NanoClaw: Security-First AI Agent for Self-Hosted Teams

NanoClaw is Gavriel Cohen's open-source Claw, and its philosophy is the deliberate opposite of OpenClaw's: ship fewer features, ship them well. The core engine sits around 800MB of RAM with a 500-line-class hot path, and every new capability gets a fresh look at dependencies and permission scope before it lands.

Its security story scores high in our methodology on two grounds. First, container isolation by default — Skills and channel adapters run in least-privilege sandboxes. Second, a steady upgrade cadence: because the core is small, each release has limited blast radius and your security review actually finishes in weeks, not quarters.

It is not trying to be everything. The usual integrations — Slack, Telegram, webhooks, a small set of model routes, file/RAG basics, error telemetry — are all in place. v0.9 tightened multi-model routing and Skills hooks, which is the main reason the Features dimension moved up this cycle. For small teams that is enough; you do have to accept that the Skill ecosystem isn't as deep as OpenClaw's, so vertical-industry Skills sometimes need to be built in-house.

BestClaw's read: NanoClaw fits teams that are security-sensitive, self-hosting on principle, and short on SRE capacity. If you want a truly tiny, turnkey shape instead, look at PicoClaw. If you really need the broadest Skill catalog, go back to OpenClaw rather than fighting NanoClaw's restraint.

NanoClaw vs OpenClaw — the decision in one paragraph. OpenClaw wins on ecosystem depth (3,200+ Skills, 15+ channels) and ceiling for customization; NanoClaw wins on default isolation, smaller blast radius per release, and ops load you can actually staff. Teams that pick OpenClaw and regret it usually underestimated governance; teams that pick NanoClaw and regret it usually hit a Skill gap mid-project. Run the full OpenClaw vs NanoClaw comparison before you commit.

Deployment path. Production shape is Docker-first: pull the official image, mount config + logs volumes, wire env for model keys, expose only the gateway port you need. K8s teams use the community Helm chart with separate namespaces per environment; bare-metal works but you lose some of the isolation story unless you keep containers. First PoC budget: 2–4 hours for a single-channel bot with one Skill — see the NanoClaw learning path for step-by-step commands.

Security assessment (BestClaw methodology). NanoClaw scores 8.4/10 overall with Security among its strongest dimensions: container sandbox by default, no major CVE on record in our tracking window, dependency tree small enough for quarterly review. Residual risks: community Skill installs (enforce whitelist), channel token storage (use your secret manager), and compliance mapping (you still own data-residency policy). Pair this page with OpenClaw security best practices if you are comparing both stacks — many controls transfer even when the runtime differs.