NullClaw Deploy Guide: The Smallest AI Assistant Infrastructure in Zig

NullClaw is the smallest AI assistant I’ve found that still does everything. A single 678 KB static binary written in Zig, about 1 MB of RAM at runtime. No runtime, no VM, no framework overhead. It boots in under 2 milliseconds and runs on anything with a CPU, including $5 ARM boards.

This guide walks through deploying NullClaw on a VPS with your choice of LLM provider, chat channels, hybrid memory, and proper sandboxing.

If you’re comparing self-hosted bot options, our OpenClaw alternatives roundup includes NullClaw alongside ZeroClaw, nanobot, NanoClaw, and PicoClaw.

What NullClaw actually is

NullClaw is an AI assistant written entirely in Zig. The tagline is “null overhead, null compromise” — a static binary with zero runtime dependencies that runs on the cheapest hardware you can find.

The architecture uses vtable interfaces for every subsystem. Want to swap your LLM provider? Change one config line. Same for channels, memory backends, tools, tunnels, sandboxes, and peripherals.

678 KB binary · <2 ms startup · 3,230+ tests · 22+ providers · 17 channels · Pluggable everything

How it compares

The benchmark numbers are measured on 0.8 GHz edge hardware. NullClaw starts in under 8 milliseconds even on the slowest targets.

Why Zig

Zig is a systems programming language that compiles to C-like performance with zero runtime overhead:

That 678 KB binary covers the same feature set as alternatives that weigh in at multiple gigabytes.

Installation

Two main ways to get NullClaw installed.

# Install Zig (Linux)
curl -L https://ziglang.org/download/0.15.2/zig-linux-x86_64-0.15.2.tar.xz | tar -xJ
sudo mv zig-linux-x86_64-0.15.2 /usr/local/zig
sudo ln -s /usr/local/zig/zig /usr/local/bin/zig

# Clone and build
git clone https://github.com/nullclaw/nullclaw.git
cd nullclaw

# Release build (678 KB)
zig build -Doptimize=ReleaseSmall

# The binary is at zig-out/bin/nullclaw
ls -lh zig-out/bin/nullclaw

# Build the image
docker build -t nullclaw .

# Run
docker run -d \
  -v ~/.nullclaw:/root/.nullclaw \
  -p 3000:3000 \
  --name nullclaw \
  nullclaw

After building, run the onboard wizard:

# Quick setup (non-interactive)
nullclaw onboard --api-key sk-... --provider openrouter

# Or interactive wizard
nullclaw onboard --interactive

This creates ~/.nullclaw/ with a config.json and workspace folder.

Check that everything’s working:

nullclaw status

Configuring LLM providers

NullClaw supports 22+ providers out of the box. Every provider uses the OpenAI-compatible interface, so switching is just a config change.

Supported providers

Get an API key

For OpenRouter (recommended for flexibility):

1. Go to openrouter.ai
2. Create an account and generate an API key
3. The key starts with sk-or-

Add to config

Edit ~/.nullclaw/config.json:

{
  "default_provider": "openrouter",
  "default_temperature": 0.7,
  "models": {
    "providers": {
      "openrouter": {
        "api_key": "sk-or-your-key"
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "anthropic/claude-sonnet-4"
      }
    }
  }
}

Using custom providers

Any OpenAI-compatible endpoint works:

{
  "models": {
    "providers": {
      "minimax": {
        "api_key": "your-minimax-key",
        "base_url": "https://api.minimax.chat/v1"
      }
    }
  }
}

Then set "default_provider": "minimax".

Recommended models

If you’re looking for cost-effective models to pair with NullClaw, two open-source options work well:

MiniMax M2.5 — A 230B MoE model with 10B active parameters. Scores 80.2% on SWE-Bench Verified at a fraction of Claude’s cost ($0.15/M input tokens). The Lightning variant runs at 100 tokens/sec. Available through OpenRouter or directly via the MiniMax API.

GLM-5 — A 744B MoE model from Z.AI with 40B active parameters. 95.8% on SWE-bench Verified and near-zero hallucinations. Available through OpenRouter or Z.AI coding plans.

Both are covered in detail in our nanobot setup guide, which walks through API key configuration and provider setup. The same models work with NullClaw through OpenRouter or direct provider endpoints.

Test it

nullclaw agent -m "What's 42 * 17?"

Channel setup

NullClaw supports 17 chat channels. Pick what you use.

Telegram

1. Create a bot via @BotFather
2. Copy the bot token
3. Get your Telegram user ID (message @userinfobot)

Config:

{
  "channels": {
    "telegram": {
      "accounts": {
        "main": {
          "bot_token": "123456789:ABCdefGHIjklMNOpqrSTUvwxYZ",
          "allow_from": ["your_telegram_user_id"],
          "reply_in_private": true
        }
      }
    }
  }
}

Discord

1. Go to discord.com/developers/applications
2. Create a bot and copy the token
3. Enable MESSAGE CONTENT INTENT in the Bot settings

Config:

{
  "channels": {
    "discord": {
      "accounts": {
        "main": {
          "token": "your-discord-bot-token",
          "guild_id": "your-server-id",
          "allow_from": ["your_user_id"],
          "allow_bots": false
        }
      }
    }
  }
}

Slack

Config:

{
  "channels": {
    "slack": {
      "accounts": {
        "main": {
          "bot_token": "xoxb-your-bot-token",
          "app_token": "xapp-your-app-token",
          "allow_from": ["U1234567890"]
        }
      }
    }
  }
}

Other channels

Full config example

Here’s a complete ~/.nullclaw/config.json with OpenRouter, Telegram, hybrid memory, and sandboxing:

{
  "default_provider": "openrouter",
  "default_temperature": 0.7,

  "models": {
    "providers": {
      "openrouter": { "api_key": "sk-or-..." }
    }
  },

  "agents": {
    "defaults": {
      "model": { "primary": "anthropic/claude-sonnet-4" },
      "heartbeat": { "every": "30m" }
    }
  },

  "channels": {
    "telegram": {
      "accounts": {
        "main": {
          "bot_token": "123:ABC",
          "allow_from": ["your_user_id"]
        }
      }
    }
  },

  "memory": {
    "backend": "sqlite",
    "auto_save": true,
    "embedding_provider": "openai",
    "vector_weight": 0.7,
    "keyword_weight": 0.3,
    "hygiene_enabled": true
  },

  "gateway": {
    "port": 3000,
    "require_pairing": true,
    "allow_public_bind": false
  },

  "autonomy": {
    "level": "supervised",
    "workspace_only": true,
    "max_actions_per_hour": 20
  },

  "runtime": {
    "kind": "native",
    "docker": {
      "image": "alpine:3.20",
      "network": "none",
      "memory_limit_mb": 512,
      "read_only_rootfs": true
    }
  },

  "security": {
    "sandbox": { "backend": "auto" },
    "resources": { "max_memory_mb": 512, "max_cpu_percent": 80 },
    "audit": { "enabled": true, "retention_days": 90 }
  },

  "tunnel": { "provider": "none" },
  "secrets": { "encrypt": true },
  "identity": { "format": "openclaw" }
}

Memory system

NullClaw’s memory is built on SQLite with no external dependencies:

Config:

{
  "memory": {
    "backend": "sqlite",
    "auto_save": true,
    "embedding_provider": "openai",
    "vector_weight": 0.7,
    "keyword_weight": 0.3,
    "hygiene_enabled": true
  }
}

Set embedding_provider to noop if you don’t want to pay for embeddings. FTS5 keyword search still works.

Identity files

NullClaw supports two identity formats:

Edit these in ~/.nullclaw/workspace/ to customize the bot’s personality and knowledge about you.

Security model

NullClaw locks things down at multiple levels, not just application-level allowlists.

Gateway security

To expose the gateway, configure a tunnel:

{
  "tunnel": {
    "provider": "cloudflare"
  }
}

Supported tunnels: Cloudflare, Tailscale, ngrok, or custom binary.

Sandbox isolation

NullClaw auto-detects the best sandbox backend:

Config:

{
  "security": {
    "sandbox": { "backend": "auto" }
  }
}

Set "backend": "docker" for maximum isolation.

Encrypted secrets

API keys are encrypted with ChaCha20-Poly1305:

{
  "secrets": { "encrypt": true }
}

The encryption key is stored locally in ~/.nullclaw/.

Workspace scoping

With workspace_only = true, the bot can only access files inside its workspace. Symlink escape attempts are blocked through path canonicalization.

MCP support

NullClaw supports Model Context Protocol servers:

{
  "mcp_servers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/home/user/documents"]
    }
  }
}

MCP tools are discovered and registered automatically. The bot can use them alongside built-in tools.

Scheduled tasks

NullClaw has a built-in cron scheduler:

# List scheduled tasks
nullclaw cron list

# Add a recurring task
nullclaw cron add --name "morning" --message "What's on my calendar today?" --cron "0 9 * * *"

# Run a task once
nullclaw cron run <task_id>

# Pause/resume
nullclaw cron pause <task_id>
nullclaw cron resume <task_id>

Tasks are persisted to JSON and survive restarts.

CLI reference

VPS deployment

For production use, here’s a complete VPS setup.

Server requirements

NullClaw runs on $5 boards. I tested it on a Raspberry Pi Zero 2 W and it worked fine.

Quick deployment

ssh root@YOUR_SERVER_IP

# Update system
apt update && apt upgrade -y

# Install Zig
curl -L https://ziglang.org/download/0.15.2/zig-linux-x86_64-0.15.2.tar.xz | tar -xJ
sudo mv zig-linux-x86_64-0.15.2 /usr/local/zig
sudo ln -s /usr/local/zig/zig /usr/local/bin/zig

# Clone and build
git clone https://github.com/nullclaw/nullclaw.git
cd nullclaw
zig build -Doptimize=ReleaseSmall

# Install binary
sudo cp zig-out/bin/nullclaw /usr/local/bin/

# Initialize
nullclaw onboard --interactive

# Edit config
nano ~/.nullclaw/config.json

# Start daemon
nullclaw daemon

Systemd service

For automatic startup:

nullclaw service install
nullclaw service start
nullclaw service status

Or create manually:

[Unit]
Description=NullClaw AI Assistant
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/nullclaw daemon
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Save to /etc/systemd/system/nullclaw.service, then:

systemctl daemon-reload
systemctl enable nullclaw
systemctl start nullclaw

Running on edge hardware

NullClaw’s low resource usage makes it a good fit for edge deployment:

Build for ARM from x86:

zig build -Dtarget=aarch64-linux -Doptimize=ReleaseSmall

Gateway API

Pairing flow:

# Start gateway (shows pairing code)
nullclaw gateway

# Exchange code for token
curl -X POST http://127.0.0.1:3000/pair \
  -H "X-Pairing-Code: 123456"

# Use token for requests
curl -X POST http://127.0.0.1:3000/webhook \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello, nullclaw!"}'

NullClaw vs ZeroClaw vs nanobot

I run all three, so here’s a direct comparison:

NullClaw is the lightest option here. ZeroClaw is easier to set up if you’re already in the Rust ecosystem. nanobot has the broadest channel support.

nullclaw migrate openclaw --dry-run
nullclaw migrate openclaw

If you’re comparing container-based isolation, see our NanoClaw deploy guide — it uses Docker containers with Claude’s Agent SDK. For a Python-based alternative with MiniMax and GLM-5 setup walkthroughs, check the nanobot setup guide.

If you want to explore other AI coding tools, our AI coding tools comparison covers the current landscape. For MCP basics that work across assistants, check the MCP introduction for beginners.

Este artículo también está disponible en español: Guía de Despliegue de NullClaw.