Latest release: v2026.7.1Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The package purpose is to provide an ACP runtime backend for OpenClaw, and the artifacts consistently implement routing, session management, ACP adapter spawning, MCP bridge injection, and process cleanup for that purpose.
Instruction Scope
The skill routes explicit harness and ACP requests and includes fallback direct-acpx flows; some trigger wording is broad, so ambiguous requests should be confirmed by the user or host policy before routing.
Install Mechanism
The package is an official @openclaw npm-pack with pinned dependencies and no package lifecycle scripts observed; repair instructions can run a plugin-local pinned npm install and wrapper fallback can use npm/npx for pinned ACP adapter packages if local binaries are missing.
Credentials
Starting external coding harnesses, passing environment variables to child processes, and optionally enabling MCP bridges are proportionate to an ACP runtime, with dangerous permission mode and secret env paths declared in the manifest.
Persistence & Privilege
The runtime writes plugin-owned state, wrappers, logs, process leases, and an isolated Codex home; it reads selected Codex config/auth inputs and redacts diagnostics, which is expected but sensitive.
Scan Findings in Context
[SQP-1] expected: The broad routing language is tied to harness/ACP continuation and relay use cases, so it is purpose-aligned; ambiguity remains only for vague requests without a named harness.
[SQP-2] expected: The automatic repair path is disclosed, pinned, and plugin-local, with global install avoided; it is still a local mutation users should understand before relying on automatic repair.
Assessment
Install if you want OpenClaw to manage ACP-backed coding-agent sessions. Review permissionMode, MCP bridge settings, configured agent commands, and mcpServers env values first, because enabled bridges or approve-all permissions can give spawned agents significant access. Expect local state and isolated Codex auth/config files under the plugin state directory, and be aware repair flows may install pinned local ACPX components and ask to restart the Gateway.dist/mcp-proxy.mjs:100
Shell command execution detected (child_process).
dist/service-CzJr7Koj.js:580
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
@openclaw/acpx
Official ACP runtime backend for OpenClaw.
ACPx lets OpenClaw run external coding harnesses through the Agent Client Protocol while OpenClaw still owns sessions, channels, delivery, permissions, and Gateway state.
Install
openclaw plugins install @openclaw/acpx
Restart the Gateway after installing or updating the plugin.
What it provides
- ACP-backed agent runtime sessions.
- Plugin-owned session and transport management.
- MCP bridge helpers for OpenClaw tools and plugin tools.
- Static runtime assets used by the ACP process bridge.
Configure
Use the ACP docs for harness-specific setup, permission modes, and model/runtime selection:
Package
- Plugin id:
acpx - Package:
@openclaw/acpx - Minimum OpenClaw host:
2026.4.25