crushclaw

• 

  CrushClaw, your engineer for incidents who's always awake

Inspiration

Being on-call in healthcare is its own special kind of pain. Your pager goes off at 3 AM with some cryptic error from a service you've never touched, and you've got maybe ten minutes to figure out whether it's a real outage, a deploy that's flapping, or just a customer who clicked the wrong button. Your first instinct is "let me ask Claude," and then you remember HIPAA. Patient data can't leave the boundary, so the most useful AI assistants on the planet are off-limits at the exact moment you need them. Then the NVIDIA DGX Spark / ASUS Ascent GX10 showed up: a desktop box with 128 GB of unified memory, enough to run a serious 30B model locally. That made the obvious question ("what if the on-call buddy just lived inside the HIPAA boundary, on the engineer's own machine?") feel worth actually trying. So we did.

What it does

Crushclaw is an always-on incident-response agent. Here's the flow: A page comes in. PagerDuty fires a webhook at the gateway over Tailscale. The agent wakes up and checks its own memory. Has this service flapped before? When was the last incident? Did it ever get resolved cleanly? It writes a debrief with four parts: what's happening, a timeline of the last 30 minutes, three hypotheses with citations, and suggested next steps. It texts the engineer. The SMS is just a short pointer, and it only goes out after the whole message body passes through a local PHI redactor. If the redactor is down, the text doesn't send. Period. The engineer opens the chat UI. From there they can ask follow-ups, dig into detail, or close things out with /resolved , which writes the resolution back into the agent's memory so the next page is a little smarter. The whole loop runs on one desktop. No cloud LLM, no PHI leaving the box.

How we built it

The hardware is an ASUS Ascent GX10, the new Grace-Blackwell desktop with 128 GB of unified memory. The local model is Nemotron-3-Nano-30B, NVIDIA's edge-friendly reasoning model, served through Ollama. The agent runs inside a NemoClaw sandbox that wraps the OpenClaw agent gateway. That's where the egress allowlist lives and where the model's tool calls get mediated. We wrote a custom skill (oncall-buddy) with four shell tools: recent_incidents, twilio_send_sms, mark_resolved, and a citation-quality check. Each one is a self-contained Node script, so the model can call them deterministically. PHI minimization is handled by a Microsoft Presidio Docker sidecar. It scans outbound text for names, MRNs, dates, and so on, and hands back a redacted version. The egress tool calls it first, and if that call fails, the send aborts. Fail-closed by default. For the surfaces: a Hono TypeScript service handles inbound Twilio webhooks plus a summary read-view. The OpenClaw Control UI canvas is the engineer's interactive surface, mounted at a tailnet-only URL through Tailscale Serve. Inbound PagerDuty and Twilio webhooks are exposed publicly via Tailscale Funnel. There's also a mock service and an MCP bridge wired up to deploy to Komodo behind Traefik for the agent's external lookups. It's all TypeScript or shell, with pnpm workspaces, vitest for tests, and a recorded-webhook replay (bin/demo-full.sh) that reproduces the whole flow hermetically. Challenges we ran into More than we expected, honestly, given how clean the architecture looked on the whiteboard. Twilio's A2P 10DLC registration turned out to be a multi-day carrier-verification slog for US local numbers. We ended up using Twilio's Test Credentials so we could prove the wiring worked end-to-end without waiting weeks on carrier ops. OpenClaw v2026.4.24's actual schema didn't match the docs we'd been building against. We had to read the source to figure out that hooks need a separate token from the gateway, that transforms get a specific context shape, that message templates render against the raw HTTP payload rather than the transform output, and a handful of other quirks. We hit network races inside the sandbox. NemoClaw's egress allowlist runs at the network layer, so the first connection to a host sometimes loses a race with policy-state setup. We added retry logic to the Presidio call to absorb the cold start. Small-model tool-calling reliability was the big one. Nemotron-3-Nano-30B does drive tools through OpenClaw's exec protocol, but at 30B its argument quality is hit or miss, and sometimes it paraphrases the playbook instead of running it. We dealt with this honestly: the demo runs the deterministic playbook from a shell driver alongside the agent's reasoning surface. A 100B-class local model would close that gap. Tailscale Funnel path routing has some subtle gotchas. Mixing serve (tailnet) and funnel (public) on the same hostname meant we had to split the auth surface off from the webhook surface and add an allowed-origins config on the gateway. Every one of these taught us something. A surprising chunk of "build a hackathon agent" turned out to be "do careful archaeology on an alpha codebase with the clock running."

Accomplishments that we're proud of

A real agent working end-to-end on edge hardware, with no cloud failover, no LLM-as-a-service, and no PHI leaving the box. Fail-closed PHI minimization that we actually tested. Pull the Presidio container and the SMS doesn't go out. Three layers of defense in depth: a hook-ingress bearer token, HMAC signature verification, and a network-layer egress allowlist. The agent literally can't reach a non-allowlisted host even if it wanted to. A hermetic demo that reproduces the entire flow from one shell command, so reviewers can run the architecture themselves instead of trusting our word for it. Honest scoping. When Nemotron's tool-calling couldn't quite drive the deterministic side effects, we shipped the split design (reasoning surface plus deterministic effects) and explained why. We'd rather show real work than paper over the gaps. What we learned Edge inference is real now. A year ago, "run a 30B reasoning model locally and get useful incident triage out of it" would have sounded like a stretch. On the GX10 it's just a Tuesday. Reliable tool calling is the bottleneck for smaller models. The agent can read a playbook and run tools, but pulling structured arguments out of a freeform spec and calling exactly the right tool is where 30B falls short of 200B. For an on-call buddy, the model-size gap that matters is the tool-calling gap, not the reasoning gap. HIPAA-by-construction gets a lot easier when the model lives inside the boundary. The whole problem stops being "stop the model from leaking" and becomes "minimize what goes out through known egress paths," which is a much smaller thing to solve. NemoClaw's network policy is the underrated piece here. Most agent sandboxes do app-layer permissions. NemoClaw enforces at the network itself, at DNS, TCP, and TLS, which means a misbehaving model is bounded by physics instead of by promises. What's next for crushclaw A stronger local model. Once a quantized 70B-class reasoning model fits comfortably in 128 GB, the deterministic shell driver goes away and the agent runs the playbook itself. Real Twilio A2P registration, so the SMS actually lands on the engineer's phone instead of the test API. A Komodo-hosted MCP server, so the agent can enrich debriefs with real log fragments, deploy timelines, and service-ownership lookups. Multi-tenant deployment: one GX10 serving multiple on-call rotations, with episodic memory partitioned per service. Sub-agent orchestration for triage, fanning out to specialized agents for DB, network, and deploys, then synthesizing what they find. Production HIPAA work: a BAA with Twilio, SQLCipher for the episodic store, and secret rotation through a vault instead of an env file. Opening the architecture up to other regulated areas. Financial-services on-call, legal-services on-call, anywhere "the model can't touch the cloud and the engineer needs help right now" is a genuine constraint.

Built With

• bashvitest
• better-sqlite3
• docker
• docker-compose
• fastapi
• javascript
• komodo
• microsoft-presidio
• nemoclaw
• nemotron-3-nano-30b
• node.js
• ollama
• openclaw
• pnpm
• pnpm-workspaces
• presidio-analyzer
• presidio-anonymizer
• python
• tailscale
• tailscale-funnel
• traefik
• typescript
• uvicorn