Operations Analysis

NanoClaw: Should You Run It?

qwibitai/nanoclaw • 14,400 stars • MIT License • February 2026

Executive Summary

What it is WhatsApp-connected Claude agent with container isolation
Codebase ~500–2,000 lines TypeScript (fully auditable)
Should you run it? Yes — on a dedicated Mac Mini
Voice calls? Not now — distraction. WhatsApp voice notes cover 90%
Gmail access? Separate email only
Calendar? Yes — read-only, high value for morning briefings

1. What NanoClaw Does

NanoClaw is a minimalist AI assistant framework by Gavriel Cohen (Qwibit). It connects Claude (via Anthropic's Agent SDK) to WhatsApp and runs each agent session inside an isolated OS-level container. Created as a reaction to OpenClaw's bloated 400,000-line codebase and its severe security issues.[1]

Karpathy's endorsement: "Giving private data and keys to 400,000 lines of vibe-coded code that is being actively attacked at scale is not very appealing at all." He explicitly named NanoClaw as a preferred alternative to OpenClaw.[2]

Current Capabilities

Messaging

  • WhatsApp (primary)
  • Telegram, Discord, Slack, Signal via skills
  • Gmail integration via MCP
  • Headless operation

Agent Features

  • Per-group CLAUDE.md memory
  • Scheduled tasks (cron/interval/one-shot)
  • Agent Swarms (multi-agent collaboration)
  • Web search & content fetch

Security

  • OS-level container isolation (Apple Container / Docker)
  • Mount allowlist (blocked: .ssh, .gnupg, .aws)
  • Per-group filesystem sandboxing
  • Environment variable filtering

Architecture

WhatsApp
via Baileys
→
SQLite DB
messages.db
→
Polling Loop
every 2s
→
Trigger Match
e.g. @Andy
→
Container
Apple/Docker
→
Claude Agent
reads CLAUDE.md
→
Response
IPC → WhatsApp

Single Node.js process. Three polling loops: messages (2s), IPC watcher (1s), scheduler (60s). Containers communicate via filesystem-based IPC — JSON files written by containers, picked up by host. No HTTP overhead, no microservices.

2. NanoClaw vs Alternatives

FeatureNanoClawOpenClawCron + Claude CLI
Codebase size~500–2K lines~400K linesCustom (minimal)
SecurityOS-level containersApplication-level (CVE-2026-25253)None (process-level)
WhatsAppBuilt-inBuilt-inNo
SchedulingBuilt-inBuilt-inVia cron
Persistent memoryPer-group CLAUDE.mdConversation historyManual file-based
Stars (community)14,400214,000+N/A
Auditability~8 minDaysCustom
Known CVEsNoneCVE-2026-25253 (RCE), malicious skillsNone
OpenClaw security incidents (Feb 2026): CVE-2026-25253 (one-click RCE), thousands of exposed instances found by Bitsight, 341 malicious ClawHub skills distributing Atomic macOS Stealer (Trend Micro). Karpathy, the creator's own endorser, flagged these concerns publicly.[3][4]

Sources

  1. NanoClaw GitHub Repository — 14,400 stars, 2,200 forks, 29+ contributors
  2. Karpathy on "Claws" — Simon Willison, Feb 21 2026
  3. OpenClaw Bug Enables One-Click RCE — The Hacker News
  4. Malicious OpenClaw Skills — Trend Micro