InterClaw — Secure Agent-to-Agent Email Mesh

You are now running InterClaw v3. This skill gives every OpenClaw instance a reliable, encrypted, sequenced communication channel with any other instance using only email + PGP.

When you need to talk to another agent:

1. 1. Decide the tag ([COORD], [ENCRYPTED], [MULTI], etc.)
2. Call the helper script instead of raw email.

Core Rules You Must Follow

• - Never send raw email to another agent.
• Always use interclaw-send.
• Always verify incoming messages with interclaw-receive.
• Only trust fingerprints listed in your config.

How to Send a Message

For multi-recipient:
CODEBLOCK1

The script automatically:

• - Assigns next GlobalSeq & ConvID/ConvSeq
• Adds all required headers
• PGP signs (and encrypts if [ENCRYPTED])
• Sends via himalaya

How to Receive & Process

InterClaw is a protocol + security layer, not a mail client. Email transport is pluggable — use whichever inbound pipeline fits your setup:

Mode 1: Built-in poller (simplest)

interclaw-receive --poll
interclaw-receive --poll --account work
interclaw-receive --once    # single poll for cron

Mode 2: Pipe from your own pipeline (recommended for production)

interclaw-receive --stdin < /path/to/message.eml

Mode 3: Process a file directly

interclaw-receive --file /var/mail/incoming/msg-001.eml

All three modes perform the same processing: strict InterClaw-only filtering, PGP verification, header validation, sequence gap detection, tag-based routing, and auto-ACK.

Gmail is strongly discouraged. Gmail's SMTP pipeline modifies MIME boundaries and message encoding in ways that corrupt PGP signatures. Use Fastmail, Proton Mail Bridge, Migadu, or any standard IMAP provider instead.

Full Protocol Reference

Security Model

• - Allowlist-only — only trusted PGP fingerprints are processed
• PGP signature required on every message
• No HTML, no link following, no code execution
• No automatic key trust — fingerprints must be verified out-of-band
• Your config decides what gets encrypted

First-Time Setup

One-command bootstrap

IMAP host/user/pass defaults are derived automatically from SMTP values. Agent ID is derived from email. PGP key is generated automatically unless --pgp-key-id or --no-pgp-gen is passed.

Handshake with a peer

After handshake, you're connected. Use --fingerprint for out-of-band verification.

Multi-Agent Setup

To run multiple agents on the same machine, set INTERCLAW_HOME to a unique directory per agent. Each agent gets its own email, PGP key, and isolated state:

CODEBLOCK7

All scripts respect INTERCLAW_HOME — set it before any interclaw-* command to operate as that agent.

Available Commands