Getting Started

ClawWatch gives you real-time observability and policy control over NVIDIA NemoClaw AI agent sandboxes. This guide walks you from zero to your first live event stream in under 5 minutes.

Prerequisites

• ›Node.js 18+ installed
• ›A running NVIDIA NemoClaw sandbox (build.nvidia.com/nemoclaw)
• ›A ClawWatch account (free trial at claw-watch.dev/sign-up)

1. Install the CLI

The ClawWatch CLI is published on npm as an open-source package.

npm install -g clawwatch

2. Generate an API token

In the ClawWatch dashboard, navigate to Settings → API Keys and create a new token. Copy it — you'll use it in the next step.

3. Watch your sandbox

The watch command spawns nemoclaw <name> logs --follow internally and streams every event to ClawWatch automatically. Make sure nemoclaw is installed and in your PATH.

clawwatch watch my-sandbox-name --token cw_YOUR_TOKEN_HERE

Alternatively, pipe the log stream manually if you need custom log filtering:

nemoclaw my-sandbox-name logs --follow | clawwatch connect my-sandbox-name --token cw_YOUR_TOKEN_HERE

Events will appear in your Overview within a few seconds.

4. Explore the dashboard

Once events start flowing, explore the Live Feed for real-time event streaming, the Audit Log for full history, and the Policy Studio to deploy your first guardrail.

Policy Studio

The Policy Studio lets you write, validate, version, and deploy YAML policies that intercept agent actions in real time. Policies are evaluated in-process — enforcement latency is under 100ms.

Policy structure

ClawWatch policies map directly to NemoClaw's openclaw-sandbox.yaml format. NemoClaw enforces a deny-by-default network posture — only hosts listed under endpoints are reachable.

# openclaw-sandbox.yaml — NemoClaw network policy
version: "1.0"
sandbox: my-sandbox

# Outbound network endpoints (deny-all by default)
endpoints:
  - host: integrate.api.nvidia.com
    port: 443
    protocol: tcp
    comment: "NVIDIA inference gateway (required)"
  - host: pypi.org
    port: 443
    protocol: tcp
  - host: registry.npmjs.org
    port: 443
    protocol: tcp

# Binaries allowed to make network calls
binaries:
  - node
  - python3
  - pip
  - npm

# Additional ClawWatch policy rules
rules:
  - name: block_metadata_endpoint
    match:
      host: "169.254.169.254"
    action: BLOCK
    alert: true

  - name: restrict_sensitive_paths
    match:
      type: FILE_ACCESS
      paths: ["/etc/**", "/proc/**", "/root/**"]
    action: BLOCK

cost_controls:
  daily_limit_usd: 5.00
  alert_at_usd: 4.00

Pulling a policy

Select a sandbox in the Policy Studio dropdown to load its active policy into the editor. You can also pull via CLI:

clawwatch policy pull my-sandbox --token cw_…

Pushing a policy

Click Deploy in the editor, or push from CLI:

clawwatch policy push my-sandbox --file policy.yaml --token cw_…

Rule actions

CLI Reference

The clawwatch CLI is the bridge between your NemoClaw deployment and the ClawWatch dashboard. All commands require a valid API token.

clawwatch watch prod-agent-01 --token cw_abc123

nemoclaw prod-agent-01 logs --follow | clawwatch connect prod-agent-01 --token cw_abc123

clawwatch demo --token cw_abc123 --rate 5

clawwatch format

Audit Log & Export

The Audit Log is an immutable, append-only record of every event across all your sandboxes. It supports advanced filtering and compliance-grade CSV export.

Filtering

Open the Filters panel on the Audit Log page to filter by:

• ›Date range (from / to)
• ›Sandbox (multi-select)
• ›Event type (network, inference, filesystem, process)
• ›Outcome (allowed, blocked, warned)
• ›Cost range (min / max USD)
• ›Free-text search on action, host, or path

CSV export formats

All timestamps in exported files are ISO 8601 format (UTC).

FAQ