LobsterLAN — Agent-to-Agent Communication
Talk to other OpenClaw agents on your LAN.
Setup
- 1. Copy
config/peers.example.json to INLINECODE1 - Fill in peer hostnames, ports, and tokens
- Ensure target agents have the required APIs enabled (see below)
- Set up a secure transport (see Network Transport below)
Required Config on Target Agent
For sync ask (chat completions):
CODEBLOCK0
⚠️ Do NOT set gateway.bind to "lan" — OpenClaw will refuse to start if the gateway is exposed on a non-loopback address without TLS. Use a secure transport instead (see below).
For async delegate (webhooks):
CODEBLOCK1
Network Transport
OpenClaw gateways default to bind: loopback and will not start with plaintext on non-loopback addresses. You need a secure transport layer for cross-host communication:
| Approach | Complexity | Best For |
|---|
| SSH Tunnel ⭐ | Low | Home LANs, simple setups |
| Reverse Proxy (TLS) |
Medium | Environments with existing Caddy/nginx |
|
Tailscale Serve | Medium | Multi-site or remote agents |
For simple LANs, SSH tunneling is recommended. Both gateways stay on loopback, the SSH tunnel provides encryption, and no gateway config changes are needed.
SSH Tunnel Example
Forward a local port to the remote agent's loopback gateway:
CODEBLOCK2
Then in peers.json, point the peer to 127.0.0.1:18790 (the local tunnel endpoint).
For persistence, use a systemd user service with Restart=always. See the full setup guide in docs/setup.md.
Commands
Ask (synchronous — wait for reply)
scripts/lobsterlan.sh ask scotty "What is the CPU temperature?"
Use for quick questions where you need the answer now.
Delegate (async — fire and forget)
scripts/lobsterlan.sh delegate scotty "Generate 5 zen wallpapers and push to the file share"
Use for long-running tasks. The peer processes independently.
Status check
CODEBLOCK5
List peers
CODEBLOCK6
Agent Usage (from within OpenClaw)
Run via exec tool:
CODEBLOCK7
Security
Three layers protect communication:
- 1. Network: LAN-only (firewall blocks external access to gateway port)
- Gateway token: Bearer auth on every request
- Agent ID header (optional):
X-LobsterLAN-Agent sent with self-ID
The gateway token is the real security boundary. The agent ID header is defense-in-depth for environments where you want explicit identity verification.
Environment Variables
- -
LOBSTERLAN_CONFIG — path to peers.json (default: ../config/peers.json relative to script)
LobsterLAN — 代理间通信
与局域网上的其他 OpenClaw 代理进行通信。
设置
- 1. 将 config/peers.example.json 复制为 config/peers.json
- 填写对等节点的主机名、端口和令牌
- 确保目标代理已启用所需的 API（见下文）
- 设置安全传输（见下文网络传输部分）
目标代理的必需配置
对于同步询问（聊天补全）：
jsonc
// 目标代理的 openclaw.json — 保持绑定为 loopback！
{
gateway: {
http: {
endpoints: {
chatCompletions: { enabled: true }
}
}
}
}
⚠️ 不要将 gateway.bind 设置为 lan — 如果网关在没有 TLS 的情况下暴露在非回环地址上，OpenClaw 将拒绝启动。请改用安全传输（见下文）。
对于异步委托（Webhook）：
jsonc
{
hooks: {
enabled: true,
token: 一个安全的共享密钥
}
}
网络传输
OpenClaw 网关默认使用 bind: loopback，不会在非回环地址上以明文方式启动。跨主机通信需要安全传输层：
| 方案 | 复杂度 | 最佳适用场景 |
|---|
| SSH 隧道 ⭐ | 低 | 家庭局域网，简单设置 |
| 反向代理（TLS） |
中 | 已有 Caddy/nginx 的环境 |
|
Tailscale Serve | 中 | 多站点或远程代理 |
对于简单的局域网，推荐使用 SSH 隧道。 两个网关都保持在回环地址上，SSH 隧道提供加密，且无需更改网关配置。
SSH 隧道示例
将本地端口转发到远程代理的回环网关：
bash
ssh -N -L 18790:127.0.0.1:18790 user@remote-agent-host
然后在 peers.json 中，将对等节点指向 127.0.0.1:18790（本地隧道端点）。
如需持久化，请使用带有 Restart=always 的 systemd 用户服务。完整设置指南请参见 docs/setup.md。
命令
询问（同步 — 等待回复）
bash
scripts/lobsterlan.sh ask scotty CPU 温度是多少？
用于需要立即得到答案的快速问题。
委托（异步 — 发送后即忘）
bash
scripts/lobsterlan.sh delegate scotty 生成 5 张禅意壁纸并推送到文件共享
用于长时间运行的任务。对等节点独立处理。
状态检查
bash
scripts/lobsterlan.sh status scotty
列出对等节点
bash
scripts/lobsterlan.sh peers
代理使用（在 OpenClaw 内部）
通过 exec 工具运行：
bash
cd ~/.openclaw/workspace/skills/lobsterlan && scripts/lobsterlan.sh ask scotty 状态报告
安全
三层保护通信：
- 1. 网络：仅限局域网（防火墙阻止外部访问网关端口）
- 网关令牌：每次请求的 Bearer 认证
- 代理 ID 头（可选）：X-LobsterLAN-Agent 随自身 ID 发送
网关令牌是真正的安全边界。代理 ID 头是在需要明确身份验证的环境中的纵深防御措施。
环境变量
- - LOBSTERLAN_CONFIG — peers.json 的路径（默认：相对于脚本的 ../config/peers.json）
