NVIDIA Launches NemoClaw for LangChain Deep Agents Code: Run Open-source dcode, tuned for Nemotron 3 Ultra, to Plan, Edit, and Test Code

AIDeveloper44 Team

A Framework for Secure Autonomous Coding

NVIDIA and LangChain have introduced a new governed blueprint called NemoClaw, designed to facilitate the deployment of autonomous coding agents on sensitive enterprise codebases. The collaboration integrates LangChain’s Deep Agents Code (dcode), a terminal-based coding agent, with NVIDIA’s secure inference and runtime infrastructure. The primary objective is to allow engineering teams to utilize the capabilities of agentic workflows while maintaining strict control over source code, credentials, and network access.

As autonomous agents gain the ability to read, write, and execute code, the security risks associated with their deployment have increased. Standard agentic setups often lack the necessary guardrails to prevent unintended actions, such as unauthorized file access or the transmission of proprietary data to external endpoints. NemoClaw addresses these concerns by wrapping the agent in a managed environment that prioritizes security and audibility.

Architectural Components

The NemoClaw blueprint is composed of four primary technical components that work in tandem to provide a secure coding environment:

• Deep Agents Code (dcode): An open-source harness developed by LangChain. It is a terminal coding agent built on the Deep Agents SDK, capable of planning, file editing, command execution, and iterative reviews.
• Nemotron 3 Ultra: NVIDIA’s open model, tuned for complex reasoning and software engineering tasks. This model serves as the logic engine for the coding agent.
• NemoClaw Blueprint: The management layer that onboards the agent and handles its orchestration within the enterprise infrastructure.
• OpenShell: A secure runtime and sandbox environment. The agent operates entirely within this containerized space, which isolates it from the host system and the broader network.

Governance and Security Controls

The core value proposition of NemoClaw is its "governed by default" architecture. Unlike typical coding assistants that function as simple autocomplete tools, NemoClaw acts as an autonomous engineer within a restricted boundary. A critical feature of this system is the deny-by-default networking policy. The agent cannot reach external sites or internal services unless a human administrator explicitly approves a specific network request.

Furthermore, NemoClaw separates credentials from the execution environment. The agent never directly touches sensitive API keys or repository credentials; instead, these remain managed by NemoClaw outside the OpenShell sandbox. For every action the agent takes—such as modifying a file or running a shell command—the system can be configured to require human approval. This provides a mechanism for engineers to review proposed diffs and test results before they are applied to the primary codebase. Every session generates a comprehensive audit trail, allowing teams to reconstruct the agent’s logic and actions for compliance purposes.

High-Stakes Use Cases: Legacy Modernization

One of the primary applications for NemoClaw is the modernization of legacy application estates. Many enterprises maintain critical business logic in older languages like COBOL or outdated versions of .NET. Modernizing these systems is often deemed too risky for standard automation due to the lack of documentation and the potential for breaking critical production workflows.

NemoClaw enables a structured approach to this modernization. According to NVIDIA’s blueprint documentation, the process begins by pointing the agent at a repository to map dependencies and document business logic. Because the source code never leaves the sandbox, organizations can use the agent to analyze the "system of record" without exposing proprietary logic. The agent can then refactor code in reviewable waves—for instance, translating modules from COBOL to Java—while running tests at each stage to ensure behavioral parity.

Beyond legacy modernization, the blueprint is designed for:

• Cloud and Infrastructure Migration: Re-platforming virtualized applications toward cloud-native targets.
• Dependency and Framework Upgrades: Identifying end-of-life packages, resolving breaking changes, and repairing tests.
• Security Patching: Automatically identifying and patching vulnerable patterns with a full audit record of the changes made.

Operational Workflow

Setting up the environment is designed to be streamlined. Using the command nemo-deepagents onboard, developers can build the OpenShell sandbox, install the dcode harness, and link it to the Nemotron 3 Ultra model via managed inference. Once configured, the agent functions through a multi-step loop: it inspects the repository, generates a plan, executes changes, runs local tests, and presents a final diff for human review.

To handle long-running engineering tasks, the system manages persistent context through a combination of summarization, persistent memory, and subagents. This allows the agent to "remember" repository-specific conventions and domain-specific instructions over time, theoretically improving its efficiency on repeated tasks within the same codebase. By providing an open model and an open harness, NVIDIA and LangChain aim to prevent vendor lock-in, allowing teams to audit, tune, or swap components as their regulatory and technical requirements evolve.

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe