NanoClaw

NanoClaw: Files, the browser, and memory

This page shows what NanoClaw can do with files, the web, and memory, with one small exercise for each. It follows Install and first job, and every command runs in Terminal on a Mac or in the Ubuntu window on Windows.

These facts were checked on 14 November 2026. Keep the folder list empty and egress lockdown on for this whole page, the same as on the install page.

Files

The agent's own workspace. Each agent has its own folder under ~/nanoclaw/groups/ on your computer, and inside the container that same folder appears as /workspace/agent. The agent can read, write, and delete anything in it without asking. Its memory and its standing instructions, a file called instructions.prepend.md, live in that folder too.

Your other folders. The agent cannot see any other folder on your computer unless you add it to ~/.config/nanoclaw/mount-allowlist.json. A folder you add shows up inside the container under /workspace/extra/, and it is read-only unless you allow writing for it. NanoClaw always blocks some paths, such as .ssh, .aws, and .env, even if you list them. Sharing a real folder is on the Advanced page, and you do not need it for anything here.

Attachments. When you send a file through a chat app, NanoClaw writes it into an inbox/ folder that belongs to that conversation, where the agent can read it. The agent can also send a file back to a chat with its send_file tool. The terminal chat sends text only, and this guide could not confirm a way to attach a file from it. An add-on called /add-anydoc lets the agent turn Word, PowerPoint, Excel, and text-based PDF attachments into plain text on your own computer, without uploading them anywhere.

Try it: make a file and find it

Ask the agent for a small text file:

cd ~/nanoclaw
pnpm run chat "Make a text file named shopping-notes.txt in your workspace with three grocery items, one per line. Do not install anything. Do not ask for any of my folders."

When it says the file is saved, find it from your own computer and print it:

find ~/nanoclaw/groups -name 'shopping-notes.txt'
cat "$(find ~/nanoclaw/groups -name 'shopping-notes.txt' | head -n 1)"

What you should see a path that starts with your home folder and contains /nanoclaw/groups/, then the three grocery items. Your Documents folder is unchanged.

The web

A built-in browser. Every agent can already browse the web, because the container includes Chromium and a skill called agent-browser. With it, the agent can open pages, click, fill in forms, take screenshots, save pages as PDFs, and stay signed in between sessions. The docs say it uses the browser on its own whenever a browser helps, not only when you ask.

Search. The Claude provider also has built-in WebSearch and WebFetch tools. Codex has web search off by default, and for providers without built-in search, the /add-tavily-tool add-on gives the agent Tavily search with no key needed.

The safety side. Any page the agent opens can carry a prompt injection, so keep it logged out of everything personal. The browser can stay signed in between sessions, which means a login you give it once stays within reach of every later job. With egress lockdown on, this guide could not confirm which of these web tools still work, so a failed web job is not a sign that something is broken.

Try it: read one public page

pnpm run chat "Open the public page https://example.com and tell me its title and its first sentence. Do not sign in to anything. Do not fill in any forms. Do not install anything."

What you should see a reply that names the page title, Example Domain, and quotes a sentence from it. If lockdown blocks the page, the agent says it could not reach it instead, and nothing else changes on your computer.

Memory

What it saves, and where. NanoClaw remembers between chats by writing plain text files into a memory folder inside the agent's workspace, so the path on your computer is ~/nanoclaw/groups/<folder>/memory/. There is no hidden database. The file memory/index.md is the agent's map of what it knows, and memory/system/definition.md holds its own rules for filing things. The memory survives restarts and a switch to a different model provider.

Who shares it. Memory belongs to one agent, not to one chat, so every chat app you connect to the same agent reads and writes the same memory. Standing rules about tone or persona go in instructions.prepend.md instead, and past conversations are kept in a conversations/ folder.

The safety side. The agent edits its memory without an approval card, and nothing records who changed what. The groups/ folder is not backed up or versioned for you, so include it in your own backups. A tricked agent can also write false "facts" into memory that every later chat then trusts, which is one more reason to keep chat apps limited to yourself.

How to see and delete it. Read the files directly, because the docs call the files on disk the final word. To remove something, tell the agent to forget it, or edit the file yourself. An edit you make by hand reaches the agent the next time it starts a fresh conversation, such as after a restart or after /clear.

Try it: save a preference, then find it

pnpm run chat "Remember that I want prices in dollars and answers in short sentences."

Wait for the reply, then search the memory files for it:

grep -ril "short sentences" ~/nanoclaw/groups/*/memory

Open the file it names to read the entry, putting that path where it says <file>:

sed -n '1,200p' <file>

What you should see at least one file path inside a memory folder, and a line about dollars and short sentences in that file. A later reply should use short sentences without being told again.

To undo it, send pnpm run chat "Forget my preference about prices and short sentences." and run the grep line again. If it still finds the line, delete that line from the file yourself.

Sources

Opened 14 November 2026.

NanoClaw:

This guide's own notes:

Next

Continue to Phone and schedules.

Checked 14 November 2026 · prices, limits, and versions change