Index / NanoClaw · updated Oct 16, 2026
NanoClaw
qwibitai/nanoclaw · healthy · rank 9 of 50 by stars
A radically minimal OpenClaw alternative where each agent runs in its own Linux container with real OS-level isolation instead of app-level permission checks. Small enough to read end-to-end, with per-agent Slack apps, memory, and scheduled jobs on Anthropic's Agents SDK.
Facts
Repository
Runtime
Posture
Community
Security breakdown
Composite 88 / 100 · how these are scored
higher is safer
higher is safer
higher is safer
higher is safer
higher is riskier
Model access
Read from the repository, not written by a model · 51 files examined
2 providers · runs locally · custom endpoint
Pinned models
None pinned in the repository.
Evidence
Decision
Why choose NanoClaw over OpenClaw?
Why choose this
- True OS-level container isolation per agent vs single shared Node process
- Codebase small enough to fully audit and understand
- Fewer dependencies and config files reduce attack surface
Tradeoffs
- Far smaller feature set and skill ecosystem
- Younger project with less battle-testing at scale
- Requires Docker and more hands-on setup
Best fit
- Security-conscious users who want auditable, minimal code
- Running multiple isolated agents with separate identities
- Self-hosters comfortable with Docker and Node tooling
Avoid if
- You need OpenClaw's full feature breadth and plugin registry
- You want a managed, zero-setup hosted experience
- You require multi-user enterprise administration
Strong README and commit evidence supports the security and architecture claims; community sentiment is positive but Reddit discussion is thin and partly tangential, so sentiment scores carry moderate uncertainty.
AI layer reviewed Oct 5, 2026 · how this is written
Star activity
30,955 stars today
Overview
NanoClaw is a deliberately minimal reimplementation of OpenClaw's core idea: a personal AI assistant reachable over WhatsApp, Telegram, Slack, Discord, Gmail, and iMessage, with persistent memory and scheduled jobs. The author's stated motivation is trust — OpenClaw's ~500k lines, 53 config files, and 70+ dependencies were too much to audit, so NanoClaw compresses the same core functionality into one process and a handful of files running on Anthropic's Agents SDK.
The defining architectural difference is isolation. Where OpenClaw enforces security at the application layer (allowlists, pairing codes) inside a single shared Node process, NanoClaw runs each agent in its own Linux container with filesystem isolation. A credential gateway brokers Anthropic credentials so agents never hold raw keys, and recent commits show active hardening: CA trust fixes for TLS-inspecting gateways, log redaction that survives BigInt/cycle edge cases, and a pinned Baileys release to patch a WhatsApp message-spoofing CVE.
Operationally it targets self-hosters: a nanoclaw.sh bootstrap installs Node, pnpm, and Docker, builds the agent container, and pairs channels, with Claude Code auto-invoked to diagnose failed steps. Recent work added update channels (stable/beta/edge) and per-agent Slack app provisioning, signaling a maturing project — though the ecosystem and feature surface remain far smaller than OpenClaw's.