NemoClaw 0.0.114 Moves Read-Only MCP Calls Out of the Model Decision Path and Tightens Image and Installation Verification

NVIDIA released NemoClaw 0.0.114 on August 23. Its most notable change is not a new model, but the removal of a class of MCP operations from the agent reasoning loop. Managed LangChain Deep Agents Code sandboxes can now call a registered read-only tool using `dcode tools call-read-only TOOL --json`. The command accepts only a bounded, single JSON object and rejects the request outright if the tool name is not unique, the capability is classified as state-modifying, or the execution conditions are ambiguous. Output uses a versioned JSON envelope, execution time and cleanup procedures are bounded, and strings matching recognized credential patterns are redacted.

This design separates “whether the model should call a tool” from “a query already selected by the workflow that only needs reliable execution.” For CI, auditing, or scheduled data collection, it can reduce model parameter-selection errors, prompt-injection attempts to rewrite intent, and the tokens and latency incurred by each call. However, it is not a secure bypass for arbitrary MCP tools. The read-only classification still depends on consistency between the registry metadata and the implementation. If a remote server is mislabeled or produces hidden side effects, the command layer may not detect them.

Version 0.0.114 also strengthens the deployment supply chain. Standard Docker onboarding selects an immutable image digest based on the release version and host architecture. If the evidence is inconsistent, the process stops before creating the sandbox; only when the image cannot be retrieved does it fall back to building from the bundled, reviewed Dockerfile. If the installation process cannot find `sha256sum` or `shasum`, it no longer skips verification of the nvm installer. Update requests and redirects are also required to use HTTPS. In addition, sandbox deletion warns about active SSH sessions, while failed export cleanup identifies temporary files that may contain secrets and explains how to remove them.

After upgrading, engineering teams should verify how their MCP registry labels read and write semantics, whether the redaction rules cover their credential formats, and whether the pinned-digest fallback build complies with internal SBOM and signature policies. This release improves predictability and fail-closed behavior; it does not establish that third-party MCP servers are inherently trustworthy.