@adcp/sdkBLOCK
A Typescript SDK for the AdCP protocol (client and server)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://badge.fury.io/js/@adcp%2Fsdk) [](https://www.npmjs.com/package/@adcp/sdk) [](https://www.apache.org/licenses/LICENSE-2.0) [](https://www.typescriptlang.org/) [](https://adcontextprotocol.github.io/adcp-client/api/) [](https://github.com/adcontextprotocol/adcp-client/actions)
Official TypeScript/JavaScript SDK for the Ad Context Protocol (AdCP). Use its buyer client to call agents, server framework to build them, and conformance tools to test them. The SDK supports MCP and A2A, with both immediate and asynchronous task results.
For AI Agents
Start with docs/llms.txt — the full protocol spec in one file (tools, types, error codes, examples). Building a server? See docs/guides/BUILD-AN-AGENT.md. Calling an AdCP agent as a buyer? Load skills/call-adcp-agent/SKILL.md — wire contract, async flow, and error-recovery priors that aren't in the type signatures. Setting up request signing? See docs/guides/SIGNING-GUIDE.md. For type signatures, use docs/TYPE-SUMMARY.md. Skip src/lib/types/*.generated.ts — they're machine-generated and will burn context.
These docs are also available in node_modules/@adcp/sdk/docs/ after install.
The Core Concept
AdCP operations are distributed and asynchronous by default. An agent might:
- Complete your request immediately (synchronous)
- Need time to process and **
190ef4efa848OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add reference-renderers --env A2A_AUTH_TOKEN=${A2A_AUTH_TOKEN} --env ADCP_ACCOUNT_FEED_TRAINING_TOKEN=${ADCP_ACCOUNT_FEED_TRAINING_TOKEN} --env ADCP_AUTH_SCHEME=${ADCP_AUTH_SCHEME} --env ADCP_AUTH_TOKEN=${ADCP_AUTH_TOKEN} -- npx -y @adcp/[email protected]{
"mcpServers": {
"reference-renderers": {
"command": "npx",
"args": [
"-y",
"@adcp/[email protected]"
],
"env": {
"A2A_AUTH_TOKEN": "${A2A_AUTH_TOKEN}",
"ADCP_ACCOUNT_FEED_TRAINING_TOKEN": "${ADCP_ACCOUNT_FEED_TRAINING_TOKEN}",
"ADCP_AUTH_SCHEME": "${ADCP_AUTH_SCHEME}",
"ADCP_AUTH_TOKEN": "${ADCP_AUTH_TOKEN}"
}
}
}
}Exposed tools (92)
84 read · 8 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
A | read | A |
Banner | read | Standard banner |
Custom | read | hand-written |
Demo | read | ... |
Dropped | read | No canonical mapping |
Exotic | read | requires something unknown |
Feed | read | Main feed placement |
Homepage | read | Serializable route fixture |
Mixed | read | One known and one custom legacy ref |
N | read | D |
Native | read | v2 native |
Nested | read | Nested placement formats |
Partial | read | One canonical mapping remains |
Precedence | read | Direct publisher wins |
Seller | read | Seller |
Symmetry | read | MCP+A2A validation symmetry |
T | read | t |
Test | read | Test product |
Unrelated | read | Same id, different owner |
a2a-stand-in | read | A2A operation-resolution stand-in |
another_op | read | AdCP op |
b | read | d |
bidi-override-neutralized | read | Unicode bidi override characters (U+202E, U+2066-U+2069) in catalog values can spoof audit-log rendering. The unreserved-whitelist rule percent-encodes them as their UTF-8 bytes. |
canonical_mcp_delivery_envelope | read | Accepts a complete MCP webhook envelope with a delivery report nested under result. |
check_governance | read | |
comply_test_controller | read | |
conformance-fixture-agent | read | card fixture |
create_media_buy | write | |
crlf-injection-neutralized | write | A catalog value containing CR/LF would enable request-header smuggling or log-row injection in downstream consumers. The unreserved-whitelist rule escapes both bytes, defeating the vector. |
custom_hanging | read | |
deadline-a2a | read | deadline fixture |
dispatched | read | |
docs-writer | write | Write or revise AdCP documentation and walkthroughs while preserving schema accuracy, fictional examples, and character consistency. |
echo | read | |
error | read | |
foo | read | |
g | read | d |
get_adcp_capabilities | read | |
get_media_buy_delivery | read | |
get_plan_audit_logs | read | |
get_principal | read | Authenticated as ${echoed} |
get_products | read | |
get_property_list | read | Fetch a property list by id. |
get_reporting_status | read | |
get_signals | read | |
get_task_status | read | |
large_result_tool | read | |
large_schema_tool | read | |
legacy | read | |
legacy-conformance-fixture-agent | read | legacy card fixture |
list_creative_formats | read | Creative Formats |
list_creatives | read | Creatives |
list_products | read | |
list_tasks | read | |
m | read | d |
mixed-path-and-query-contexts | read | Verifies encoding applies equally to path segments and query strings within the same URL. |
n | read | d |
native | read | |
nested-expansion-preserved-as-literal | read | A catalog value containing AdCP macro syntax |
non-ascii-utf8-percent-encoding | read | Non-ASCII octets MUST be percent-encoded after UTF-8 encoding per RFC 3986 §2.5. A value containing |
observe_auth | read | |
opts | read | |
p | read | x |
path-scoped-agent | read | card fixture |
ping | read | health |
platform | read | |
protocol-reviewer | read | Review protocol, schema, and documentation changes for correctness, workflow regressions, versioning mistakes, and missing tests. |
provenance-fixture-agent | read | card fixture |
refine_proposals | read | |
reject_bare_delivery_result | write | Rejects delivery report content sent directly as the top-level POST body. |
reject_invalid_signature | read | Rejects a request whose signature does not cover the exact raw request body. |
reject_mismatched_signature_target | read | Rejects a valid signature that covers a different webhook target URI. |
reject_missing_envelope_fields | read | Rejects an MCP-like envelope missing required transport fields. |
reject_stale_signature_timestamp | read | Rejects a request whose signature timestamp is outside the allowed freshness window. |
reject_unsupported_status | read | Rejects malformed top-level async task status values. |
report_plan_outcome | read | |
reserved-character-breakout | read | A catalog value containing |
retry_preserves_idempotency_key | read | Accepts a retry of the same logical event with the same idempotency_key. |
routed-a2a | read | transport fixture |
rpc-only | read | rpc only |
sample | read | |
seller | read | seller |
signing-a2a-stub | read | A2A stub for request-signing integration tests |
sync_accounts | write | |
sync_creatives | write | |
sync_plans | write | |
tasks_get | read | |
tenant-card | read | tenant scoped card |
test | read | test |
unsigned_op | read | |
update_media_buy | write | |
url-scheme-injection-neutralized | read | A catalog value containing |
Trust audit
BLOCKgrade F · trust 37/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (12 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
server-payload-aliases.ts
server-payload.ts
result = await exec(executable, argv, { cwd: output, timeout, maxBuffer: 4 * 1024 * 1024 });const exportResult = await exec(
const installed = await exec(python, ['-I', path.join(here, 'verify.py'), packageRoot, archive, wheel], {eval(script: string, options: { keys: string[]; arguments: string[] }): Promise<unknown>;eval(script: string, options: { keys: string[]; arguments: string[] }): Promise<unknown>;'metadata.google.internal',
'metadata.google.internal',
origin = Path(importlib.import_module(name).__file__).resolve()
module = importlib.import_module(name)
console.log(`${prefix} ↳ (no token / opaque token)`);console.log(`\n🔍 Discovering OAuth token endpoint from ${url}...`);console.log(` Found token endpoint host: ${endpointHost}`);console.log(`Token URL: ${resolvedOauthEndpoint}${oauthEndpoint ? '' : ' (discovered)'}`);console.log(`✅ Token exchange succeeded (expires_in: ${tokens.expires_in ?? 'unspecified'})\n`);callback_url TEXT NOT NULL,
callback_url,
callbackUrl: requiredString(row, 'callback_url'),
agent_id, operation_id, agent_url, protocol, task_type, callback_url,
agent_url, protocol, task_type, callback_url, method, mode,
SALES_AGENTS_CONFIG='{"agents": [{"id": "test_mcp_local", "name": "Local Test MCP Server", "agent_uri": "http://127.0.0.1:3001/mcp", "protocol": "mcp", "requiresAuth": false}, {"id": "demo_agent_a2a",adcp grade request-signing http://127.0.0.1:3000/mcp --allow-http --skip-rate-abuse
report.fail('S', 'check', 'failed with postgres://user:hunter2@host/db and ya29.token-value and hunter2');token: 'irrelevant-for-this-test',
Gates applied: no_behavioural_pass.
190ef4efa848full audit observations/trust-audit/mcp-server/adcontextprotocol__adcp-client.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 190ef4efa848 | BLOCK | F | 37 | first audit |
Questions
What is the @adcp/sdk MCP server?
A Typescript SDK for the AdCP protocol (client and server)
What tools does @adcp/sdk expose?
92 in total: 84 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @adcp/sdk safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (37/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @adcp/sdk need?
It reads A2A_AUTH_TOKEN, ADCP_ACCOUNT_FEED_TRAINING_TOKEN, ADCP_AUTH_SCHEME, ADCP_AUTH_TOKEN, ADCP_AUTH_TOKEN_CROSS_TENANT, ADCP_CONFORMANCE_TOKEN, ADCP_GRADE_INITIALIZE_AUTHORIZATION, ADCP_INTEROP_BUYER_TOKEN, ADCP_LOG_IDEMPOTENCY_KEYS, ADCP_PRIV_KEY, ADCP_REGISTRY_API_KEY and ADCP_TEST_AUTH_MODULE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @adcp/sdk run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @adcp/reference-renderers at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (190ef4efa848), read on 2026-10-12. The repository is watched and re-audited when it changes.