OpenClaw on DGX Spark: NemoClaw Setup on ASUS Ascent GX10

Running OpenClaw on a DGX Spark-class machine is the most common request we get from ASUS Ascent GX10 buyers in Singapore, and the supported way to do it is NVIDIA NemoClaw: a one-line installer that puts an OpenClaw agent inside an OpenShell sandbox and serves it a local model from the GX10's 128 GB of unified memory. This guide covers what each layer does, prerequisites, the install and onboarding steps from NVIDIA's documentation, pointing the agent at a local model, network policies, sharing the endpoint with NVIDIA's Personal AI Router, and common pitfalls. It applies to every GX10 configuration and, with identical commands, to any other GB10 system.

OpenClaw, OpenShell and NemoClaw: what each layer does

NVIDIA's documentation is explicit that NemoClaw "does not replace OpenShell or your chosen agent runtime"; it packages them. ASUS validates the stack on the GX10, which is why it carries the Agent Computer badge.

Why the sandbox matters for an always-on agent

An agent with file and shell access is only as safe as the fence around it, and OpenShell's fence has four parts. Network: deny-by-default egress; a request to an unlisted host is intercepted and you approve or deny it in the terminal, and approvals last for the session only. Secrets: the host holds the provider credential and upstream endpoint; the agent only ever sees inference.local. Filesystem: system paths are read-only, with only /sandbox and /tmp writable. Process: privilege escalation and dangerous syscalls are blocked. For a Singapore organisation pointing an agent at client documents, that is a control you can describe to an auditor under the PDPA.

Prerequisites on the Ascent GX10

Update first. NVIDIA's June 2026 DGX Spark release is the one that surfaces the NemoClaw playbook after first boot, and ASUS support listed DGX OS 7.5.0-2 for the GX10 on 29 July 2026; apply updates through the DGX Dashboard before anything else. NVIDIA's playbook then lists Node.js 22.16 or newer (the installer adds it if missing), sudo access, Docker and a working NVIDIA driver (covered by the installer's readiness check), and free storage for the model, the vLLM container and temporary downloads. Large express-install models can need hundreds of gigabytes, which is the practical case for the 2 TB or 4 TB GX10 over the 1 TB unit. A free Hugging Face read token is optional but recommended, because anonymous downloads can hit HTTP 429 rate limits. Work from a laptop over SSH or NVIDIA Sync; no monitor is needed.

Installing NemoClaw step by step

1. Run the installer. In a terminal on the GX10, optionally export your Hugging Face token, then run NVIDIA's one-liner:

export HF_TOKEN=<read-token>
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

2. Accept express install. On a DGX host the installer offers two inference options and asks Run express install with these settings? [Y/n]:. Enter takes the defaults: OpenClaw as the agent, managed local vLLM with automatic serving-profile selection, a sandbox named my-assistant and the Balanced policy. NVIDIA's playbook notes the default profile served nvidia/Qwen3.6-35B-A3B-NVFP4 on a 128 GB DGX Spark in its testing. Answer n to choose Hermes or Deep Agents, another name, provider or model.

3. Or onboard manually. nemoclaw onboard walks through agent, inference provider, model, sandbox name, apply, optional Brave web search (needs a Brave API key), optional messaging channels, resource profile and policy preset. NEMOCLAW_NO_EXPRESS=1 skips the express prompt.

4. Check status. nemoclaw my-assistant status and nemoclaw my-assistant logs --follow.

5. Talk to the agent. Open the URL from nemoclaw my-assistant dashboard-url --quiet in a browser (default http://127.0.0.1:18789/; treat the authenticated URL like a password), or run nemoclaw my-assistant connect and then openclaw tui inside the sandbox.

The first reply from a large model is slow while it loads. Budget 30 minutes for the install and longer if the model download is large.

Pointing NemoClaw at a local model: vLLM, Ollama or NIM

On DGX Spark the default is managed vLLM, and for most buyers it is the right answer: the installer picks a serving profile for the GB10 and runs the model in a container beside the sandbox. If Ollama is already running on the GX10, choose Local Ollama at onboarding; NemoClaw expects it at localhost:11434, and NVIDIA's starter examples include qwen3.6:35b, nemotron-3-nano:30b and qwen3.5:9b. If you serve with NVIDIA NIM, your own vLLM, llama.cpp or SGLang, choose Other OpenAI-compatible endpoint and supply the base URL. The remaining providers (NVIDIA Endpoints, OpenAI, Anthropic, Gemini and the experimental Model Router) send prompts off the machine, so skip them if data residency is why you bought a GX10. Model size follows the usual GX10 rule: 70B-class comfortably, 120B to 200B-class at FP4; our Ascent GX10 guide lists what fits.

Security policy basics

NemoClaw offers three tiers at onboarding. Restricted is the base sandbox with no presets. Balanced, the default, adds npm, PyPI, Hugging Face, Homebrew, Brave search and weather. Open adds public-reference sources plus Slack, Discord, Telegram, WhatsApp, Jira and Outlook presets. Under every tier sits the baseline, which allows only the NVIDIA inference hosts, clawhub.ai, openclaw.ai, the OpenClaw docs (GET only) and the npm registry (GET only). To extend a running sandbox use nemoclaw <sandbox> policy-add <preset>, or for a single host openshell policy update <sandbox> --add-endpoint host:443:read-only:rest:enforce. Our rule: start Balanced, watch the approval prompts for a week, then allow only the hosts the agent actually needs.

Sharing the GX10 with your office: NVIDIA PAIR

NemoClaw gives one operator a sandboxed agent. NVIDIA Personal AI Router (PAIR) lets the rest of the office use the GX10's model: it discovers compatible devices on the local network, exposes a single local endpoint, proxies to Ollama, llama.cpp or LM Studio on each node, and routes to another node when one is busy. It does not pool machines into one virtual GPU, so a 70B model still has to fit on the node serving it, which is exactly why the 128 GB GX10 is the natural anchor. NVIDIA's validated configurations cover DGX Spark/GB10 on DGX OS, RTX PCs on Windows 11 and Ubuntu 24.04, and Apple silicon Macs on macOS Tahoe. Combine the two: NemoClaw for the agent on the GX10, PAIR so every laptop and the Ascent QN10s at the edge call the same private model.

Common pitfalls and fixes

nemoclaw: command not found after install (common with nvm or fnm): source ~/.bashrc or open a new terminal. HTTP 429 during download: set HF_TOKEN and re-run the installer. Dashboard will not load (stale port forward): openshell forward stop <port> my-assistant then openshell forward start <port> my-assistant --background. Brave search returns 403: the agent fetched a URL instead of using the search tool; the preset only allows the search API host. Rebuilding: --fresh destroys and recreates a same-named sandbox; --recreate-sandbox adds features without losing it. Updates: nemoclaw update --check then nemoclaw upgrade-sandboxes --check. NemoClaw is alpha software maintained on a best-effort basis, so test upgrades on a second sandbox before touching one that people rely on.

Buying the Ascent GX10 for agents in Singapore

SourceIT is an authorised ASUS reseller with the GX10 1 TB at S$7,200, 2 TB at S$8,050 and 4 TB at S$9,850, all with official ASUS Singapore warranty. We commission units on request: delivered on current DGX OS, on your network, with NemoClaw onboarded against your chosen model and PAIR ready for your users. Education and NVIDIA Inception pricing may apply. Use Request for Quotation on the product page, call (65) 6978 3502, or email Sales@sourceit.com.sg; we are GeBIZ and Vendors@Gov registered. For the wider line-up see the ASUS Agent Computer guide, and for first boot and networking our DGX Spark setup guide.

Frequently asked questions

Can I run OpenClaw on the GX10 without NemoClaw? Yes, OpenClaw is a standalone open-source project. NemoClaw is the supported path on DGX OS because it adds the OpenShell sandbox, managed local inference and policy presets, and it is the setup ASUS validates on the GX10.

Does NemoClaw need an internet connection or an NVIDIA API key? Internet for the install and model download. With managed vLLM or local Ollama as the provider, no cloud API key is required and prompts stay on the machine.

Which model does the express install use? Managed vLLM with automatic profile selection; NVIDIA's playbook reports it served nvidia/Qwen3.6-35B-A3B-NVFP4 on a 128 GB unit in testing. You can choose another model at onboarding.

Can the agent reach the internet? Only hosts allowed by the policy tier. Anything else is blocked and surfaced for you to approve or deny, per session.

How do other people in the office use the GX10's model? Install NVIDIA PAIR: it exposes one local endpoint and routes requests to Ollama, llama.cpp or LM Studio on the GX10 and any other paired RTX PC or Mac.

Does the same procedure work on the NVIDIA DGX Spark or HP ZGX Nano? Yes. NemoClaw targets DGX OS on GB10 hardware; the commands are identical across OEMs.

Will SourceIT set it up for me? Yes. Commissioning covers OS updates, network setup, NemoClaw onboarding against your model and a handover session.