill ecosystem
- You can't run Docker/Linux containers on your host
- You want a managed cloud service rather than self-hosting
Strong evidence from a detailed README, active v2.3.0 release, and security-focused commit history; community sentiment is positive but Reddit discussion volume is moderate, so long-term ecosystem strength is less certain.
AI layer reviewed Aug 24, 2026 · how this is written
Star activity
30,666 stars today
Overview
NanoClaw is a lightweight, security-first alternative to OpenClaw built around one core idea: agents should run in their own Linux containers with real filesystem isolation, not behind application-level permission checks. The author explicitly frames it as a reaction to OpenClaw's scale — nearly half a million lines of code, 53 config files, and 70+ dependencies all sharing one Node process — and instead delivers the same core functionality in a codebase small enough for one person to read and understand.
Architecturally, it runs directly on Anthropic's Agents SDK and connects to WhatsApp, Telegram, Slack, Discord, Gmail, iMessage, and a local CLI, with persistent memory and scheduled jobs. A standout feature is the Slack integration: setup provisions each agent its own Slack app with manifest, avatar, and workspace install, so every spawned teammate gets a distinct bot identity, container, and memory. The nanoclaw.sh bootstrap script handles the entire install — Node, pnpm, Docker, credential registration via OneCLI, container build, and channel pairing — and even invokes Claude Code to auto-diagnose failed steps.
Recent development shows a mature security posture: hardened container image pins, a publicized effort that eliminated 1,400 CVEs from images, and careful multi-instance channel support (e.g., multiple Telegram bots on one install). Compared to OpenClaw, NanoClaw trades feature breadth and ecosystem size for auditability, isolation, and operational simplicity — a compelling pick for users who want an agent they can actually verify.