NanoClaw vs OpenClaw: isolation, providers and running cost

NanoClaw and OpenClaw are both free, MIT-licensed, self-hosted assistants, and NanoClaw's own repository describes it as a lightweight alternative to OpenClaw — so the choice is not about price but about isolation and provider freedom. NanoClaw runs every agent session inside its own Docker container and keeps credentials in a vault; OpenClaw runs unsandboxed by default and accepts an arbitrary custom model provider in one config file. Software cost is $0 on both sides; the real bill is the model API, the host, and — for NanoClaw only — a possible Docker license.

First, make sure you have the right products

This page is about github.com/nanocoai/nanoclaw and github.com/openclaw/openclaw. Four lookalikes cause wrong answers:

• The old NanoClaw org. The repository was renamed from qwibitai/nanoclaw to nanocoai/nanoclaw; release 2.0.63, dated 2026-05-15 in the project's CHANGELOG, records sweeping the remaining qwibitai/nanoclaw references "across code and docs" after that rename. The old address still resolves — GitHub redirects it to the current repository — so old links land on today's code while the prose around them may not have been updated.
• The PyPI package called nanoclaw. Its own summary calls it an "Installer for the cmdop CLI — one binary to run an AI agent in a container you own", with cmdop.com as its homepage — a different product with its own versions and terms (PyPI). pip install nanoclaw gets you that installer, not the messaging agent.
• ApeCodeAI/nanoclaw-py. A separate ~500-line Python Telegram project whose README says it is "heavily inspired by nanoclaw" (repo). Its configuration is its own.
• OpenClaw's two former names. Clawdbot became Moltbot on January 27, 2026 after an Anthropic trademark request, then OpenClaw about three days later (CNBC). Same project. The project's own sites link to each other: openclaw.ai footers out to docs.openclaw.ai, the Foundation at openclaw.org, the skills hub at clawhub.ai and the GitHub repository, so treat those as the set to check a config snippet against. NVIDIA also publishes its own OpenClaw-related pages under NVIDIA NemoClaw; those are NVIDIA's, not the project's.

Who should pick which

Decide on isolation first, because that is the choice you cannot retrofit cheaply. NanoClaw's container-per-session model is the default and the only runtime it ships; turning OpenClaw's sandbox on later means picking a backend and re-testing every tool. Decide on providers second: OpenClaw's custom-provider block is declarative and open-ended, while NanoClaw's supported third-party routes run through skills and a credential vault.

Feature and requirement comparison

Sources checked September 18, 2026: NanoClaw installation, NanoClaw releases, OpenClaw getting started, OpenClaw configuration, OpenClaw releases and OpenClaw sandboxing; repository counts, release history, channel lists and issue #1984 re-checked September 21, 2026. Star and commit counts move daily; they are what the repositories reported on the later date. Third-party summaries reporting a Node 22 floor for OpenClaw disagree with the project's own repository documentation — use the repository.

One stale description worth flagging: a large body of writing says NanoClaw runs in Apple containers. The CHANGELOG entry for 2.0.0, dated 2026-04-22, records "Apple Container removed from default setup" and says it stays available as an opt-in through /convert-to-apple-container; the installation page describes Docker as the only runtime shipped in the repository. If you are following an Apple Container write-up, check it against your own version first.

Execution model and permissions

NanoClaw's README describes a single Node host orchestrating per-session agent containers. Credentials do not follow the agent into the container: since 2.0.0 the CHANGELOG states the OneCLI Agent Vault is the sole credential path and containers never receive raw API keys. A Native Credential Proxy skill used to offer an escape hatch — gated by NANOCLAW_NATIVE_CREDENTIALS=true, it injected the keys as Docker -e arguments, while its own page called env-threaded credentials "an anti-pattern". The 2.3.0 CHANGELOG entry closes it: the use-native-credential-proxy skill is retired, and the new session spec "refuses credential values in container env on every lane, by design". Plan on the vault. NanoClaw also pins a sanctioned OneCLI gateway version in versions.json — 2.3.0 records new installs moving to gateway 1.41.0 — and OneCLI is a separate project (github.com/onecli/onecli) with its own terms, so read those before you depend on it.

OpenClaw inverts the default. Its sandboxing page says sandboxing is off by default and controlled by agents.defaults.sandbox, that the gateway process always stays on the host, and that only tool execution moves into the sandbox when enabled — with tools.elevated deliberately running outside it. The same page volunteers that this is not a perfect security boundary. NanoClaw makes no comparable qualified statement, which means the honest comparison stops at "on by default versus off by default"; neither project publishes a measurement you could rank them by.

Providers, custom endpoints and where each one stops

This is the section that actually decides the bill, and the two products draw the line in different places.

OpenClaw takes a declarative custom provider under models.providers.<provider-id>. Per its custom-provider reference, you supply baseUrl, apiKey (usually as ${ENV_VAR}), and an api field that is either openai-completions or anthropic-messages. For a custom provider the reference tells you to add models.providers.<provider>.models[] with at least the matching id, and every custom-provider example on the page carries one: bundled plugins such as LM Studio and Ollama discover models over their native APIs, but a custom route has no discovery to fall back on, so the ids come from you. Models are then referenced as <provider-id>/<model-id> and selected at agents.defaults.model.primary. Three documented limits matter. Changing a configured route discards the metadata from the previous route, so you re-declare every model. On a proxy-style openai-completions route — any non-empty baseUrl whose host is not api.openai.com — OpenClaw skips native OpenAI-only request shaping, including prompt-cache hints. And on an anthropic-messages route pointed at a non-direct endpoint, which is exactly what a third-party base URL creates, OpenClaw suppresses implicit Anthropic beta headers such as interleaved-thinking-2025-05-14 so that proxies do not reject flags they do not implement; the page says to set models.providers.<id>.headers["anthropic-beta"] explicitly if your endpoint needs a specific beta feature. That is a documented behavior for the beta headers only — the page does not say what a given third-party endpoint does with caching or tool use, so verify those against your own provider rather than assuming parity.

{
  "models": {
    "providers": {
      "kunavo": {
        "baseUrl": "https://api.kunavo.com",
        "apiKey": "${KUNAVO_API_KEY}",
        "api": "anthropic-messages",
        "models": [
          {
            "id": "claude-sonnet-5",
            "name": "Claude Sonnet 5"
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "kunavo/claude-sonnet-5"
      }
    }
  }
}

NanoClaw is stricter, and its own two sources read differently. The environment-variable reference documents ANTHROPIC_BASE_URL as a custom Anthropic-compatible endpoint passed into agent containers with a placeholder auth token, active only once setup has registered the custom-endpoint provider config, with the real token staying in the vault — and read from .env only, with no process-environment fallback, so exporting it in your shell will not work. The README, meanwhile, presents the plain ANTHROPIC_BASE_URL plus ANTHROPIC_AUTH_TOKEN pair as a route for one-off experiments and names /add-opencode and /add-ollama-provider as the supported third-party paths. Those are reconcilable — experiment versus registered-at-setup — but they are not the same instruction, and the setup script nanoclaw.sh documents SECRET_NAME and HOST_PATTERN as defaulting to the OneCLI secret name Anthropic and the host pattern api.anthropic.com, so a third-party host means changing them during setup. Whether that path completes a request against a non-Anthropic host is something neither source demonstrates with a worked example.

# NanoClaw's README scopes this pair to "one-off experiments".
# It is not the project's supported third-party route.
ANTHROPIC_BASE_URL=https://api.kunavo.com
ANTHROPIC_AUTH_TOKEN=your-kunavo-key

# The documented provider route is registered during setup, and the
# setup script nanoclaw.sh documents two variables for a non-Anthropic host:
SECRET_NAME=Anthropic          # OneCLI secret name (default: Anthropic)
HOST_PATTERN=api.anthropic.com # OneCLI host pattern (default: api.anthropic.com)

NanoClaw's providers page sets provider and model per agent group with ncl groups config update --id <group-id> --provider <name> --model <model>, effective on the next container spawn. Leaving Claude costs you specific features: slash commands are not native and arrive as ordinary chat text, there is no mid-turn input streaming, there is no transcript rotation, and Codex caps project documents at 32 KiB against 4 MiB on Claude. Agent memory and standing instructions survive a provider switch; in-flight conversation context does not. Separately, issue #1984, opened 2026-04-24 and still open on 2026-09-21, reports that setting OPENAI_BASE_URL alone silently falls back to openai-codex, the WebSocket subscription provider, because Codex never consults the variable, and that OpenCode's config shape excludes no-auth endpoints and real-key endpoints that are not behind the vault. A project contributor replied the same day accepting the Codex finding, and in May pointed at a later pull request improving Codex-as-a-backend setup, so this is an open thread with maintainer engagement rather than an ignored report — but the fixes in it are the reporter's local patches, not shipped behavior. If your plan was an OpenAI-compatible base URL on NanoClaw's Codex path, read that issue before you budget for it.

One more NanoClaw constraint that shapes the cost path: Claude Code is required for /customize, /debug, setup error recovery and every /add-<channel> skill. You need a Claude-Code-capable credential even if the agents themselves end up running on OpenCode or a local model. And NANOCLAW_FAST_MODE opts into the Claude fast serving tier; the reference says there is no per-group fast-mode field, that other providers must explicitly support the option, and that it may change provider billing.

What each one costs to run

Docker's published paid tiers are Personal $0, Pro $11 per user per month billed monthly or $9 billed annually, Team $16 or $15, and Business $24 (pricing, license terms, checked September 18, 2026). This is the one recurring charge NanoClaw can create that OpenClaw does not, and it applies to the organization, not the assistant.

On the model side, OpenClaw's Anthropic provider page draws the line that matters for both products: subscription-plan Agent SDK and claude -p usage still draws from the signed-in subscription's usage limits, while console and API-key logins use pay-as-you-go API billing and do not receive the subscription Agent SDK credit. For shared production automation the page recommends an Anthropic API key over Claude CLI reuse. A custom base URL sits on the API-key side of that line by construction — you cannot point a subscription at a third-party endpoint. OpenClaw's OAuth page also says Anthropic staff told the project this usage is "allowed again", so OpenClaw treats Claude CLI reuse and claude -p as sanctioned for this integration unless Anthropic publishes a new policy. Note the word "again": write-ups reporting that Anthropic cut off this access earlier in 2026 are best read as overtaken rather than wrong, and the project's own page states the status is provisional. Re-check it before you build on it.

A worked token estimate

Assume an always-on assistant handling 40 turns a day for 30 days, and assume each turn costs 8,000 uncached input tokens and 500 output tokens — 9.6 million input and 0.6 million output tokens for the month. At Kunavo catalog rates, Claude Sonnet 5 lists $2.00 per million input and $10.00 per million output, giving $25.20. The same workload on Claude Haiku 4.5 at $0.40 / $2.00 gives $5.04.

That is token arithmetic on assumed volumes, not a measured NanoClaw or OpenClaw task and not a ceiling on your bill. It excludes cache charges, tool calls, retries and host costs, and it assumes the cheaper model finishes the work without extra attempts — which is the condition that decides whether a lower listed rate produces a lower total. Cheapest listed price and lowest cost to finish the task are different claims, and this example only speaks to the first.

Kunavo's catalog amount is a billing floor rather than a cap: where the upstream reports its charge, the bill is the greater of catalog cost and upstream cost times the applicable markup. The minimum top-up is $10 in prepaid credit, with no subscription. See billing details.

Migration cost between them

Neither project documents an import path from the other, so treat a switch as a fresh install. Reasoning from the two config formats: OpenClaw's state is one JSON5 file you can copy and diff, while NanoClaw's is split between .env, per-group ncl settings and a credential vault, so there is nothing to hand over wholesale in either direction. Channels are the expensive part — every messaging platform has to be re-paired and re-authorized on the new side — and NanoClaw installs each channel through an /add-<channel> skill that needs Claude Code available. Agent memory and scheduled jobs have to be recreated. Keep the old install running until the new one has handled real traffic.

Pointing either one at Kunavo

The configurations above come from reading each project's current source documentation on September 18, 2026. Kunavo has not run either product against its endpoint, so nothing here is a tested-compatibility claim — plan a bounded trial of your own before you move scheduled work. Kunavo publishes setup guides for the underlying pieces both products lean on: the Claude Agent SDK that NanoClaw uses as its default provider, the OpenCode route NanoClaw's README names as a supported third-party path, and the Anthropic base URL reference that both ANTHROPIC_BASE_URL paths depend on. A published setup guide is documentation, not a compatibility test of these two assistants.

If OpenClaw is the side you have settled on, best API for OpenClaw works through the provider choice in detail and OpenClaw pricing covers the full operating bill. When you are ready to try a route, create a Kunavo account and start with one small task before migrating anything scheduled.

FAQ

NanoClaw and OpenClaw repositories, documentation and Docker's license and pricing pages checked September 18, 2026, with repository counts, releases, channel lists and issue #1984 re-checked September 21, 2026. Neither product has been runtime-tested against Kunavo; the configurations shown are a review of vendor source documents. Kunavo token rates read from the live catalog; totals are illustrative estimates.