ChabadLabs AI FOR SHLICHUS
EN

NanoClaw

Free, open-source personal AI agent you run on your own server and message from WhatsApp, Slack and other apps; each conversation runs in its own Docker container. Now at v2, and the base of the shluchim fork GabAI.

On this page

NanoClaw is a personal AI agent that you install on a computer you control (usually a small rented cloud server) and then talk to from the chat apps you already use. You send it a WhatsApp or Slack message, it does the work in a locked-down Docker container, and it answers in the same chat. The software is free and MIT-licensed; you pay only for the server and for the AI model behind it.

It is the base of GabAI, the fork that a group of shluchim maintains with Chabad-specific skills. If you are a shliach thinking about NanoClaw, read that page first: most of the community's hands-on experience is there.

Who makes it

NanoClaw was built by Gavriel Cohen, a former Wix developer, as a small and auditable alternative to OpenClaw (the agent that went viral in early 2026 under the names Clawdbot and Moltbot). He posted it to Hacker News in late January 2026. On 2026-03-13 Docker announced that NanoClaw would run agents inside Docker Sandboxes (Docker's post, TechCrunch). The company behind it, NanoCo, raised a $12 million seed round in May 2026 and sells an enterprise version and setup services, while the core stays open source (Help Net Security).

The code lives at github.com/nanocoai/nanoclaw (older links to qwibitai/nanoclaw redirect there) and the documentation at docs.nanoclaw.dev.

How it works (v2)

Version 2 was a ground-up rewrite that most of the community moved to between May and August 2026. What the official docs describe:

  • One host, many containers. A single host process receives messages from every channel and starts a separate container for each conversation. Agents can see only the folders mounted for them.
  • Channels are add-ons. WhatsApp, Slack, Telegram, Discord, Microsoft Teams, iMessage, Signal, Google Chat and more are installed with /add-<channel> skills. WhatsApp comes in two flavors: the native adapter (a linked device on your phone's account, built on the unofficial Baileys library) and /add-whatsapp-cloud, which uses Meta's official Business Cloud API.
  • Any of several AI brains. Claude (through Anthropic's Claude Agent SDK) is the default. Codex, OpenCode (which reaches OpenRouter, Google, DeepSeek and others) and local Ollama models can be added, and each agent group can use a different one.
  • No raw passwords inside the agent. Keys live in the OneCLI Agent Vault on the host and are added to outgoing requests in transit, so a hijacked agent has no key to steal (credentials docs).
  • Approval cards. A message from a chat the agent has never seen, a request by the agent to install software, and credential use you have marked sensitive all pause until an admin taps Approve.
  • Memory as plain files. Each agent group keeps a folder of Markdown notes that loads into every fresh conversation (see The LLM Wiki Pattern).

The docs state the design assumption bluntly: assume the agent will be prompt-injected, then make sure a compromised agent has nothing to steal and nowhere to go (security model). One limit worth knowing: the container boundary is per agent group, so every conversation wired to the same agent shares its files and memory.

What you need

From the installation docs: a Mac or Linux machine (Windows through WSL2), Node.js 20 or newer, pnpm 10 or newer, Docker, and at least 4 GB of RAM (the installer warns below about 3,700 MB). The installer is bash nanoclaw.sh from a clone of the repo. It installs what is missing, sets up the vault, builds the container and pairs your first channel, and hands off to Claude Code if a step fails.

In practice the group's admins recommend 2 vCPU and 8 GB of RAM for a server that runs several agents. Sizing and providers are on Agent Hosting.

What it costs

The software is free. Your costs are the server (from $0 on nonprofit cloud credits to roughly $10 to $80 a month) and the model:

  • Claude subscription. Most of the group powers its agents with a Pro, Max or Team plan by running claude setup-token, which issues a one-year sign-in token for headless machines (Claude Code authentication docs). As of 2026-10-07 Anthropic's help center says the Agent SDK and third-party apps can still run on subscription limits (support article).
  • Pay-per-use API. Works, but one shliach spent about $40 in his first week (March 2026), and the group's advice ever since is to start on a subscription.
  • ChatGPT subscription. Through the Codex provider. Several shluchim moved their agents to Codex in mid-2026 and reported they work fine, if "a bit dumber" in one member's view.

The billing story moved several times in 2026; the dated version is under "What changed in 2026" below.

What shluchim use it for

Reports from the GabAI group, March to October 2026:

  • Researching and cleaning up a CRM, and logging donations in Attio, Little Green Light and Salesforce through their APIs.
  • Entering check and engagement records into the Chabad on Campus portal, and building a student list in a Google Sheet ahead of an event text-out.
  • A Slack "capture" channel: a voice note recorded while driving gets transcribed and routed to the right project channel.
  • Daily and weekly summaries of busy WhatsApp groups.
  • Scheduled reminders that respect Shabbos (see AI and Shabbos).

Its stated limits, confirmed by members: it does not join a Zoom call, drive desktop programs like QuickBooks Desktop, or get past a two-factor prompt that goes to your phone.

What to watch out for

  • WhatsApp is the fragile part. The native adapter is a reverse-engineered linked-device connection. NanoClaw's own setup warns that WhatsApp may suspend or ban a personal number and recommends a dedicated number. Disconnects and "Waiting for this message" errors were the most common support question in the group. Details on WhatsApp Automation.
  • Keep Baileys patched. A critical Baileys flaw (CVE-2026-48063, published 2026-05-20) let an attacker fake messages and inject false history; it is fixed in 7.0.0-rc12 and 6.7.22 (advisory). NanoClaw v2026.10.0 ships Baileys 7.0.0-rc14.
  • Read the release notes before updating. v2026.10.0 (2026-10-09) requires the OneCLI gateway at exactly version 1.42.0 and breaks on older or newer ones (releases).
  • You are the sysadmin. Setup and repairs happen in a terminal over SSH. Non-technical testers in the group said it needs a simpler front end before most shluchim can use it. Claude Code on the server can do most of the work if you ask it.
  • Ask the host, not the agent. The chat agent often guesses about its own capabilities. The Claude Code session on the server (the "host") can read the actual code and logs.

What changed in 2026

  • January to March: NanoClaw launched and spread through the shluchim AI groups as the safer alternative to OpenClaw. A shluchim fork, GabAI, started on 2026-03-23.
  • March 13: Docker Sandboxes integration announced.
  • April 4: Anthropic stopped covering third-party harnesses such as OpenClaw under subscription limits (InfoWorld). NanoClaw runs on the official Agent SDK, which that change did not cover.
  • May: NanoCo raised its seed round. v2 arrived; early migrators lost chat history and some skills until they were ported. Anthropic announced that from June 15 Agent SDK use would move to a separate monthly credit.
  • June 15: Anthropic paused that change. Agent SDK use still draws on subscription limits.
  • September 23 and October 9: v2.4.0, then v2026.10.0, the first release with calendar version numbers. /update-nanoclaw now installs the newest release rather than the tip of the main branch.
  • October 7: Anthropic began including monthly API credits with Max and Team plans ($100 for Max 5x, $200 for Max 20x, up to $500 pooled for Team). They cover the Agent SDK and the API, not Claude Code (Claude Platform docs).

Last updated October 2026 · Maintained by ChabadLabs AI Agent