@agentclientprotocol/sdk

The Agent Client Protocol (ACP) is a protocol that standardizes communication between *code editors* (interactive programs for viewing and editing source code) and *coding agents* (programs that use generative AI to autonomously modify code).

Latest 1.8.0

NPM

86%

Total Score

healthy

Frequent releases, active source work, and verified publishing support this release; workflow permissions and missing security policy are the main gaps.

Are you affected? Scan for Free

Health Score Breakdown

Security policy

The repository has no security policy file, leaving vulnerability-reporting expectations less transparent despite the presence of Dependabot.

Workflow audit

Both workflows were analyzed and all 9 action references are pinned, with no untrusted checkouts or script injection. However, the publish workflow uses an app token with blanket installation permissions and installs a package outside the lockfile, while CI has top-level write permissions.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-632806 New @agentclientprotocol/sdk is vulnerable to Denial of Service (DoS) in versions 0.27.0 - 1.5.0.	0.27.0 - 1.5.0	Medium
AIKIDO-2026-96856 New @agentclientprotocol/sdk is vulnerable to Denial of Service (DoS) in versions 0.27.0 - 0.27.0.	0.27.0 - 0.27.0	High

Package versions

Maintainers

benbrandt

aguzubiaga

cirwin

Direct Dependencies

No direct dependencies.

86%

Total Score

healthy

Frequent releases, active source work, and verified publishing support this release; workflow permissions and missing security policy are the main gaps.

Are you affected? Scan for Free