NanoClaw is an AI assistant that runs agents inside separate Linux containers, isolating their files and execution environments. People use it to connect agents to messaging services and run assistants with memory and scheduled jobs. The catalogue contains skills and instructions for extending or operating NanoClaw.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nanocoai/nanoclaw --skill iron-proxy-gatewaygit clone --depth 1 https://github.com/nanocoai/nanoclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nanocoai/nanoclaw/iron-proxy-gateway)<a href="https://agentmods.dev/skills/nanocoai/nanoclaw/iron-proxy-gateway"><img src="https://agentmods.dev/badge/skills/nanocoai/nanoclaw/iron-proxy-gateway/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nanocoai/nanoclaw/iron-proxy-gateway"><img src="https://agentmods.dev/badge/skills/nanocoai/nanoclaw/iron-proxy-gateway.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00492 |
| Opus 5.5 | $0.00016 | $0.00197 |
| Sonnet 5.5 | $0.00008 | $0.00098 |
| Haiku 4.5 | $0.00004 | $0.00049 |
Grade A, and why
iron-proxy-gateway scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Iron Proxy gateway
Your outbound HTTP and HTTPS requests pass through your session's Iron Proxy. A policy-selected credential request waits for human approval before the proxy inserts a credential. You receive only a useless placeholder.
Policy failures
A bare 403 does not prove which layer rejected the request. It may be the destination rule, credential grant, human approval, or upstream API. Respect the block, report the hostname and observed error, and request a host-side check instead of guessing that credentials were never injected.
Connect an account
Run the shared command for the API hostname requested by the user:
ncl groups connect --host <API hostname>
Return the exact connect_url and describe its action. An operator_console
handoff requires the operator to configure the credential, grant, and destination
in the gateway; it is not an OAuth link. Do not invent a connection flow when the
result is unsupported. The command does not grant access or change policy.
Use the user's requested CLI or a direct HTTP client. Do not add an MCP server
merely to connect an account. Clients requiring local authentication may use
gateway-managed as a non-secret placeholder (for example GH_TOKEN for gh).
Never use a real token in the client. Never run a local login to store credentials.
Request approval and account connection are separate. A 401 is not proof that injection did not happen: the stored token may itself be invalid. Report the observed result, follow the shared handoff, and verify with a credentialed request after the operator completes configuration. Never claim connected before success.
Rules
- Never ask for, print, or store a raw API key or OAuth token.
- Never bypass the configured proxy or its CA validation.
- Never treat a pending approval as granted.
- Never claim a blocked destination is connected.
- Treat proxy errors as policy or operator-configuration errors, not as permission to weaken TLS.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago First seen · 48 lines · 40 tokens per session scan A 19a36a1005ce
iron-proxy-gateway is a skill published in the GitHub repository nanocoai/nanoclaw (30,960 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 492 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.
Other skills, from other repositories
Pynchy Ops
Use when managing the pynchy service on the server — deploying changes, observing logs, checking service status, restarting the service, setting up GitHub auth, rebuilding the agent container, or running commands on the live Pynchy host. Also use when interacting with the LiteLLM proxy — investigating failed requests…
Pynchy Development
Use when running pynchy locally — running the app, tests, linting, formatting, prek hooks, or rebuilding the agent container. Also use when determining whether you're on the live Pynchy host or a local machine, and for debugging agent behavior-- session transcript branching, inspecting message history and agent traces…
Pynchy Plugin Authoring
Use when creating, scaffolding, or updating a pynchy plugin, including channels, MCP servers, skills, agent cores, workspace specs, and container runtime plugins. Also use when users ask how to register plugins via config.toml, add entry points, or validate plugin hook wiring.
x-integration
Post tweets, like, reply, retweet, and quote on X (Twitter) using browser automation. Use when the user asks you to interact with X/Twitter.
slack-token-extractor
Refresh expired Slack browser tokens (xoxc/xoxd) using persistent browser sessions. Use when Slack MCP tools fail with authentication errors.
Documentation Manager
Use when writing or reviewing pynchy documentation, deciding where to document things, updating the docs, checking doc consistency, or fixing broken links. Covers information architecture, writing philosophy, tree-shaped navigation, doc-code coupling, no hard-coded usernames, extensibility framing for pluggable…