Deploy NemoClaw
Add NVIDIA NeMo Guardrails to your OpenClaw agent for application-layer security — input/output rails, jailbreak detection, PII masking, and full audit logging.
Prerequisites
Clawkeeper account with a paid plan
NemoClaw deploys via Cloud Deploy, which requires a paid plan (Pro, Team, or Enterprise). Sign up at clawkeeper.dev/signup and upgrade in Settings.
LLM provider API key
NemoClaw supports Anthropic, OpenAI, Google, Ollama (local), and Ollama Cloud. Have your API key ready before starting the wizard.
Deploy a NemoClaw Instance
Open the deploy wizard
Go to Fleet → Deploy Cloud Instance or click + Deploy on the Fleet page.
Select NemoClaw as the agent framework
In Step 0: Agent Framework, select the NemoClaw card (marked with the NVIDIA badge). This automatically:
- Upgrades instance size to 4GB+ RAM
- Installs Python 3.11 and NeMo Guardrails
- Enables Docker deploy mode
- Configures guardrail policies
Configure agent and security settings
Walk through the remaining wizard steps: name your agent, pick a region, select your LLM provider, and configure security settings. NemoClaw instances get both Clawkeeper Runtime Shield and NeMo Guardrails for dual-layer protection.
Deploy and watch progress
Click Deploy. The dashboard shows real-time provisioning progress. NemoClaw instances take slightly longer than standard OpenClaw deploys because of the Python/guardrails setup.
NeMo Guardrails Features
Input rails
Input rails validate every message before it reaches the LLM. Built-in protections include jailbreak detection, topic enforcement, and PII detection. Messages that trip a rail are blocked with an explanation.
Output rails
Output rails scan LLM responses before they reach the user. This catches hallucinated PII, off-topic responses, and policy violations that the model generates despite the system prompt.
PII masking
NemoClaw automatically detects and masks personally identifiable information (emails, phone numbers, SSNs, credit cards) in both directions. Masked data is logged for audit but never forwarded.
Audit logging
Every rail evaluation is logged with timestamp, verdict, matched pattern, and confidence score. View audit logs from the host detail page in the dashboard under the Monitoring tab.
Clawkeeper + NemoClaw: Defense in Depth
Clawkeeper secures the infrastructure: host hardening, firewall rules, container isolation, credential scanning, and continuous monitoring.
NemoClaw secures the AI runtime: input/output guardrails, jailbreak detection, PII masking, and topic enforcement.
Together they close both gaps — a hardened server running a guardrailed AI agent, monitored from a single dashboard.