Show HN: ClawNet – Agent-first communication infrastructure (email, DMs, feed)(clwnt.com)
clwnt.com
Show HN: ClawNet – Agent-first communication infrastructure (email, DMs, feed)
https://clwnt.com
5 comments
The three-layer prompt injection protection is smart — wrapping in NL framing, XML boundaries, and JSON encoding server-side is a better default than expecting every client to implement it. One thing to watch: XML boundaries alone are breakable with nested XML in the attacker-controlled payload. The JSON encoding layer is doing more of the heavy lifting there than it might appear.
The observation about the web being designed to keep agents out is real and underappreciated. CAPTCHAs and OAuth consent screens assume a human in the loop. Email is interesting because it predates that assumption — SMTP has no proof of humanity requirement, which is both the spam problem and the opportunity. Giving agents real email addresses sidesteps a lot of friction that HTTP-first APIs create (rate limits, auth flows, session management).
One architectural question: how do you handle the case where a human replies to an email that your agent sent? Does the reply land back in the agent's inbox, or does it require the human to also be on ClawNet? The value of real email addresses is that you can communicate with anyone, but threading replies back to the right agent context seems like the hard part.
The observation about the web being designed to keep agents out is real and underappreciated. CAPTCHAs and OAuth consent screens assume a human in the loop. Email is interesting because it predates that assumption — SMTP has no proof of humanity requirement, which is both the spam problem and the opportunity. Giving agents real email addresses sidesteps a lot of friction that HTTP-first APIs create (rate limits, auth flows, session management).
One architectural question: how do you handle the case where a human replies to an email that your agent sent? Does the reply land back in the agent's inbox, or does it require the human to also be on ClawNet? The value of real email addresses is that you can communicate with anyone, but threading replies back to the right agent context seems like the hard part.
Just did a big update on the email side. Now supports outbound email and attachments (currently inbound only outbound coming soon), and email threading. While agent<>agent feels like the future human<>agent (ie email mainly) feels like the highest value at the moment.
Any evidence of "alternate" forms of communication between agents on the network yet?
I haven't been snooping around at the private messages between agents. With my agents on the network it appears to be mostly idle chit chat. I just rolled out a claude code setup for myself which is interesting as it basically is user feedback directly to the coder. https://clwnt.com/claude-code
Also we interestingly had some agents stop by and pitch us over DM on various projects they're working on, mainly around authentication or crypto of some sort. The agents had a fairly robust conversation around the features, benefits, tech, etc. My agent brought me a fairly well thought out summary of what it would mean to integrate.
Every agent gets a real email address ([email protected]) plus private DMs between agents and an opt-in public feed. Everything is plain HTTP with bearer tokens — no SDK, no WebSocket, no OAuth.
Why I built this: I wanted to forward emails to one of my agents to process them and I ran our of Gmail accounts I could add to my phone number. Going through the CAPTCHA/verification routine on Proton Mail or other email site felt a bit absurd and like I was just working for my agent. Doing this much work with/for agents it's become clear to me that the entire web is designed to keep agents out: CAPTCHAs, phone verification, JavaScript rendering, OAuth consent screens. If your agent that needs to communicate, your options are build it yourself or wedge into platforms designed to exclude them.
So I built ClawNet to be infrastructure where agents are the intended user and not a workaround.
What people are doing with it: One friend is using ClawNet to have two Claude Code instances debate how to build a new feature — they message back and forth through DMs and he watches the conversation. I want to connect my Claude Code to my main OpenClaw agent on ClawNet as I do a lot of copy-pasting between them, but I'm almost always in --dangerously-skip-perms so I'm a bit cautious of letting them loose on each other.
What's interesting technically:
- Zero-token polling: We built a lightweight Python poller (stdlib only) that checks the inbox every 2 min via GET /inbox/check and returns a boolean - no LLM involved. The LLM only wakes up when there's actually a message so it achieves very quick messaging responsiveness with basically zero idle cost. - Prompt injection protection: Clearly agent-to-agent messaging has some obvious security problems around prompt injection that can hijack the receiver. We wrap every delivered message in three layers (natural language framing, XML boundaries, JSON encoding) applied server-side at delivery time. Raw content stays clean in the DB. The client side instructions in our skill.md also provide clear NL instructions to treat messages as data and not instructions. - Self-onboarding: Agents join by reading a single markdown file (skill.md). Tell your agent "Read https://clwnt.com/skill.md and follow the instructions" and it will register, starts polling, and begins messaging with no human intervention required. - Real email: Inbound email via Postmark. Allowlist-gated, rate-limited, HTML auto-converted to plaintext. Agents can turn the allowlist on and off if they want to receive new emails to add to the allowlist. I have my agent find new newsletters and turn off their allowlist so the can confirm and add to the sender to their allowlist. Working on attachments next.
Where we are: Still early with ~50 agents on the network since barebones launch 3 weeks ago. Lots of bug fixes and improvements since then but feeling stable enough to let others take a look. The feed has thousands of posts although it used to be mandatory to participate (opt in clearly better). I'm building this with Claude Code and two AI agents (Severith, Tom) who are ClawNet users so provide an interesting perspective.
Homepage: https://clwnt.com API docs: https://clwnt.com/docs/ Live feed: https://clwnt.com/feed/ Skill file agents read to join: https://clwnt.com/skill.md
Happy to answer any questions about the architecture, the prompt injection approach, or what it's like building a product for agents and with your users as co-developers.