Guide · Agent skill
How to use the Manage Mounts agent skill (manage-mounts)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The manage-mounts skill is a set of instructions that lets an AI agent change which folders on your computer its NanoClaw containers can reach. NanoClaw runs agents inside isolated containers, and by default those containers cannot see your files. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what to check before granting access. By the end you will be able to view, add, and remove mount allowlist entries safely.
Manage Mountsnanocoai/nanoclaw · MIT Download the skill Quick start
- 1Install NanoClaw prerequisites. Make sure NanoClaw is installed with its setup script, and that pnpm and tsx are available.
- 2Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3View the current allowlist. Ask the agent to show your mount allowlist so you can see which directories are allowed and their access level.
- 4Add a directory. Name the folder you want agents to reach. The agent checks the path exists and asks whether it should be read-only or read-write.
- 5Confirm the write. Review the change the agent proposes, then let it save the config through the NanoClaw setup script.
- 6Apply to running containers if needed. New containers pick up changes automatically. For a group with a running container, restart that group with ncl groups restart.
What the manage-mounts skill does
NanoClaw agent containers are isolated from your host machine. The mount allowlist is the list of host directories those containers are permitted to access. It lives at ~/.config/nanoclaw/mount-allowlist.json.
With this skill, the agent can show you the current allowlist in a readable form, add new directories, remove existing ones, or reset the list to empty. For each directory it adds, the agent checks that the path exists and asks whether access should be read-write or read-only. Read-only is the safer default.
- View: shows which directories are allowed and whether each is read-only or read-write.
- Add: validates each path, asks about access mode, then saves the config.
- Remove: shows the current config, asks which entry to drop, then saves the trimmed config.
- Reset: empties the allowlist.
Install the manage-mounts skill
Download the skill ZIP from this page and unzip it into one of these locations. Use ~/.claude/skills/ to make the skill available everywhere, or a project's .claude/skills/ folder to limit it to that project.
You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into your project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Check that NanoClaw is set up
The skill only configures NanoClaw, so NanoClaw must already be installed with its setup script. The setup script is run with pnpm and tsx. You also need access to ~/.config/nanoclaw/mount-allowlist.json.
The ncl CLI is optional. You only need it if you want to apply changes to a container that is already running.
- NanoClaw installed, with its setup script available
- pnpm and tsx available to run that script
- Access to ~/.config/nanoclaw/mount-allowlist.json
- ncl CLI (optional, for restarting a group's container)
Trigger the skill with natural requests
The skill is triggered by phrases such as "mounts", "mount allowlist", "agent access to directories", and "container mounts". You do not need to type a command. Describe what you want in plain language and mention the folder.
To see the current setup, ask something like: show my mount allowlist. To grant access, name the folder and the access level you want. The agent will ask you to confirm read-only or read-write for each path.
- "Show my container mounts."
- "Give agents read-only access to /path/to/project."
- "Add my notes folder to the mount allowlist as read-write."
- "Remove the mount allowlist entry for /path/to/old-dir."
- "Reset the mount allowlist to empty."
cat ~/.config/nanoclaw/mount-allowlist.json 2>/dev/null || echo "No mount allowlist configured"How changes are written and applied
Adding or removing entries writes a JSON config through NanoClaw's setup script, using --step mounts with --force to overwrite the existing config. Resetting uses the --empty flag instead of --json. The agent builds the JSON for you, so you do not need to write it yourself.
The allowlist is read fresh when a container is spawned. New mounts therefore apply to newly spawned containers automatically, with no service restart. To apply changes to a group that already has a running container, restart only that group with the ncl CLI.
pnpm exec tsx setup/index.ts --step mounts --force -- --json '{"allowedRoots":[{"path":"/path/to/dir","allowReadWrite":true}],"blockedPatterns":[]}'Safety notes before you grant access
Only grant the access the agent needs. Read-only is the default and the safer choice. Read-write lets an agent modify files, so use it only for folders you are comfortable having changed.
Do not grant read-write access to sensitive locations such as home directories, SSH keys, or credential stores. An agent could modify or leak those files. The skill runs scripts locally; the source states it does not use the network.
- Prefer read-only unless writes are required.
- Never grant read-write to home directories, SSH keys, or credential stores.
- Review the list periodically and remove entries you no longer need.
- Reset to empty if you want to cut all container file access.
What people use it for
- Letting an agent work on one specific project folder in read-write mode while keeping everything else hidden.
- Auditing which host directories agents can reach and removing entries you no longer need.
- Giving an agent read-only access to reference documents so it can read but not change them.
- Resetting container file access to nothing before handing a machine to someone else.
Frequently asked questions
What is the manage-mounts skill?
It is an agent skill for NanoClaw that lets an agent view, add, or remove entries in the mount allowlist. The allowlist controls which host folders NanoClaw agent containers can access.
Do I need NanoClaw to use this skill?
Yes. The skill only configures NanoClaw containers, so NanoClaw must be installed with its setup script. It is not useful for other tools.
How do I install the manage-mounts skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
Is manage-mounts free and what licence does it use?
The source lists the licence as MIT. This page does not state any price, so check the directory listing for current availability.
Should agents get read-only or read-write access?
Read-only is the safer default and should be your choice unless the agent must write files. Avoid read-write access to home directories, SSH keys, or credential stores.
Do changes apply immediately?
The allowlist is read when a container is spawned, so new containers use it automatically. For a group with a container already running, restart that group with ncl groups restart.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use manage-mounts if you run NanoClaw and want precise control over which folders agents can reach, especially if you prefer read-only by default. Skip it if you do not use NanoClaw, since it only configures NanoClaw containers, or if you need to grant broad read-write access to sensitive folders.
Download the skill