NanoClaw: Agent Orchestration with the Gateway

NanoClaw is an open-source agent runtime that isolates every agent in its own Docker container. Hogpass is an open-source credential and policy layer for AI agents. Together, they give you the full stack: runtime isolation, credential isolation, and policy enforcement.

The full stack

Layer	What it solves	Project
Runtime isolation	Each agent gets its own container, filesystem, and process space. No ambient access to the host.	NanoClaw
Credential isolation	Agents never hold raw API keys. Credentials are injected at the proxy level per-request.	Hogpass
Policy enforcement	Rules control what agents can access, which operations are allowed, and how often.	Hogpass

NanoClaw solves the problem of agents escaping their sandbox. Hogpass solves the problem of agents misusing the access they’ve been given. You need both.

How it works

NanoClaw runs each agent in a Docker container. Hogpass runs as a sidecar (or shared service) that acts as the HTTP gateway for all agent traffic. When NanoClaw spawns an agent container, it configures the agent to route HTTP traffic through Hogpass’s gateway.

NanoClaw creates a Docker container for the agent
The container’s HTTP_PROXY / HTTPS_PROXY environment variables point to Hogpass’s gateway
The agent makes normal HTTP requests. It doesn’t know Hogpass exists
Hogpass checks rules (block/rate-limit), injects credentials, and forwards the request
The response flows back to the agent

Setup

Prerequisites

Docker running on your machine
Hogpass running (see Quickstart)
NanoClaw installed (github.com/qwibitai/nanoclaw)

1. Start Hogpass

docker run --pull always \
  -p 10254:10254 \
  -p 10255:10255 \
  -v onecli-data:/app/data \
  ghcr.io/onecli/onecli

2. Configure agents and credentials in Hogpass

You can do this through the dashboard at localhost:10254, or automate it with the Hogpass CLI:

CLI (recommended for automation)
Dashboard

# Install the CLI
curl -fsSL onecli.sh/cli/install | sh

# Create an agent for each NanoClaw agent
onecli agents create --name "email-agent" --identifier email-agent

# Add credentials
onecli secrets create --name "Gmail" --type google --value "$GMAIL_TOKEN"

# Assign specific secrets to the agent
AGENT_ID=$(onecli agents list --quiet id | head -1)
onecli agents set-secrets --id "$AGENT_ID" --secret-ids "$SECRET_ID"
onecli agents set-secret-mode --id "$AGENT_ID" --mode selective

This is especially useful when NanoClaw is provisioning agents dynamically. The CLI lets your orchestrator create agent identities, assign scoped credentials, and configure rules without any manual dashboard interaction.

3. Configure NanoClaw to route through Hogpass

When NanoClaw spawns agent containers, configure them to use Hogpass as their HTTP proxy. The agent containers need:

HTTP_PROXY and HTTPS_PROXY pointing to Hogpass’s gateway
The Hogpass CA certificate for HTTPS interception
A Proxy-Authorization header with the agent’s access token

If you’re using the Node.js SDK, applyContainerConfig() handles all of this automatically:

import { OneCLI } from "@onecli-sh/sdk";

const onecli = new OneCLI({
  url: "http://localhost:10254",
  apiKey: "oc_agent_access_token",
});

const args = ["run", "-i", "--rm", "--name", "my-nanoclaw-agent"];
await onecli.applyContainerConfig(args);

// args now has HTTPS_PROXY, CA certs, and volume mounts configured

One-line install (Cloud)

If you’re using Hogpass Cloud, the dashboard provides a one-line install command that clones NanoClaw, configures your .env with the correct Cloud URL and API key, installs dependencies, and sets up the CLI:

curl -fsSL https://app.onecli.sh/v1/install/nanoclaw | sh

After the script completes, follow the on-screen instructions to run the /setup wizard inside the NanoClaw directory.

Migrating from self-hosted to Cloud

If you’re already running NanoClaw with a self-hosted Hogpass instance and want to move to Cloud, use the migration script:

curl -fsSL https://app.onecli.sh/v1/migrate/nanoclaw | sh

The migration script:

Exports secrets from your local Hogpass instance
Updates your CLI config to point at Hogpass Cloud
Finds all NanoClaw installations on your machine (via launchd, systemd, or common directories)
Updates each NanoClaw .env with the Cloud URL and API key
Restarts NanoClaw services so they route through Cloud

After migration, reconnect your OAuth app integrations (Gmail, GitHub, etc.) in the Cloud dashboard since OAuth tokens are not transferable between instances.

Per-agent policies

Since each NanoClaw agent gets its own Hogpass agent identity, you can set different rules per agent:

Your “email-agent” can read emails but not delete them
Your “code-agent” can access GitHub but not Slack
Your “research-agent” has read-only access to everything, rate-limited to 100 requests per hour

See Rules for the full details on setting up policies.

​The full stack

​How it works

​Setup

​Prerequisites

​1. Start Hogpass

​2. Configure agents and credentials in Hogpass

​3. Configure NanoClaw to route through Hogpass

​One-line install (Cloud)

​Migrating from self-hosted to Cloud

​Per-agent policies

The full stack

How it works

Setup

Prerequisites

1. Start Hogpass

2. Configure agents and credentials in Hogpass

3. Configure NanoClaw to route through Hogpass

One-line install (Cloud)

Migrating from self-hosted to Cloud

Per-agent policies