NVIDIA/NeMo-Relay

Review signals: 4 download and execute, 15 known vulnerability. 8 static matches retained as context.

Source contains download and execute; review its purpose. 2 distinct locations. 4 findings.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 15 findings.

1 download and execute matches retained as context; full list in the evidence.

7 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The transparent wrapper starts a local Relay gateway and injects host-specific hook settings for the launched agent process: Real input produced the expected result: argv = claude --plugin-dir <temporary-claude-plugin-dir>

  Source: The transparent wrapper starts a local Relay gateway, injects host-specific hook

  Input: nemo-relay run --agent claude --dry-run --print

  Expected: plan shows a temporary Claude Code plugin directory and settings

  Command: <guest-path> run --agent claude --dry-run --print

  Observed: argv = claude --plugin-dir <temporary-claude-plugin-dir> --settings <temporary-claude-settings> env.NEMO_RELAY_GATEWAY_URL = http://127.0.0.1:33501 env.NEMO_RELAY_TRANSPARENT_RUN = 1 env.PATH = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:<guest-path> env.NEMO_RELAY_PROXY_CREDENTIAL = <redacted> env.ANTHROPIC_CUSTOM_HEADERS = <redacted> env.ANTHROPIC_BASE_URL = http://127.0.0.1:33501 note = would generate a temporary Claude Code plugin directory

Examples

• Embedded diagnostics reader example runs through the Python binding: command completed successfully with no output

  Source: examples/diagnostics/README.md

  Input: examples/diagnostics/python.py

  Expected: exit 0 with internal assertions passing (silent)

  Command: <guest-path> examples/diagnostics/python.py

• Node.js diagnostics example: Node example needs the nemo-relay-node binding built from source and Node.js 24.13.1 or newer per README; guest has Node v22.23.4 and no build was done, so it was not run

  Source: examples/diagnostics/README.md

  Expected: documented command completes successfully

  Observed: Node example needs the nemo-relay-node binding built from source and Node.js 24.13.1 or newer per README; guest has Node v22.23.4 and no build was done, so it was not run

Local or hosted: both

Install the NeMo Relay CLI from PyPI and run its documented transparent-wrapper launch plan (nemo-relay run --agent claude --dry-run --print); run the documented Python diagnostics example.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git status 2>&1 | head -3) && ls <guest-path> /inputs 2>&1 | head -20
cd <guest-path> && cat README.md 2>/dev/null | head -c 7000
cd <guest-path> && tail -c +7000 README.md | head -c 8000
cd <guest-path> && ls .coldpass; cat <guest-path> | head -c 3000; echo; curl -s -m 10 -i $CDP_URL/json/version | head -20; echo "rc=$?"; python3 -m pip --version; which cargo rustc uv node npm 2>&1
mkdir -p <guest-path> && cd <guest-path> && (python3 -m venv <guest-path> 2>&1 || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv ><guest-path> 2>&1; python3 -m venv <guest-path>)) && <guest-path> --version && <guest-path> install -q --upgrade pip 2>&1 | tail -3; echo done
cd <guest-path> && timeout 900 <guest-path> install nemo-relay-cli-bin 2>&1 | tail -8; echo "rc=${PIPESTATUS[0]}"; ls <guest-path> | grep -i relay
cd <guest-path> && export PATH=<guest-path> && nemo-relay --version; nemo-relay --help 2>&1 | head -60
cd <guest-path> && export PATH=<guest-path> && nemo-relay run --help 2>&1 | head -40; echo ---; nemo-relay agents 2>&1 | head -20; echo ---; ls examples; ls python | head; grep -n "nemo-relay run\|plugins.toml\|--config" README.md | head
cd <guest-path> && find examples -maxdepth 2 | head -60; echo ---; ls python/nemo_relay python/tests | head -40; echo ---; grep -n "pytest\|python -m\|uv run" justfile | head -20
cd <guest-path> && cat examples/diagnostics/README.md | head -c 5000; echo; echo ---; grep -n "" examples/diagnostics/python.py | head -60
cd <guest-path> && timeout 900 <guest-path> install "nemo-relay==0.11.0" 2>&1 | tail -4; echo "rc=${PIPESTATUS[0]}"; <guest-path> -c "import nemo_relay,sys;print(nemo_relay.__file__)" 2>&1 | tail -1
cd <guest-path> && <guest-path> examples/diagnostics/python.py; echo "rc=$?"
cd <guest-path> && export PATH=<guest-path> && export HOME=${HOME:-<host-path>; echo HOME=$HOME; nemo-relay run --agent claude --dry-run --print 2>&1 | head -30; echo "rc=$?"; nemo-relay doctor --offline 2>&1 | head -40
cd <guest-path> && grep -rn -i "interval\|cron\|--once\|webhook\|sleep(" python/nemo_relay/*.py | head -8; echo ---; grep -n "injects host-specific hook\|The transparent wrapper starts a local Relay gateway\|Install the prebuilt CLI from PyPI\|Run the Relay wrapper for the host CLI" README.md; echo ---; node --version; <guest-path> -c "import json" && echo ok
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","run","--agent","claude","--dry-run","--print"],"cwd":"<guest-path>","expected_text":"argv = claude --plugin-dir <temporary-claude-plugin-dir>"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The transparent wrapper starts a local Relay gateway and injects host-specific hook settings for the launched agent process","source":"The transparent wrapper starts a local Relay gateway, injects host-specific hook","input":"nemo-relay run --agent claude --dry-run --print","expected":"plan shows a temporary Claude Code plugin directory and settings","probe_kind":"cli","argv":["<guest-path>","run","--agent","claude","--dry-run","--print"],"cwd":"<guest-path>","expected_text":"argv = claude --plugin-dir <temporary-claude-plugin-dir>"}]
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool claims.json >/dev/null && echo valid
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Embedded diagnostics reader example runs through the Python binding","source":"examples/diagnostics/README.md","input":"examples/diagnostics/python.py","expected":"exit 0 with internal assertions passing (silent)","argv":["<guest-path>","examples/diagnostics/python.py"],"cwd":"<guest-path>","env":{}},
{"kind":"example","claim":"Node.js diagnostics example","source":"examples/diagnostics/README.md","reason":"Node example needs the nemo-relay-node binding built from source and Node.js 24.13.1 or newer per README; guest has Node v22.23.4 and no build was done, so it was not run"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (nemo-relay CLI help, run/daemon/gateway commands, python/nemo_relay). The only periodic mechanism is the observability exporter timer export_interval_millis in python/nemo_relay/observability.py, which requires a configured exporter endpoint and is not a documented run-once/cron entry point; no README-documented product cycle was triggered.","checks":[]}
EOF
for f in examples.json cycles.json; do python3 -m json.tool $f >/dev/null && echo "$f valid"; done
cd <guest-path> && <env-var>=<guest-path> PATH=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 6000; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install the NeMo Relay CLI from PyPI and run its documented transparent-wrapper launch plan (nemo-relay run --agent claude --dry-run --print); run the documented Python diagnostics example.","operation_scope":"Linux x86_64 guest, Python 3.12.3 venv at <guest-path>, nemo-relay-cli-bin 0.11.0 and nemo-relay 0.11.0 from PyPI. Not covered: a live Claude Code or Codex session (host agents not installed, no credentials), ATOF/ATIF output from a real agent run, and the Node.js example.","steps":["Checked CDP endpoint: GET $CDP_URL/json/version returned HTTP 200 (Chrome/155.0.8059.84). Not needed for this CLI product.","python3 -m venv <guest-path> (Python 3.12.3)","pip install nemo-relay-cli-bin (installed 0.11.0)","nemo-relay --version -> nemo-relay 0.11.0","nemo-relay run --agent claude --dry-run --print (README Quick Start CLI step 3 wrapper; dry run, no agent launched)","pip install nemo-relay==0.11.0 (README Python API extra equivalent)","python examples/diagnostics/python.py (documented in examples/diagnostics/README.md) -> exit 0"],"deviations":["Used absolute venv paths (<guest-path>) instead of a global nemo-relay on PATH.","Ran the agent wrapper with --dry-run --print because the host agents claude/codex/pi are not installed in the guest and no credentials were available; a real agent run and its ATOF/ATIF files were not produced.","Ran examples/diagnostics/python.py with the venv interpreter instead of 'uv run python' (uv sync would rebuild the project).","Node example examples/diagnostics/node.cjs not run: needs nemo-relay-node built from source and Node.js 24.13.1+, guest has v22.23.4.","The /inputs/coldpass-preflight.py path does not exist in this guest; used <guest-path> instead.","No git metadata init was needed; the snapshot in the workspace was used as provided."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"For full evidence, install Claude Code or Codex in the guest and provide credentials, then run nemo-relay claude/codex through the wrapper and check .nemo-relay/atof/events.jsonl and .nemo-relay/atif/*.json as the README describes."}
EOF
python3 -m json.tool report.json >/dev/null && echo valid && ls -la <guest-path>