NanoClaw

The /add-vorim skill gives each NanoClaw agent group a Vorim identity and a hook that blocks writes, shell commands and message sends the agent isn't granted.

NanoClaw

NanoClaw runs Claude agents in containers and grows through skills that Claude Code applies to your checkout. Vorim ships as one of them, /add-vorim. It registers the Vorim MCP server for the agent groups you pick and adds a PreToolUse hook that checks every file write, shell command and MCP call against the agent's Vorim scopes, sending a message included. The API key stays in the OneCLI vault and never enters the container.

Install

In your NanoClaw checkout, fetch the skill and run it from Claude Code.

mkdir -p .claude/skills/add-vorim
curl -fsSL https://vorim.ai/hooks/nanoclaw/add-vorim/SKILL.md -o .claude/skills/add-vorim/SKILL.md
curl -fsSL https://vorim.ai/hooks/nanoclaw/add-vorim/REMOVE.md -o .claude/skills/add-vorim/REMOVE.md

# then, in Claude Code inside your NanoClaw checkout
/add-vorim

bash

The skill asks which groups to cover and which Vorim agent each one acts as, has you store the API key with onecli secrets create, restarts the groups, and walks you through checking that a call the agent isn't granted gets blocked.

What it changes

data/v2-sessions/<group>/.claude-shared/settings.json gains PreToolUse and PostToolUse command hooks that run the Vorim hook for Write, Edit, Bash and every MCP tool.
ncl groups config add-mcp-server registers a vorim MCP server, with the key supplied by the OneCLI gateway.
groups/<group>/instructions.prepend.md gets a short block telling the agent not to work around a Vorim denial.

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Write|Edit|NotebookEdit|Bash|mcp__.*",
      "hooks": [{ "type": "command",
        "command": "NODE_USE_ENV_PROXY=1 node /home/node/.claude/vorim/vorim-hook.mjs pre --agent agid_..." }]
    }]
  }
}

json

REMOVE.md, installed alongside the skill, undoes each step. The hook needs Node 22.21 or later in the container, the first release where fetch follows the gateway's HTTPS_PROXY once NODE_USE_ENV_PROXY=1 is set, which the skill does for you.

Need Help?

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.