nora

Nora is an open-source, self-hosted AI agent operations platform for running autonomous agent clusters on infrastructure under the user's own control. It can uniformly manage OpenClaw, Hermes, or keep both in the same operations interface. The project uses the Apache-2.0 license, with code hosted on GitHub.

Purpose: After most teams run agents in production, they eventually rebuild the same set of layers around the runtime: deployment workflows, secrets, monitoring, logs, terminal, templates, and a separate management interface. Nora's goal is to make this set of layers unnecessary to repeatedly rewrite as runtime conversations change. Operator workflows are located under /app, and platform-level administration is located under /admin.

Main capabilities:

• Deploy and operate runtimes: deploy OpenClaw and Hermes agents to Docker or Kubernetes (both GA, with official Helm charts), supporting full lifecycle control: deploy, start/stop, restart, redeploy, and version history.
• Migrate existing runtimes: rebuild agents from uploaded packages, and self-hosted platform administrators can use privileged local Docker Live Pull.
• Real-time operations access: streaming logs, interactive terminal into running containers, file browser/editor, and the OpenClaw gateway and Hermes dashboard embedded in the operations interface.
• Monitoring and alerting: per-agent metrics and costs, cluster attention summary (errors, stuck, over budget, telemetry stalled), and user-defined alert rules delivered to specified channels.
• Budgets and scheduled runs: hard caps on per-agent large model budgets with automatic suspension, and periodic cron scheduling for agent runs, including queue retries and sweep protection.
• Secret management that fails closed by default: provider secrets are encrypted at rest using AES-256-GCM and synchronized to running runtimes; production refuses to start without a valid encryption key unless the operator deliberately enables an insecure plaintext override; SSH host key pinning is used to protect remote (BYOC) Docker hosts.
• Network isolation: baseline ingress isolation based on Kubernetes NetworkPolicy, administrator-managed CIDR allow rules, and an experimental NemoClaw hardened sandbox for untrusted code.
• Agent Hub: installable, versioned starter templates to help quickly build usable agents from scratch.
• Integrations: 69 credential/connection entriesAccording to/connect directories (source code management, chat, cloud, observability, vector databases, automation) as well as 17+ large model providers. Executable behavior comes from runtime skills or MCP adapters; supported per-agent MCP servers must be explicitly enabled.
• Experimental Proxmox LXC: deploy the standard OpenClaw or preconfigured Hermes image to an unprivileged LXC, and verify API TLS and pinned SSH. It is not VM-level isolation, and a real hardware smoke test is still required before production use.
• Comprehensive automation: public REST API (OpenAPI 3.1), @noraai/cli, and @noraai/mcp-server for Claude Code, Gemini CLI, Claude Desktop, and Cursor.
• Workspaces and RBAC: multi-tenant workspaces, tiered roles, platform management interface, account event history, and encrypted managed backups.

Usage: System requirements: macOS 12+, Linux, or Windows 10+ (WSL2), with Docker Engine and Compose v2 installed. The installer checks Docker, Git, and OpenSSL, and installs anything missing. For the macOS / Linux / WSL2 installation command, the Windows PowerShell installation command, and the Kubernetes Helm installation command, see the official documentation. Windows requires PowerShell 7+; the default Windows PowerShell 5.1 is not supported and it must be run in a pwsh 7 session. The installer verifies prerequisites, generates or preserves secrets, optionally creates a bootstrap administrator, selects a free local port when the default port is occupied, and starts the full set of services. When finished, open the URL printed by the installer. Local mode defaults to http://localhost:8080，但繁忙工作站上可能选择 8081 and other ports. Then you can follow the "First 15 Minutes" walkthrough. If you do not yet have an API key: in installations with a local Docker target enabled, you can select "Start Local Docker Demo" on the "Get Started" page. Nora will deploy a usable agent using the built-in deterministic demo provider, allowing you to verify chat and operations workflows without any keys and with no model usage cost. Only Kubernetes installations require adding a model provider first and deploying to an enabled cluster target. For manual setup, environment variables, public domain mode, TLS, remote Docker, Kubernetes, NemoClaw, and experimental Proxmox LXC configuration, see the self-hosting guide, environment variable reference, provisioning backends, remote Docker BYOC setup, TLS and public domain, Cloudflare fronting deployment, and other documentation. Full documentation is at docs.norafleet.ai, with MDX source in docs/. For the complete architecture description, see docs/concepts/architecture.

Public REST API, CLI, and MCP: Workspace-scoped API keys (bearer only, prefix nora_, static HMAC hash, scope-based) drive a stable subset of the REST surface. Issue keys at /app/workspaces/<id>/api-keys. The CLI is located in cli/ (@noraai/cli): run nora login once to save the host and API token, then nora workspaces, nora agents, and nora monitoring wrap the same REST surface. nora doctor runs an admin-only control plane health check, and nora mcp starts the MCP stdio server. For supported endpoints and scopes, see the API reference. You can operate Nora from Claude Code, Gemini CLI, Claude Desktop, or Cursor: the mcp-server/ package (@noraai/mcp-server) exposes the same API as Model Context Protocol tools—deploy agents, control their lifecycle, read cluster metrics, events, and per-agent cost. Destructive deletion remains disabled unless explicitly opted in. Gemini CLI users can install the repository extension directly. The installer prompts for the Nora API URL and stores the workspace API key as a sensitive extension setting. For configuration, tool lists, and security notes for Gemini CLI, Claude Desktop, and Cursor, see the MCP guide.

Standards and isolation:

• MCP: Provided. Control-plane MCP server (@noraai/mcp-server, published to the official MCP Registry) plus per-agent MCP server management.
• OpenTelemetry GenAI: Available. Exports OTLP + Prometheus runtime telemetry per gen_ai.* semantic conventions—per-interaction chat spans and token/cost/resource metrics flow into existing Grafana / Datadog / Langfuse stacks. Per-tool-call child spans depend on the runtime event stream and remain on the roadmap.
• A2A: On the roadmap. Agent Cards / agent-to-agent discovery for managed OpenClaw and Hermes agents.
• Isolation by deployment target: Standard Docker runs use container namespaces and operator-set CPU and RAM limits; disk_gb is metadata, and operators must monitor Docker storage. Kubernetes adds workload resource limits and provisioned storage requests. The experimental NemoClaw profile hardens untrusted code with a non-root user, dropping all Linux capabilities, no-new-privileges, Landlock + seccomp, and default-deny egress. Experimental Proxmox placement uses unprivileged LXC, which remains a shared-kernel boundary and is not presented as VM-level isolation.

Use cases: Suitable for teams, platform administrators, and self-hosted users who need to standardize operations for OpenClaw and Hermes agent clusters on their own infrastructure, covering production operations needs such as deployment, monitoring, budgets, secrets, isolation, and automation.

Limitations and roadmap (partial):

• NemoClaw hardening (high priority): Mature the experimental security sandbox profile end to end.
• Proxmox hardware qualification: Before running protected OpenClaw and provisioned Herme on the exact nodes, storage, bridges, templates, and networkss lifecycle matrix, this target remains experimental.
• Hermes/OpenClaw parity: Close the runtime gaps in validation, logging, terminal access, monitoring, and failure reporting.
• First-run operations experience, account-level monitoring, authentication and secret synchronization hardening, Agent Hub ergonomics, A2A support, and more are still in progress. The project includes the contribution guide CONTRIBUTING.md, and CLAUDE.md documents the repository layout, development commands, and subtree ownership. Contribution areas include runtime adapters, operations and management UX, provisioning and lifecycle orchestration, integrations and channels, testing and CI hardening, self-hosted deployment ergonomics, and more. Typical workflow: fork → branch (feature/...) → commit → pull request.