
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
agy-acp-bridge
Advanced tools
Custom Agent Client Protocol adapter for Google Antigravity CLI using native JSON output
Agent Client Protocol (ACP) adapter bridge for the Google Antigravity CLI (agy) built on native JSON-stream output.
Unlike older adapters that rely on polling and parsing local SQLite database states (StreamPoller), this adapter uses agy's native --output-format stream-json print mode. It is entirely event-driven, streaming message chunks and tool states in real-time.
Install globally via npm:
npm install -g agy-acp-bridge
If the official Antigravity CLI (agy) is not already installed, the npm
package downloads and runs Google's installer for the current platform. The
official installer selects the latest release and verifies its SHA-512 checksum
before installing it. Existing agy installations are left in place because
the CLI keeps itself up to date.
The bridge does not redistribute Google's platform binaries inside the npm
tarball. To install only the ACP bridge (for example in an offline build or when
provisioning agy separately), disable the automatic installer:
AGY_ACP_SKIP_CLI_INSTALL=1 npm install -g agy-acp-bridge
On Windows PowerShell:
$env:AGY_ACP_SKIP_CLI_INSTALL = "1"
npm install -g agy-acp-bridge
If agy is installed in a non-standard location, point the bridge at it with
AGY_ACP_COMMAND=/absolute/path/to/agy.
To customize the CLI prompt execution timeout (default: 30m to prevent premature stream cutoffs on long tasks), pass --print-timeout <duration> or set AGY_ACP_PRINT_TIMEOUT=<duration>:
AGY_ACP_PRINT_TIMEOUT=1h agy-acp
Or run directly via npx:
npx agy-acp-bridge
agy's stdout.stdio, sse, http), dynamically synced into <cwd>/.agents/mcp_config.json.agy's --conversation <id> context and persists them under ~/.agy-acp-state.json. Supports session/new, session/load, session/resume, session/list, and session/delete.session/cancel by terminating active sub-processes using SIGINT.stderr to avoid polluting the JSON-RPC pipe.--dangerously-skip-permissions or --sandbox) to child processes.npm install
npm run build
Add the adapter as a custom agent in your Zed settings.json:
{
"agent_servers": {
"Google Antigravity": {
"command": "agy-acp",
"args": [
"--dangerously-skip-permissions"
]
}
}
}
Or using npx:
{
"agent_servers": {
"Google Antigravity": {
"command": "npx",
"args": [
"agy-acp-bridge",
"--dangerously-skip-permissions"
]
}
}
}
[!NOTE] Since the adapter runs the CLI in headless print mode (
--dangerously-skip-permissionsis supplied. Alternatively, you can whitelist actions in your Antigravitysettings.jsonfile.
FAQs
Custom Agent Client Protocol adapter for Google Antigravity CLI using native JSON output
The npm package agy-acp-bridge receives a total of 64 weekly downloads. As such, agy-acp-bridge popularity was classified as not popular.
We found that agy-acp-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.