A2a Register

Register, deregister, and manage this OpenClaw instance as an A2A agent in the A2A API Gateway. Use when: (1) registering this instance so other agents can d...

Security Scan

The skill's scripts largely match the described purpose (registering an agent with an A2A gateway) but the package metadata and runtime behavior have a few mismatches that warrant caution before installing.

Purpose & Capability

Name/description (register/deregister/heartbeat/status) align with the included scripts which call the gateway admin API. The required binaries (curl, python3) are appropriate for the HTTP + small JSON parsing work the scripts perform.

Instruction Scope

Runtime instructions and scripts restrict network activity to the configured A2A gateway endpoints (/v0/admin/*). Scripts auto-detect local network addresses (tailscale, hostname -I) and read/write a shared config file at ../a2a-client/a2a.conf. That shared config file behavior is expected for an A2A sidecar, but it means the skill will write into a sibling skill directory (a2a-client), which you should confirm is intended in your environment.

Install Mechanism

No install spec; code is provided as plain shell/Python helpers. No downloads from external URLs or archive extraction — lowest install risk from this perspective.

Credentials

The scripts require A2A_GATEWAY_URL and optionally A2A_GATEWAY_API_KEY (and use other agent-related env vars), but the registry metadata did not declare required env vars or a primary credential. The missing metadata declaration is an inconsistency: these secrets/configs are necessary for the skill to function and the admin bootstrap call yields an admin JWT that the scripts then use to perform registry admin actions.

Persistence & Privilege

always:false (good). The skill writes/overwrites ../a2a-client/a2a.conf (shared config); this is expected behavior for sidecar coordination but does give the skill the ability to modify configuration used by other A2A skills. Agent-autonomous invocation is enabled by default (disable-model-invocation:false) — that is platform-default but increases blast radius if you enable this skill and it is untrusted.

What to consider before installing

This skill appears to do what it claims (registering/deregistering and heartbeating to a configured A2A gateway), but there are a few things to check before enabling it: - Confirm configuration flow: the scripts expect A2A_GATEWAY_URL (required) and may use A2A_GATEWAY_API_KEY. The registry metadata did not declare these env vars — make sure you supply them (or create ../a2a-client/a2a.conf) before running. - Review and accept the shared config behavior: a2a-setup.sh writes ../a2a-client/a2a.conf. Ensure that writing into that sibling directory is intentional and that the a2a-client skill on your system is the expected recipient of that config. - Understand the bootstrap/admin token: the scripts call GET /v0/admin/bootstrap and use the returned accessToken as an admin JWT to create/update/delete agents. Verify your gateway's bootstrap endpoint behavior (does it really provide an admin token without additional auth?) and whether you want an installed skill to use that token for admin operations. - Least privilege: run these scripts manually the first time (rather than enabling autonomous invocation) so you can observe exact network calls and confirm gateway responses. - If you do not control the gateway URL or are unsure about the gateway's trustworthiness, do not run the scripts while connected to untrusted networks; malicious/compromised gateway endpoints could return tokens that enable administrative changes. If you can confirm the gateway is trusted and you expect/permit the shared config write, this skill is coherent with its stated purpose. If not, treat it as untrusted and avoid enabling autonomous invocation or letting it overwrite a2a-client/a2a.conf.

A2A Register — Agent Registration Management

Register and manage this OpenClaw instance as an A2A agent in the A2A API Gateway. Other agents discover this instance through the gateway registry, so registration is required before receiving inbound tasks.

Sidecar Principle

This skill is strictly an OpenClaw sidecar — it uses the A2A API Gateway's existing admin API to register, deregister, heartbeat, and check status. The gateway's admin endpoints are the contract; OpenClaw is just a participant. Never assume what other registered agents look like or how they connect — they could be MC2, another OpenClaw, or anything else that speaks A2A. These scripts call the gateway's admin API as-is.

Configuration

All scripts read from a shared a2a.conf file (located in the a2a-client skill directory). The gateway URL must be configured — there are no hardcoded defaults.

Priority order: CLI flags → env vars → a2a.conf → auto-detected defaults

Setting	Auto-detected Default	Description
Gateway URL	none — required	A2A API Gateway URL (A2A_GATEWAY_URL)
Agent Name	hostname -s (lowercase)	Display name (AGENT_NAME)
Agent Slug	hostname -s (lowercase)	URL-safe identifier (AGENT_SLUG)
Agent URL	http://{Tailscale IP}:{port}	Agent endpoint (AGENT_URL)
Capabilities	chat,code,research	Comma-separated (AGENT_CAPABILITIES)
Auth Type	bearer	Auth method (AGENT_AUTH_TYPE)
API Key	empty	For listener auth (A2A_GATEWAY_API_KEY)

Quick Setup

# Interactive setup — creates a2a.conf for you
./a2a-setup.sh

# Non-interactive (env vars required)
A2A_GATEWAY_URL=http://GATEWAY_IP:8090 A2A_GATEWAY_API_KEY=your-key ./a2a-setup.sh --non-interactive

When to Use

• Setup — First time configuring this instance for A2A
• Register — When this OpenClaw instance needs to be discoverable by other A2A agents
• Deregister — When going offline or removing this instance from the gateway
• Heartbeat — Periodically signal that this instance is alive and reachable
• Status — Check whether this instance is registered and view its current configuration

Tools

a2a-setup.sh — Interactive Configuration

./a2a-setup.sh [--non-interactive] [--conf PATH]

Creates or updates the shared a2a.conf file. In interactive mode, prompts for all values with auto-detected defaults. In non-interactive mode, reads from environment variables.

# Interactive (recommended first time)
./a2a-setup.sh

# Non-interactive (for scripting)
A2A_GATEWAY_URL=http://GATEWAY_IP:8090 \
A2A_GATEWAY_API_KEY=your-key \
AGENT_SLUG=my-agent \
./a2a-setup.sh --non-interactive

register.sh — Register This Agent

./register.sh [--gateway-url URL] [--name NAME] [--slug SLUG] [--url URL] [--capabilities CAPS]

Registers this OpenClaw instance in the A2A API Gateway. The script:

1. Obtains a JWT via GET /v0/admin/bootstrap
2. Checks if the agent slug already exists (GET /v0/admin/agents)
3. If new → POST /v0/admin/agents to create it
4. If exists → PUT /v0/admin/agents/{id} to update it

Idempotent — safe to run multiple times.

# Register with defaults (from a2a.conf / auto-detected)
./register.sh

# Override specific values
./register.sh --name "My Agent" --slug my-agent --url http://MY_IP:8100

# Override gateway URL
./register.sh --gateway-url http://GATEWAY_LAN_IP:8090

deregister.sh — Remove This Agent

./deregister.sh [--gateway-url URL] [--slug SLUG]

Removes this OpenClaw instance from the gateway registry. Other agents will no longer be able to discover or route tasks to it.

./deregister.sh

heartbeat.sh — Send Liveness Signal

./heartbeat.sh [--gateway-url URL] [--slug SLUG]

Sends a heartbeat to the gateway (PATCH /v0/admin/agents/{id}/heartbeat) to signal that this instance is alive and reachable. Useful for cron jobs or periodic health checks.

# One-time heartbeat
./heartbeat.sh

# In a cron (every 5 minutes)
*/5 * * * * /path/to/skills/a2a-register/heartbeat.sh

status.sh — Check Registration Status

./status.sh [--gateway-url URL] [--slug SLUG]

Checks whether this OpenClaw instance is registered in the gateway and shows its current configuration (URL, capabilities, status).

./status.sh

Typical Workflow

1. Setup → ./a2a-setup.sh to create your a2a.conf
2. Register → ./register.sh to add this instance to the gateway
3. Start listener → Use a2a-server skill's start.sh to begin receiving tasks
4. Heartbeat → Run ./heartbeat.sh periodically (or set up a cron)
5. Status → ./status.sh to verify registration
6. Deregister → ./deregister.sh when going offline

Gateway API

Endpoint	Method	Purpose
/v0/admin/bootstrap	GET	Obtain admin JWT
/v0/admin/agents	GET	List all registered agents
/v0/admin/agents	POST	Register a new agent
/v0/admin/agents/{id}	PUT	Update an existing agent
/v0/admin/agents/{id}	DELETE	Remove an agent
/v0/admin/agents/{id}/heartbeat	PATCH	Signal liveness

Environment Variables

Variable	Description
A2A_GATEWAY_URL	Gateway URL (required if not in a2a.conf)
A2A_GATEWAY_API_KEY	API key for listener auth
AGENT_NAME	Agent display name
AGENT_SLUG	Agent identifier
AGENT_URL	Agent endpoint URL
AGENT_CAPABILITIES	Comma-separated capabilities
LISTENER_PORT	Listener port (default: 8100)