NanoClaw: Phone and schedules

This page connects one chat app so you can reach NanoClaw from your phone, sets up repeating jobs, and weighs the safety settings that matter once the agent works while you are away. Do it only after the terminal jobs from Files, the browser, and memory went the way you expected.

Later: chat apps and schedules

NanoClaw is built to keep running. On a Mac the service starts at login and restarts if it crashes, and on Linux it is a user service. The computer still has to stay on and online for the agent to answer.

Add one chat app, for yourself only

The setup wizard offers Telegram, WhatsApp, Slack, Discord, and a few more. After setup, the docs say to add one with a command such as /add-telegram inside Claude Code, Anthropic's coding agent, which the README lists as required for these add-ons. This guide could not confirm whether the installer puts Claude Code on your computer, or how it signs in.

Telegram is the clearest documented path:

1. In Telegram, message @BotFather, send /newbot, and copy the token it gives you.
2. Paste the token when setup asks.
3. Setup prints a one-time 6-digit code. Send only those 6 digits to your bot.
4. The bot replies Pairing success! The first person to pair becomes the owner.

Then lock the chat so strangers are dropped silently. Find the chat's id, then set it to strict, putting the id where it says <id>:

ncl messaging-groups list
ncl messaging-groups update --id <id> --unknown-sender-policy strict

Do not add the bot to group chats yet, and never use public.

What you should see Pairing success! in Telegram, and a welcome message from the agent.

Schedules

You can ask for a repeating job in chat, for example: "Every weekday at 9am, send me a short summary of the weather." The agent creates the task. Times are rough, often within about a minute, and each run is a paid call to the model. The docs refuse a job that runs more than 4 times a day unless it has a check script.

To see, pause, or stop tasks:

ncl tasks list
ncl tasks pause <id>
ncl tasks cancel --all

ncl tasks cancel --all is the stop-everything switch.

Set your time zone by adding a line such as TZ=America/New_York to .env, then restart.

What you should see your task in ncl tasks list, with its next run time.

Trade-offs: safety versus capability

NanoClaw's container is already on, so most of these choices are about what you let through its walls: your folders, the internet, other people, and your money.

Commands that run without asking. Inside the Docker container, ordinary commands run without an approval. NanoClaw asks a person only for new chats, for installs into its own container, and for the optional per-use key and agent-to-agent rules.

• You gain: the agent can work through a long job without stopping for you, which is what lets it finish jobs you send from your phone while you are away.
• You risk: a mistake or a tricked agent can still read or delete its own workspace, message anyone it is connected to, and spend through its keys. Nobody is asked first.
• Makes sense when: the container is the only thing the agent can reach, which means the folder list is empty and egress lockdown is on. If you want a person in the loop for spending, turn on per-use approval for keys in the vault.

Egress lockdown. NANOCLAW_EGRESS_LOCKDOWN=true in .env forces the agent's traffic through the vault instead of letting the container reach the whole internet directly. It starts off.

• You gain: with lockdown off, every web tool works, including tools that do not go through the vault and would break with lockdown on.
• You risk: with lockdown off, a tricked agent has a direct path to send your data anywhere on the internet. With it on, some web jobs may fail, and this guide could not confirm which tools still work.
• Makes sense when: you are starting out, in which case keep lockdown on from the first job and switch to jobs that need no web if a web tool breaks. Turning it off only makes sense for a job that needs a tool lockdown breaks and has nothing private in the agent's workspace or connected chats.

The shared-folder list. ~/.config/nanoclaw/mount-allowlist.json lists which of your real folders the agent may see, and on a new install it starts empty.

• You gain: once you add a folder, the agent can work on your real files instead of only its own workspace under ~/nanoclaw/groups/.
• You risk: anything in a shared folder is within reach of a mistake or a prompt injection. Through its chat apps or an open internet connection, the agent could also send it elsewhere.
• Makes sense when: the agent has already run safely with an empty list, and you share a single backed-up folder made for one job. It never makes sense for your home folder, Documents, or Desktop.

Who can message the bot. On Telegram, the first person to send the 6-digit pairing code becomes the owner, and the strict unknown-sender policy drops strangers silently. The public setting lets anyone talk to your agent.

• You gain: a chat app lets you send jobs and read replies from your phone while you are away from the computer, which is what NanoClaw is built for.
• You risk: under public, anyone at all can give your agent orders. The first person to send the 6-digit code becomes the owner, so pair right away and never share the code.
• Makes sense when: your terminal jobs went right, you pair the one chat app yourself, and you set it to strict before you send it any work. public does not make sense for anyone following this guide.

Which model, and how you pay. Setup is built around a Claude API key billed pay-as-you-go, while OpenCode takes keys from OpenRouter, DeepSeek, OpenAI, Google, or Anthropic, or a local OpenAI-format server. The Claude chat plan sign-in is an unofficial route that this guide does not teach.

• You gain: the Claude key is the path setup and its later add-ons are built around, so it is the best-documented choice. OpenCode opens up other providers and a local model server, and with OpenCode, setup builds the container image with no NanoClaw account.
• You risk: a pay-as-you-go key bills every reply and every scheduled run, so a key with no spend limit has no ceiling. The chat plan sign-in may still bill you, because Anthropic's rules on it have changed more than once in 2026. This guide also could not confirm that a free Google AI Studio key works through OpenCode.
• Makes sense when: your Claude API key has a monthly spend limit already saved at Anthropic, and you set that limit before you schedule anything. OpenCode makes sense if you already have a key from one of its providers and do not mind a less-tested path.

Before you change any of these, check the job against the three questions in Safety versus capability.

Sources

Opened 14 November 2026.

NanoClaw:

• README, for Claude Code and the channel list.
• Installation, for the login service on a Mac and the user service on Linux.
• Security model, for approvals and what it does not defend.
• Hardening, for egress lockdown, the folder list, and sender policies.
• Credentials, for per-use key approval in the vault.
• Agent providers, for Claude, OpenCode, and Codex.
• Channels overview, for the list of chat apps and /add- add-ons.
• Telegram, for BotFather and 6-digit pairing.
• ncl CLI reference, for messaging-groups commands and sender policies.
• Schedule recurring work, for tasks, limits, and time zones.

This guide's own notes:

• NanoClaw raw notes.
• First-hour safety checklist.
• Unofficial routes, including Claude plan sign-in.

Next

Continue to The playbook.