Latest release: v2026.9.2Download zip
Compatibility
Security Scan
OpenClaw
Suspicious
high confidenceCredentials
Local command execution, explicit cwd handling, Codex/Claude wrapper setup, Pi session catalog reads, and MCP bridge options are mostly proportionate to an ACP runtime, with defaults such as approve-reads and MCP bridges off reducing some exposure.
Install Mechanism
The normal plugin install is declared through @openclaw/acpx package metadata with pinned dependencies, but runtime/repair guidance can run npm install or npx-style package execution for pinned ACP adapters without first requiring explicit user confirmation.
Instruction Scope
The skill instructs automatic local repair when the ACP backend is unavailable, including installing plugin-local acpx, retrying spawns, and removing broken ~/.acpx/config.json agent overrides before fallback; this is operationally scoped but under-disclosed for user control.
Persistence & Privilege
The plugin starts on Gateway startup, creates plugin state, generated wrappers, isolated Codex home/config, process leases, session files, and can terminate validated OpenClaw-owned ACPX process trees; this is disclosed in code/metadata and tied to runtime lifecycle management.
Purpose & Capability
The package is an ACP runtime backend for OpenClaw and its core capabilities of spawning ACP harness sessions, managing session state, and relaying prompts to supported coding agents fit that purpose.
Scan Findings in Context
[SQP-2] expected: Verified in artifact/skills/acp-router/SKILL.md: the automatic plugin-local repair is purpose-aligned for keeping ACP thread spawns working, but the instruction to install immediately and not ask first unless policy requires it makes this a Review concern rather than a benign-only note.
[SQP-2] expected: Verified in artifact/skills/acp-router/SKILL.md: the direct acpx exec path is central to the telephone-game harness flow and uses fixed command templates with explicit cwd, so it is expected for the purpose, though users should understand it runs local CLI commands in their workspace.
What to consider before installing
Install only if you want OpenClaw to run and manage local ACP coding-agent sessions. Before enabling repair or direct acpx fallback, confirm any npm install, gateway restart, or ~/.acpx configuration change; also review Codex/Claude auth handling, Pi session catalog access, MCP bridge settings, and permissionMode before using it in sensitive workspaces.dist/mcp-proxy.mjs:100
Shell command execution detected (child_process).
dist/service-COMUTA5A.js:943
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
@openclaw/acpx
Official ACP runtime backend for OpenClaw.
ACPx lets OpenClaw run external coding harnesses through the Agent Client Protocol while OpenClaw still owns sessions, channels, delivery, permissions, and Gateway state.
Install
openclaw plugins install @openclaw/acpx
Restart the Gateway after installing or updating the plugin.
What it provides
- ACP-backed agent runtime sessions.
- Plugin-owned session and transport management.
- MCP bridge helpers for OpenClaw tools and plugin tools.
- Static runtime assets used by the ACP process bridge.
Configure
Use the ACP docs for harness-specific setup, permission modes, and model/runtime selection:
Package
- Plugin id:
acpx - Package:
@openclaw/acpx - Minimum OpenClaw host:
2026.4.25