Getting Started with NemoClaw on DGX Spark

The NVIDIA DGX Spark is the ideal development platform for NemoClaw. With its Grace Blackwell architecture packing 128GB of unified memory and up to 1 petaflop of AI compute, a single DGX Spark can run the entire NemoClaw stack — including Nemotron 120B MoE — locally on your desk.

This tutorial walks you through the complete setup process, from unboxing to running your first secured agent blueprint.

Prerequisites

•NVIDIA DGX Spark (or any system with an NVIDIA GPU with 24GB+ VRAM for the quantized model)
•Ubuntu 22.04 LTS or later (DGX OS comes pre-installed on Spark)
•Docker 24.0+ with NVIDIA Container Toolkit
•50GB free disk space for models and containers

Step 1: Install the NemoClaw CLI

The NemoClaw CLI is the primary interface for managing the stack. Install it via the official installer:

bash

# Download and run the NemoClaw installer
curl -fsSL https://github.com/NVIDIA/NemoClaw | bash

# Verify installation
nemoclaw version
# Output: nemoclaw v1.0.0-preview (built for linux/arm64)

# Initialize NemoClaw in your project directory
mkdir my-first-agent && cd my-first-agent
nemoclaw init

The nemoclaw init command creates the project scaffolding:

my-first-agent/
├── nemoclaw.yaml          # Main configuration
├── policies/
│   ├── sandbox.yaml       # OpenShell sandbox policies
│   ├── network.yaml       # Network access policies
│   └── privacy.yaml       # Privacy Router configuration
├── blueprints/
│   └── starter.yaml       # Default agent blueprint
└── scripts/
    ├── setup.sh           # Environment setup script
    └── test-agent.sh      # Agent smoke test

Step 2: Configure the Stack

Edit nemoclaw.yaml to configure your deployment:

yaml

# nemoclaw.yaml
apiVersion: nemoclaw.nvidia.com/v1
kind: NemoClawConfig
metadata:
  name: my-first-deployment
spec:
  # Model configuration
  model:
    provider: local
    name: nemotron-120b-moe
    quantization: int4  # Use INT4 for DGX Spark
    gpuLayers: all

  # OpenShell configuration
  openshell:
    enabled: true
    isolationLevel: standard  # standard | strict | paranoid
    auditLog: true

  # Privacy Router configuration
  privacyRouter:
    enabled: true
    defaultRoute: local
    cloudEndpoints: []  # No cloud endpoints for local-only setup

  # Network Policy Engine
  networkPolicy:
    enabled: true
    defaultAction: deny
    allowlist:
      - "*.internal.company.com"

  # Agent configuration
  agent:
    framework: openclaw
    version: "3.13"
    maxConcurrentTasks: 8

Step 3: Pull the Nemotron Model

NemoClaw uses Nemotron 120B MoE as its policy evaluation engine. On DGX Spark, we use the INT4 quantized variant which fits comfortably in the 128GB unified memory:

bash

# Pull the Nemotron model (approximately 35GB)
nemoclaw model pull nemotron-120b-moe-int4

# Verify the model is ready
nemoclaw model list
# Output:
# NAME                        SIZE     STATUS
# nemotron-120b-moe-int4      34.7GB   ready

For systems with less memory, NemoClaw also supports smaller models:

bash

# Alternative: Nemotron 8B for systems with 24GB VRAM
nemoclaw model pull nemotron-nano-4b

Step 4: Start the NemoClaw Runtime

Launch the full stack with a single command:

bash

# Start all NemoClaw services
nemoclaw up

# Output:
# ✓ OpenShell runtime started (kernel modules loaded)
# ✓ Nemotron 120B MoE loaded (34.7GB, 4-bit quantized)
# ✓ Privacy Router initialized (local-only mode)
# ✓ Network Policy Engine active (deny-by-default)
# ✓ OpenClaw agent framework ready
#
# NemoClaw is running at http://localhost:7860
# Dashboard: http://localhost:7860/dashboard
# API: http://localhost:7860/api/v1

The dashboard provides real-time visibility into agent execution, policy evaluations, and security events.

Step 5: Deploy Your First Blueprint

Blueprints are pre-configured agent templates with built-in security policies. Let's deploy the Customer Support blueprint:

bash

# List available blueprints
nemoclaw blueprint list
# Output:
# NAME                  DESCRIPTION                          SECURITY LEVEL
# customer-support      Tier-1 support ticket handling       standard
# sales-ops            CRM and sales automation              standard
# security-ops         Alert triage and remediation           strict
# infra-management     Cloud resource management              strict
# code-review          PR analysis and vulnerability scan     standard
# data-pipeline        ETL orchestration                      standard

# Deploy the customer support blueprint
nemoclaw blueprint deploy customer-support

•OpenShell sandbox policy (restricts filesystem and network access)
•Nemotron policy rules (PII detection, intent classification)
•Network allowlist (only approved API endpoints)
•Operator approval workflow (escalation for refunds, account changes)

Step 6: Test Your Agent

Send a test request to your secured agent:

bash

# Send a test message to the agent
nemoclaw agent test --blueprint customer-support \
  --message "Customer John Smith (ID: 12345) is asking about their recent order #ORD-9876. They want to know the delivery status."

# Output:
# ┌──────────────────────────────────────────────┐
# │ NemoClaw Security Report                      │
# ├──────────────────────────────────────────────┤
# │ Policy Evaluation:     PASS (45ms)            │
# │ Intent Classification: customer-inquiry       │
# │ Data Sensitivity:      internal               │
# │ Model Route:           local (nemotron-120b)  │
# │ Sandbox:               cs-agent-sandbox-001   │
# │ Network Access:        crm.api, orders.api    │
# │ PII Detected:          name, customer-id      │
# │ PII Action:            redacted-from-logs     │
# │ Approval Required:     no                     │
# ├──────────────────────────────────────────────┤
# │ Agent Response:                                │
# │ "I've checked order #ORD-9876 for the         │
# │  customer. The order shipped on March 18       │
# │  via FedEx (tracking: FX123456789). Expected  │
# │  delivery is March 21."                        │
# └──────────────────────────────────────────────┘

•Classified the intent as a routine customer inquiry
•Detected PII (customer name and ID) and redacted it from logs
•Routed the request to the local Nemotron model
•Granted network access only to the CRM and orders APIs
•Determined that no human approval was required

Step 7: Monitor with the Dashboard

Open http://localhost:7860/dashboard in your browser to access the NemoClaw monitoring dashboard. Key features include:

•Real-time event stream — every agent action, policy evaluation, and security decision
•Policy violation alerts — instant notification when an agent attempts unauthorized actions
•Audit log — complete, immutable record of all agent activities
•Performance metrics — latency, throughput, and resource utilization
•Approval queue — pending human approval requests for high-risk actions

Common Configuration Patterns

Connecting to External APIs

To allow your agent to access external services, update the network policy:

yaml

# policies/network.yaml
networkPolicy:
  egress:
    allow:
      - domain: "api.zendesk.com"
        methods: [GET, POST, PUT]
        headers:
          required: ["Authorization"]
      - domain: "api.stripe.com"
        methods: [GET]  # Read-only access to payment data

Configuring Operator Approval

Set up approval workflows for sensitive operations:

yaml

# policies/sandbox.yaml
approvalWorkflow:
  enabled: true
  rules:
    - action: "refund.process"
      condition: "amount > 100"
      approvers: ["support-leads"]
      channel: "slack"
      timeout: "10m"
    - action: "account.modify"
      condition: "always"
      approvers: ["account-managers"]
      channel: "teams"
      timeout: "15m"

Enabling Cloud Model Routing

For non-sensitive tasks, you can enable cloud model routing for better performance:

yaml

# policies/privacy.yaml
privacyRouter:
  defaultRoute: local
  cloudEndpoints:
    - name: "nvidia-nim"
      url: "https://build.nvidia.com"
      apiKey: "${NVIDIA_API_KEY}"
      allowedSensitivity: ["public", "internal"]

Troubleshooting

OpenShell kernel module fails to load

bash

# Check kernel module status
nemoclaw diagnose openshell

# If using a custom kernel, ensure eBPF is enabled
# and the kernel version is 5.15+

Model loading out of memory

bash

# Check available GPU memory
nemoclaw diagnose gpu

# Switch to a smaller quantization or model
nemoclaw model pull nemotron-120b-moe-int2  # Smaller but less accurate
nemoclaw model pull nemotron-nano-4b  # Much smaller

Next Steps

You now have a fully operational NemoClaw deployment on your DGX Spark. From here, you can:

1.Customize security policies for your specific use case
2.Build custom blueprints for your organization's agent workflows
3.Integrate with your existing SIEM and observability tools
4.Scale to multi-node deployment using NemoClaw Cluster mode

Check the next post in this series for a deep dive into OpenShell's security runtime.

Getting Started with NemoClaw on DGX Spark