Latest release: v2026.5.28Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The package purpose is an ACP runtime backend for OpenClaw, and the runtime/session management, MCP bridge support, subprocess launching, and process cleanup fit that purpose.
Instruction Scope
The router skill is scoped to ACP harness routing, but its recovery guidance includes plugin-local npm repair, gateway restart offers, and restoring ACPX defaults; these are operationally relevant but should remain user-directed.
Install Mechanism
The artifact is an official @openclaw package with pinned dependencies, no package lifecycle scripts in package.json, and VirusTotal reported 0 malicious and 0 suspicious detections.
Credentials
The runtime necessarily starts external coding harnesses, reads selected Codex configuration to generate an isolated CODEX_HOME, and writes session, lease, wrapper, and diagnostic state under configured state directories; this is proportionate for ACP integration but broad enough to review.
Persistence & Privilege
It persists gateway/session state and generated wrappers, logs redacted stderr tails, and can terminate OpenClaw-owned ACP process trees; no artifact-backed exfiltration or destructive broad deletion was found.
Scan Findings in Context
[suspicious.dangerous_exec] expected: Static scan flagged child_process usage; the reviewed uses are ACP harness spawning, process listing via ps, and cleanup of OpenClaw-owned ACP process trees, which are expected for this runtime.
[SQP-2] expected: The mcp-proxy executes a target command from an encoded payload without a shell; this is expected for an internal ACP proxy, though it relies on the host/runtime to keep that payload trusted.
[SQP-2] expected: The skill's plugin-local repair and pinned acpx install flow is purpose-aligned recovery behavior, but users should confirm before allowing package installs or gateway restarts.
[SQP-2] expected: The guidance to remove broken ~/.acpx/config.json agent overrides is recovery-oriented, but it could disrupt custom setups unless reviewed and backed up first.
Assessment
Install this only if you want OpenClaw to manage ACP-backed coding agent sessions. Review configured agents, MCP servers, permissionMode, and any repair action before allowing installs, restarts, or changes to ~/.acpx/config.json.dist/mcp-proxy.mjs:95
Shell command execution detected (child_process).
dist/process-reaper-CAUlLOkM.js:460
Shell command execution detected (child_process).
dist/service-BrT7jug3.js:118
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
@openclaw/acpx
Official ACP runtime backend for OpenClaw.
ACPx lets OpenClaw run external coding harnesses through the Agent Client Protocol while OpenClaw still owns sessions, channels, delivery, permissions, and Gateway state.
Install
openclaw plugins install @openclaw/acpx
Restart the Gateway after installing or updating the plugin.
What it provides
- ACP-backed agent runtime sessions.
- Plugin-owned session and transport management.
- MCP bridge helpers for OpenClaw tools and plugin tools.
- Static runtime assets used by the ACP process bridge.
Configure
Use the ACP docs for harness-specific setup, permission modes, and model/runtime selection:
Package
- Plugin id:
acpx - Package:
@openclaw/acpx - Minimum OpenClaw host:
2026.4.25