agent_gatewayBLOCK
Let the coding agent you already use delegate work to Claude Code, Codex, and Grok on demand — a local MCP server and Agent Client Protocol (ACP) gateway with persistent sessions, interactive approvals, and crash-safe recovery. No predefined workflows.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 한국어 | 日本語 | 简体中文
[](https://www.npmjs.com/package/acp-gateway-daemon) [](https://github.com/creverse-ai-lab/agent_gateway/actions/workflows/ci.yml?query=branch%3Amain) [](LICENSE)
Let the coding agent you already use delegate work to Claude Code, Codex, and Grok on demand — over MCP + ACP, with persistent sessions, interactive approvals, and no predefined workflows.
ACP Gateway is a local daemon and Model Context Protocol (MCP) server: whichever of Claude Code, Codex, or Grok you talk to uses it to delegate work to the others, and to any other installed agent listed in the official Agent Client Protocol (ACP) registry.
Do you use more than one AI agent?
Do you ask Claude a question, have Codex fix the code, then hand the review to Grok — juggling terminals and conversations the whole time?
Have you ever thought, “Instead of directing each of these agents myself, I wish one agent would just put the others to work for me...”?
That is what this is for.
Overview
ACP Gateway is middleware that lets the AI you talk to directly — the orchestrator — discover the AI Workers installed on your machine, run them over ACP, and manage everything from long-running tasks and permission requests to retrieving the final result. Main, as used in the code and tool descriptions, means this orchestrator role.
- Claude Code, Codex, and Grok are supported as built-in Workers; other ACP-capable AIs installed locally are discovered by matching them against the official ACP registry.
- The daemon keeps ACP sessions and provider processes alive.
- Worker sessions can be recovered even when MCP restarts.
- The orchestrator controls models, permissi
ca5bcb715c0cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add acp-gateway-daemon --env ACP_GATEWAY_CONTROL_TOKEN=${ACP_GATEWAY_CONTROL_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"acp-gateway-daemon": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ACP_GATEWAY_CONTROL_TOKEN": "${ACP_GATEWAY_CONTROL_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}"
}
}
}
}Exposed tools (10)
7 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent_acp_answer | read | Answer, decline, or cancel a pending structured worker question. |
agent_acp_cancel | read | Request cancellation of the active prompt turn. |
agent_acp_config | write | List or set ACP session configuration options advertised by the Worker, such as model, mode, thought level, or boolean model settings. |
agent_acp_guide | read | Read ACP worker role, provider availability, and delegation restrictions. This tool cannot control agents. |
agent_acp_permission | read | Answer a pending permission request. |
agent_acp_poll | read | Poll status and final results with minimal token use; opt into progress evidence only when needed. |
agent_acp_prompt | write | Start a prompt in an owned worker session and immediately return its session/turn acknowledgement. |
agent_acp_session | read | List, inspect, check, close, or clean sessions owned by this Main. workspace_diff returns the patch from the original cwd to a snapshot session |
agent_acp_session_open | read | Open a worker ACP session owned by this Main. |
agent_acp_setup | write | Inspect and start a configured ACP provider through the persistent Gateway. Always surface non-empty health alerts to the user. |
Trust audit
BLOCKgrade D · trust 68/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (22)
bench-payload.js
return `http://127.0.0.1:${server.address().port}/`;token: "wrong-control-token-at-least-24-chars",
const TOKEN = "stdin-identity-control-token-at-least-24";
const wrongToken = clientFor(env, { token: "wrong-control-token-at-least-24-chars" });const token = "daemon-control-token-at-least-24";
const stored = { token: "stored-control-token-at-least-24", rootId: "main-stored" };bench-payload.test.js
payload-baseline.json
shasum: createHash("sha1").update(bytes).digest("hex")const DAEMON_PATH = fileURLToPath(new URL("../../src/gateway-daemon.js", import.meta.url));import { GatewayService } from "../../src/gateway-service.js";import { runInstaller as runRealInstaller } from "../../src/installer.js";import { decodeRecord, statePaths, WAL_TYPES } from "../../src/state-store.js";import { STATE_SCHEMA_VERSION } from "../../src/version.js";stdout: JSON.stringify(["agent-acp", "agent-acp-guide"].map((name) => ({ name, scope: "user", url: "http://127.0.0.1:9/mcp", enabled: true }))),`subscribe` with `taskIds` (1 to 100 task ids; full setup's `capabilities.taskSubscriptions` is `true` where it is supported) follows those tasks instead of sessions. Every id must name a task the cal
Control and Guide MCP registration supports Codex, Claude, Grok, and Auggie. In the default `--install-all`, Control is registered only with the one of Codex, Claude and Grok that the user selected as
- Like observer access, this is not a credential boundary against a process that holds the token.
`GatewayRpcClient({token, rootId, access: "control"|"observer", autoStart})` defaults to control for old consumers. Role is bound on the first authenticated request and cannot change on that connectioLike observer access, this is not a credential boundary: a process that holds the token can send any `caller`, or none. It keeps Mains that share a machine from reading, answering for, steering or cle
Like observer access, this is not a credential boundary: a process that holds the token and can start processes outside the daemon's tree is not stopped by it.
Gates applied: no_behavioural_pass.
ca5bcb715c0cfull audit observations/trust-audit/mcp-server/creverse-ai-lab__agent_gateway.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ca5bcb715c0c | BLOCK | D | 68 | first audit |
Questions
What is the agent_gateway MCP server?
Let the coding agent you already use delegate work to Claude Code, Codex, and Grok on demand — a local MCP server and Agent Client Protocol (ACP) gateway with persistent sessions, interactive approvals, and crash-safe recovery. No predefined workflows.
What tools does agent_gateway expose?
10 in total: 7 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is agent_gateway safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (68/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does agent_gateway need?
It reads ACP_GATEWAY_CONTROL_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent_gateway run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as acp-gateway-daemon at 1.9.0.
How current is this page?
The grade is for one exact copy of the source (ca5bcb715c0c), read on 2026-10-11. The repository is watched and re-audited when it changes.