{
  "markdown": "<div align=\"center\">\n  <img src=\".github/readme-assets/nora-logo.png\" alt=\"Nora\" width=\"112\" height=\"112\" />\n  <h1>Nora</h1>\n  <p><strong>Run OpenClaw and Hermes fleets on your own infrastructure — from one control plane.</strong></p>\n</div>\n\n<p align=\"center\">\n  <strong>OpenClaw + Hermes</strong>&nbsp;&nbsp;·&nbsp;&nbsp;\n  <strong>Docker + Kubernetes GA</strong>&nbsp;&nbsp;·&nbsp;&nbsp;\n  <strong>69 provider connections</strong>&nbsp;&nbsp;·&nbsp;&nbsp;\n  <strong>Apache-2.0</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/solomon2773/nora\"><img src=\"https://img.shields.io/badge/%E2%98%85-Star_Nora-f2d7a1?style=for-the-badge&amp;labelColor=071018\" alt=\"Star Nora on GitHub\" /></a>\n  <a href=\"https://docs.norafleet.ai/quickstart\"><img src=\"https://img.shields.io/badge/%E2%86%92-Quick_Start-8ae6ff?style=for-the-badge&amp;labelColor=071018\" alt=\"Quick Start\" /></a>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/solomon2773/nora/releases\"><img src=\"https://img.shields.io/github/v/release/solomon2773/nora?color=6d28d9&label=release\" alt=\"Latest release\" /></a>\n  <a href=\"https://github.com/solomon2773/nora/actions/workflows/ci-quality.yml\"><img src=\"https://img.shields.io/github/actions/workflow/status/solomon2773/nora/ci-quality.yml?branch=master&label=CI\" alt=\"CI status\" /></a>\n  <a href=\"https://www.npmjs.com/package/@noraai/cli\"><img src=\"https://img.shields.io/npm/v/%40noraai%2Fcli?label=%40noraai%2Fcli&color=cb3837\" alt=\"@noraai/cli on npm\" /></a>\n  <a href=\"https://www.npmjs.com/package/@noraai/mcp-server\"><img src=\"https://img.shields.io/npm/v/%40noraai%2Fmcp-server?label=%40noraai%2Fmcp-server&color=cb3837\" alt=\"@noraai/mcp-server on npm\" /></a>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://docs.norafleet.ai\">📚 Documentation</a> ·\n  <a href=\"https://docs.norafleet.ai/self-hosting\">Self-Hosting</a> ·\n  <a href=\"https://docs.norafleet.ai/concepts/architecture\">Architecture</a> ·\n  <a href=\"https://docs.norafleet.ai/compare\">How Nora Compares</a> ·\n  <a href=\".github/press-kit/README.md\">Press Kit</a> ·\n  <a href=\"CHANGELOG.md\">Changelog</a>\n</p>\n\n---\n\n<p align=\"center\">\n  <a href=\"https://norafleet.ai/walkthrough.mp4\">\n    <img src=\".github/readme-assets/walkthrough.gif\" alt=\"Watch the Nora walkthrough\" width=\"900\" />\n  </a>\n</p>\n<p align=\"center\">\n  <sub>▶ <b><a href=\"https://norafleet.ai/walkthrough.mp4\">Watch the walkthrough</a></b></sub>\n</p>\n\n## What Is Nora?\n\nNora is the self-hosted AI agent ops platform for running autonomous agent fleets on infrastructure you control — whether you standardize on OpenClaw, Hermes, or keep both available in the same operator surface.\n\nMost teams running agents in production eventually rebuild the same layer around the runtime itself: deploy workflows, secrets, monitoring, logs, terminal, templates, and a separate admin surface. Nora exists so that layer doesn't have to be rewritten every time the runtime conversation changes. Operator workflows live under `/app`; platform-wide admin lives under `/admin`.\n\n→ [Why Nora](https://docs.norafleet.ai/introduction#positioning-pillars) · [Runtime model](https://docs.norafleet.ai/concepts/runtimes) · [Deployment footprint](https://docs.norafleet.ai/concepts/architecture#deployment-topologies)\n\n## Features\n\n- **Deploy & operate runtimes** — provision OpenClaw and Hermes agents to Docker or Kubernetes (both GA, official Helm chart) with full lifecycle controls: deploy, start/stop, restart, redeploy, and version history.\n- **Migrate existing runtimes** — recreate agents from uploaded bundles, with privileged local-Docker Live Pull available to self-hosted platform admins.\n- **Live operator access** — streaming logs, an interactive terminal into running containers, a file browser/editor, and the OpenClaw gateway &amp; Hermes dashboard embedded in the operator UI.\n- **Monitoring & alerting** — per-agent metrics and cost, a fleet needs-attention roll-up (errored, stuck, over-budget, stalled telemetry), and user-defined alert rules delivered to your channels.\n- **Budgets & scheduled runs** — per-agent LLM budget hard caps with auto-pause, plus recurring cron schedules for agent runs with queue retries and sweep guards.\n- **Secrets that fail closed by default** — provider keys are AES-256-GCM encrypted at rest and synced to running runtimes; production refuses to boot without a valid encryption key unless an operator deliberately enables the insecure plaintext override; SSH host-key pinning protects remote (BYOC) Docker hosts.\n- **Network isolation** — baseline Kubernetes NetworkPolicy ingress isolation with admin-managed CIDR allow rules, and an experimental NemoClaw hardened sandbox for untrusted code.\n- **Agent Hub** — installable, versioned starter templates to go from zero to a working agent fast.\n- **Integrations** — a 69-entry credential/connectivity catalog (source control, chat, cloud, observability, vector DBs, automation) plus 17+ LLM providers. Executable behavior comes from runtime skills or MCP adapters; supported per-agent MCP servers are enabled explicitly.\n- **Experimental Proxmox LXC** — deploy standard OpenClaw or a prepared Hermes image into unprivileged LXC with verified API TLS and pinned SSH. It is not VM-grade isolation and still requires the real-hardware smoke gate before production use.\n- **Automate everything** — a public REST API (OpenAPI 3.1), the `@noraai/cli`, and the `@noraai/mcp-server` for Claude Code, Gemini CLI, Claude Desktop, and Cursor.\n- **Workspaces & RBAC** — multi-tenant workspaces with ranked roles, a platform admin surface, account event history, and encrypted managed backups.\n\n## Screenshots\n\n<table>\n  <tr>\n    <td align=\"center\" width=\"50%\">\n      <img src=\".github/readme-assets/proof-operator-dashboard.png\" alt=\"Operator dashboard\" /><br />\n      <sub><b>Operator dashboard</b></sub>\n    </td>\n    <td align=\"center\" width=\"50%\">\n      <img src=\".github/readme-assets/proof-operator-fleet.png\" alt=\"Fleet monitoring\" /><br />\n      <sub><b>Fleet monitoring &amp; needs-attention triage</b></sub>\n    </td>\n  </tr>\n  <tr>\n    <td align=\"center\" width=\"50%\">\n      <img src=\".github/readme-assets/proof-operator-agent-detail.png\" alt=\"Nora agent detail and operations view\" /><br />\n      <sub><b>Agent detail &amp; lifecycle operations</b></sub>\n    </td>\n    <td align=\"center\" width=\"50%\">\n      <img src=\".github/readme-assets/proof-operator-hermes-webui-tab.png\" alt=\"Embedded Hermes WebUI\" /><br />\n      <sub><b>Hermes WebUI embedded in Nora</b></sub>\n    </td>\n  </tr>\n  <tr>\n    <td align=\"center\" colspan=\"2\">\n      <img src=\".github/readme-assets/proof-operator-deploy-flow.png\" alt=\"Agent deploy flow\" /><br />\n      <sub><b>Agent deploy flow</b></sub>\n    </td>\n  </tr>\n</table>\n\n## Quick Start\n\n> **Requirements:** macOS 12+, Linux, or Windows 10+ (WSL2), with Docker Engine + Compose v2. The installer checks for Docker, Git, and OpenSSL and installs anything missing.\n\n**macOS / Linux / WSL2:**\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/solomon2773/nora/master/setup.sh | bash\n```\n\n<details>\n<summary><strong>Prefer to inspect the installer first?</strong></summary>\n\n```bash\ngit clone https://github.com/solomon2773/nora.git\ncd nora\nless setup.sh\nbash setup.sh\n```\n\n</details>\n\n**Windows (PowerShell):**\n\n```powershell\niwr -useb https://raw.githubusercontent.com/solomon2773/nora/master/setup.ps1 | iex\n```\n\n> **Windows requires [PowerShell 7+](https://learn.microsoft.com/powershell/scripting/install/installing-powershell-on-windows).** The default Windows PowerShell 5.1 is not supported — run the command above from a `pwsh` 7 session.\n\n**Kubernetes (Helm):**\n\n```bash\nhelm show chart oci://ghcr.io/solomon2773/nora\n```\n\nThe command resolves the latest published chart; pin the reported version for reproducible production installs. The public OCI chart installs the full Nora control plane. See the [Helm instructions](https://docs.norafleet.ai/self-hosting#kubernetes-helm) for the required secrets and Ingress options.\n\nThe installer verifies prerequisites, generates or preserves secrets, optionally creates a bootstrap admin, picks free local ports when the defaults are busy, and starts the stack. Once it finishes, open the URL printed by setup. Local mode defaults to `http://localhost:8080`, but setup may select another port such as `8081` on a busy workstation. Then follow the [first-15-minutes walkthrough](https://docs.norafleet.ai/quickstart).\n\n> **No API key yet?** On installations with the local Docker target enabled, choose **Launch local Docker demo** on the Getting Started page. Nora deploys a working agent against its built-in deterministic demo provider, so you can validate chat and the operator workflow with zero keys and zero model-usage cost. Kubernetes-only installations start by adding a model provider and deploying to an enabled cluster target.\n\nFor manual setup, environment variables, public-domain mode, TLS, Remote Docker, Kubernetes, NemoClaw, and experimental Proxmox LXC configuration, see the docs:\n\n- [Self-hosting guide](https://docs.norafleet.ai/self-hosting)\n- [Environment variables reference](https://docs.norafleet.ai/configuration/environment-variables)\n- [Provisioner backends](https://docs.norafleet.ai/configuration/provisioner-backends) (Docker and k3s/Kubernetes are GA; Remote Docker, NemoClaw, and Proxmox LXC are experimental)\n- [Remote Docker BYOC setup](https://docs.norafleet.ai/guides/remote-docker) — SSH registration, private networking, validation, sharing, and recovery\n- [TLS and public domains](https://docs.norafleet.ai/configuration/tls-domains)\n- [Fronting a launch with Cloudflare](infra/cloudflare-launch.md) — edge caching, rate limiting, and spike absorption for the single-host deploy\n\n## Documentation\n\nFull docs live at **[docs.norafleet.ai](https://docs.norafleet.ai)**. The MDX source is in [`docs/`](./docs).\n\n| Section                                                                        | What's there                                                                                           |\n| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ |\n| [Quick Start](https://docs.norafleet.ai/quickstart)                     | Install and validate your first agent in 15 minutes                                                    |\n| [Concepts](https://docs.norafleet.ai/concepts/architecture)             | Architecture, agents, runtimes, workspaces, LLM providers, Agent Hub                                   |\n| [Configuration](https://docs.norafleet.ai/configuration/platform-modes) | Platform modes, env vars, provisioner backends, TLS / public domains                                   |\n| [Guides](https://docs.norafleet.ai/guides/deploy-agent)                 | Deploy agent, providers, integrations, channels, monitoring, alert rules, backups, Agent Hub, NemoClaw |\n| [API Reference](https://docs.norafleet.ai/api/overview)                 | Auth, workspaces, agents, channels, integrations, providers, monitoring, alert rules                   |\n| [Support](https://docs.norafleet.ai/support/faq)                        | FAQ, troubleshooting                                                                                   |\n\n## Architecture\n\n```text\nNginx\n├── /           → frontend-marketing  (Next.js)\n├── /app/*      → frontend-dashboard  (Next.js)\n├── /admin/*    → admin-dashboard     (Next.js)\n└── /api/*      → backend-api         (Express.js)\n                       ├── PostgreSQL\n                       ├── Redis + BullMQ  (deployments, clawhub-jobs, backups, alert-deliveries)\n                       ├── worker-provisioner\n                       ├── worker-backup\n                       ├── deploy-target adapters  (Docker + k3s/k8s GA · Remote Docker + Proxmox experimental)\n                       └── sandbox profiles        (standard · NemoClaw experimental)\n```\n\nFull architecture write-up — system map, queue/worker boundaries, RBAC, migration contract, deployment topologies — is in [docs/concepts/architecture](https://docs.norafleet.ai/concepts/architecture).\n\n## Tech Stack\n\n| Layer              | Technology                                                                                     |\n| ------------------ | ---------------------------------------------------------------------------------------------- |\n| Reverse proxy      | Nginx                                                                                          |\n| Frontends          | Next.js 16, React 19, Tailwind CSS                                                             |\n| Backend API        | Express.js 5, Node.js 24 LTS                                                                   |\n| Auth               | JWT, HttpOnly cookies, bcryptjs, provider OAuth bridge                                         |\n| Database           | PostgreSQL 15                                                                                  |\n| Queue              | BullMQ + Redis 7                                                                               |\n| Runtime families   | OpenClaw, Hermes                                                                               |\n| Deployment targets | Docker and k3s/Kubernetes (GA); Remote Docker BYOC and Proxmox unprivileged LXC (experimental) |\n| Sandbox profiles   | Standard; NemoClaw (experimental, not available on Proxmox)                                    |\n| Secrets at rest    | AES-256-GCM (provider keys, integrations, backups)                                             |\n\n## Public REST API, CLI, and MCP\n\nWorkspace-scoped API keys (bearer-only, prefixed `nora_`, HMAC-hashed at rest, scope-based) drive a stable subset of the REST surface. Issue keys at `/app/workspaces/<id>/api-keys`.\n\n```bash\nexport NORA_TOKEN=\"nora_...\"\ncurl -H \"Authorization: Bearer $NORA_TOKEN\" https://your-nora.example.com/api/agents\n```\n\nA small CLI lives in [`cli/`](./cli) (`@noraai/cli`): run `nora login` once to save your host and API token, then `nora workspaces`, `nora agents`, and `nora monitoring` wrap the same REST surface. `nora doctor` runs an admin-only control-plane health check, and `nora mcp` launches the MCP stdio server. See the [API reference](https://docs.norafleet.ai/api/overview) for the supported endpoints and scopes.\n\n**Operate Nora from Claude Code, Gemini CLI, Claude Desktop, or Cursor:** the [`mcp-server/`](./mcp-server) package (`@noraai/mcp-server`) exposes the same API as [Model Context Protocol](https://modelcontextprotocol.io) tools — deploy agents, control their lifecycle, and read fleet metrics, events, and per-agent cost from any MCP client. Destructive deletion stays disabled unless explicitly opted in.\n\n```bash\nclaude mcp add nora \\\n  --env NORA_API_URL=https://your-nora.example.com \\\n  --env NORA_API_KEY=nora_... \\\n  -- npx -y @noraai/mcp-server\n```\n\nGemini CLI users can install the repository extension directly. The installer prompts for the Nora API URL and stores the workspace API key as a sensitive extension setting:\n\n```bash\ngemini extensions install https://github.com/solomon2773/nora\n```\n\nSee the [MCP guide](https://docs.norafleet.ai/guides/mcp-server) for Gemini CLI, Claude Desktop, and Cursor configuration, the tool list, and security notes.\n\n## Standards & isolation\n\n- **MCP — shipped.** A control-plane [MCP](https://modelcontextprotocol.io) server (`@noraai/mcp-server`, published to the official [MCP Registry](https://github.com/modelcontextprotocol/registry)) plus per-agent MCP server management — operate the fleet from Claude Code, Gemini CLI, Claude Desktop, or Cursor, and wire MCP tools into individual agents.\n- **OpenTelemetry GenAI — available.** [OTLP + Prometheus export](https://docs.norafleet.ai/guides/opentelemetry) of runtime telemetry under the `gen_ai.*` semantic conventions — per-exchange chat spans plus token/cost/resource metrics flow into the Grafana / Datadog / Langfuse stack you already run. (Per-tool-call sub-spans depend on runtime event streams and remain on the roadmap.)\n- **A2A — on the roadmap.** Agent Cards / Agent-to-Agent discovery for managed OpenClaw and Hermes agents.\n- **Isolation, per deploy target.** Standard Docker runs use container namespaces plus operator-set CPU and RAM limits; `disk_gb` is metadata and operators must monitor Docker storage. Kubernetes adds workload resource limits and provisioned storage requests. The experimental **NemoClaw** profile hardens untrusted code with a non-root user, all Linux capabilities dropped, `no-new-privileges`, Landlock + seccomp, and default-deny egress. Experimental Proxmox placement uses unprivileged LXC, which remains a shared-kernel boundary and is not presented as VM-grade isolation. See the [isolation model](https://docs.norafleet.ai/concepts/security#runtime-isolation).\n\n## Roadmap\n\n- **NemoClaw hardening** _(high priority)_ — mature the experimental secure-sandbox profile end to end: enablement, policy controls, approvals, telemetry, and validation.\n- **Proxmox hardware qualification** — run the protected OpenClaw and prepared-Hermes lifecycle matrix on the exact node, storage, bridge, templates, and network before considering any beta label; until then the target remains Experimental.\n- **Hermes/OpenClaw parity** — close runtime gaps across validation, logs, terminal access, monitoring, and failure reporting.\n- **First-run operator UX** — a tighter path from install to the first deployed, validated agent.\n- **Account-scoped monitoring** — account-level health roll-ups across workspaces, agents, cost, and alerts, with drill-downs.\n- **Auth & key-sync hardening** — key rotation, audit trails, and recovery from partial sync failures.\n- **Agent Hub ergonomics** — better template discovery, install/configure flows, and post-install validation.\n- **A2A support** — Agent Cards / agent-to-agent discovery for managed runtimes.\n\n## Development\n\n```bash\n# Docker (recommended)\ndocker compose up -d\ndocker compose logs -f backend-api\n\n# Tests\ncd backend-api && npx jest --no-watchman\ncd e2e && npm test\n```\n\nStart with [`CONTRIBUTING.md`](./CONTRIBUTING.md) for contributor guidance. [`CLAUDE.md`](./CLAUDE.md) documents the repo layout, development commands, and subtree ownership for humans and AI coding agents alike.\n\n## Contributing\n\nNew here? Browse [**good first issues**](https://github.com/solomon2773/nora/labels/good%20first%20issue) for small, self-contained starting points, then skim [CONTRIBUTING.md](./CONTRIBUTING.md).\n\nStrong contribution areas: runtime adapter work · operator and admin UX · provisioning and lifecycle orchestration · integrations and channels · test and CI hardening · self-hosted deployment ergonomics.\n\nTypical workflow: fork → branch (`feature/...`) → commit → pull request.\n\n## Community\n\n- [Issues](https://github.com/solomon2773/nora/issues)\n- [Discussions](https://github.com/solomon2773/nora/discussions)\n- [Hermes Agent](https://github.com/NousResearch/Hermes-Agent)\n- [OpenClaw](https://github.com/openclaw/openclaw)\n\nIf Nora is useful to you, a ⭐ on the repo helps other self-hosters find it.\n\n## License\n\nThis project is open source under the [Apache License 2.0](./LICENSE).\n",
  "bytes": 19277,
  "sha": "4613ac348ee95b1f12ad915929f6f528b5955e48c0ff2b6ad5595417ffa21b5d",
  "repo_slug": "solomon2773/nora",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_solomon2773_nora_6e4f210b/readme"
}