Preface: “NanoClaw” is the name of the open-source AI agent software itself. “nanocoai” is simply the name of the GitHub organization/username where the official repository is hosted. NanoClaw is a complete AI agent orchestration framework that acts as an MCP Host while also spinning up its own built-in, dynamic MCP server alongside external ones.
Technical community discussions and news disclosures reveal that NanoClaw has gained high-profile traction:
- Tech Executives: Senior executives from Amazon, Google, Meta, and Accenture use it as part of their daily workflow automation.
- Government Leadership: Singapore’s Minister for Foreign Affairs, Vivian Balakrishnan, is among its notable public users.
- Industry Partners: NanoCo has established strategic partnerships with Docker and Vercel to provide hyper-secure sandbox environments for corporate systems.
Background: In NanoClaw’s architecture, when an AI agent wants to register a new MCP (Model Context Protocol) server, it invokes the handleAddMcpServer function in src/modules/self-mod/request[.]ts. At this point, the system triggers a requestApproval prompt to the administrator (human) and packages the execution parameters into the payload.
To automate tasks, corporate AI needs access to Gmail, databases, or ERP systems. NanoClaw ensures that raw API tokens and credentials never pass through the AI model itself. Credentials reside in a secure Agent Vault. They are dynamically injected via a secure Rust-based gateway only at the exact millisecond an authorized external request is executed.
When NanoClaw attempts high-risk write operations—such as modifying cloud files, sending corporate emails, or executing code—the framework automatically intercepts the action. It pushes an interactive approval card to the manager or employee via Slack, Microsoft Teams, or WhatsApp. The AI cannot fetch credentials or proceed until a human clicks “Approve.”
Vulnerability details: CVE-2026-17434 A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.
Official announcement: Please refer to the link for details –