
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ACP (Agent Client Protocol) adapter for Droid - Factory's AI coding agent.
Use Droid from any ACP-compatible clients such as Zed!
/context)/compress)/sessions)npm install droid-acp
export FACTORY_API_KEY=fk-...
If you only need WebSearch via the built-in proxy + Smithery Exa MCP, a valid Factory key is not required (droid-acp injects a dummy key into the spawned droid process to satisfy droid's local auth gate).
# Default mode (stream-jsonrpc, supports custom models)
npx droid-acp
# Set initial reasoning effort (passes through to `droid exec --reasoning-effort`)
npx droid-acp --reasoning-effort high
# Enable experimental sessions/history helpers
npx droid-acp --experiment-sessions
# Native ACP mode (lighter, but no custom model support)
npx droid-acp --acp
Add to your Zed settings.json:
{
"agent_servers": {
"Droid": {
"type": "custom",
"command": "npx",
"args": ["droid-acp"],
"env": {
"FACTORY_API_KEY": "fk-your-api-key-here"
}
}
}
}
Using native ACP mode (no custom model support):
{
"agent_servers": {
"Droid Native": {
"type": "custom",
"command": "npx",
"args": ["droid-acp", "--acp"],
"env": {
"FACTORY_API_KEY": "fk-your-api-key-here"
}
}
}
}
Using a custom droid binary (e.g., patched version):
{
"agent_servers": {
"Droid Custom": {
"type": "custom",
"command": "npx",
"args": ["droid-acp"],
"env": {
"FACTORY_API_KEY": "fk-your-api-key-here",
"DROID_EXECUTABLE": "/path/to/custom/droid"
}
}
}
}
Enable WebSearch proxy (Smithery Exa MCP):
{
"agent_servers": {
"Droid WebSearch": {
"type": "custom",
"command": "npx",
"args": ["droid-acp"],
"env": {
"SMITHERY_API_KEY": "your_smithery_key",
"SMITHERY_PROFILE": "your_profile_id"
}
}
}
}
Enable experimental sessions/history (/sessions, session/list, session/load):
{
"agent_servers": {
"Droid Sessions (Experimental)": {
"type": "custom",
"command": "npx",
"args": ["droid-acp", "--experiment-sessions"]
}
}
}
| Command | Mode | Custom Models | Description |
|---|---|---|---|
npx droid-acp | stream-jsonrpc | ✅ Supported | Default, recommended |
npx droid-acp --acp | native ACP | ❌ Not supported | Lighter, direct pipe to droid |
Note: Native ACP mode (
--acp) has a limitation in droid where custom models configured in~/.factory/config.jsonare not recognized. Use the default stream-jsonrpc mode if you need custom models.
FACTORY_API_KEY - Your Factory API key (recommended for Factory-hosted features)
DROID_EXECUTABLE - Path to the droid binary (optional, defaults to droid in PATH)
DROID_ACP_FACTORY_DIR - Override Factory config dir (defaults to ~/.factory)
DROID_ACP_EXPERIMENT_SESSIONS - Enable experimental sessions/history features (same as --experiment-sessions)
DROID_ACP_REASONING_EFFORT - Initial reasoning effort passed to droid exec --reasoning-effort (optional)
DROID_DEBUG - Enable adapter debug UI output (raw tool inputs, websearch proxy status, raw events)
DROID_ACP_WEBSEARCH - Enable local WebSearch proxy. When unset, the proxy auto-enables if SMITHERY_API_KEY+SMITHERY_PROFILE or DROID_ACP_WEBSEARCH_FORWARD_URL is set (set to 0 to force disable).
DROID_ACP_WEBSEARCH_FORWARD_URL - Optional forward target for websearch (base URL or full URL)
DROID_ACP_WEBSEARCH_FORWARD_MODE - (Legacy) Forward mode for DROID_ACP_WEBSEARCH_FORWARD_URL (http or mcp, default: http). Prefer mcp: prefix in the forward URL.
DROID_ACP_WEBSEARCH_UPSTREAM_URL - Optional upstream Factory API base URL (default: FACTORY_API_BASE_URL, then FACTORY_API_BASE_URL_OVERRIDE, then https://api.factory.ai)
DROID_ACP_WEBSEARCH_HOST - Optional proxy bind host (default: 127.0.0.1)
DROID_ACP_WEBSEARCH_PORT - Optional proxy bind port (default: auto-assign an available port)
SMITHERY_API_KEY - Optional (recommended) Smithery Exa MCP API key (enables high-quality websearch)
SMITHERY_PROFILE - Optional Smithery Exa MCP profile id
Enable the built-in proxy to intercept POST /api/tools/exa/search and serve results from Smithery Exa MCP (recommended):
export SMITHERY_API_KEY="your_smithery_key"
export SMITHERY_PROFILE="your_profile_id"
npx droid-acp
To debug proxy wiring (shows proxyBaseUrl and a /health link in the ACP UI):
DROID_DEBUG=1 npx droid-acp
To forward WebSearch to your own HTTP handler instead:
DROID_ACP_WEBSEARCH_FORWARD_URL="http://127.0.0.1:20002" \
npx droid-acp
To forward WebSearch to an MCP endpoint (JSON-RPC tools/call), set:
DROID_ACP_WEBSEARCH_FORWARD_URL="mcp:http://127.0.0.1:20002" \
npx droid-acp
Notes:
GET /health on proxyBaseUrl (handy for troubleshooting).FACTORY_API_KEY into the spawned droid process if none is set, so WebSearch requests can reach the proxy even without Factory login.Accept-Encoding: identity upstream and strips content-encoding/content-length when proxying to avoid Brotli decompression errors in some client setups.This is an experimental feature. Enable with npx droid-acp --experiment-sessions (or set DROID_ACP_EXPERIMENT_SESSIONS=1).
droid-acp supports ACP session/list, session/load and session/resume, plus an in-thread workaround command:
/sessions: list/load sessions from local Droid history (useful because some clients don’t yet persist external ACP agent history)session/load: replays the full conversation history back to the clientsession/resume: resumes without replay (faster, but the client won’t get old messages from the agent)/sessions usage/sessions (or /sessions list) - list sessions for the current cwd (numbered)/sessions all - list recent sessions across all cwds (prefers the current cwd)/sessions <#> - load by index from the last list/sessions load <#> - load by index from the last list/sessions load <session_id_prefix> - load by id prefix (from the last list)/sessions load <session_id> - load by full session id/sessions load last - load the most recent session (from the last list)When loading:
--session-id (fast path).Notes:
~/.factory/sessions (override with DROID_ACP_FACTORY_DIR).<context ...> blocks, and tool calls/tool results.<context ref="session_history"> ...)./sessions are displayed as YYYY-MM-DD HH:mm:ss in your local timezone.--acp) does not support these helpers./context)Some ACP clients don’t expose Droid’s built-in token usage indicator UI. Use /context to print the last model call context indicator (matching Droid’s TUI). droid-acp reads this from ~/.factory/logs/droid-log-single.log.
Notes:
Total is computed as inputTokens + outputTokens + cacheReadTokens (matching Droid’s internal “lastTokenUsage”).max=200000 for Anthropic models, otherwise max=300000./compress, /compact)Droid’s built-in /compress is TUI-only. In stream-jsonrpc mode, droid-acp implements an equivalent workflow:
<summary>...</summary> of the current conversationNotes:
npx droid-acp --acp)./compress focus on current code changes and next steps.| Mode | Description | Droid autonomy level |
|---|---|---|
| Spec | Plan-only (read-only) | spec |
| Auto Off | Prompts before edits/commands (per-tool) | normal |
| Auto Low | Low-risk operations (basic file operations) | auto-low |
| Auto Medium | Development operations | auto-medium |
| Auto High | Production operations (dangerous) | auto-high |
src/acp/agent/ - ACP Agent implementation (sessions, prompts, slash commands)src/acp/notifications/ - Droid notifications → ACP updatessrc/acp/permissions/ - Permission prompts, diffs, and auto-approval logicsrc/acp/session/ - Session attach/restart helperssrc/websearch-proxy.ts - Optional local WebSearch proxysrc/acp-agent.ts - Public entry point (re-exports DroidAcpAgent, runAcp from src/acp/)# Install dependencies
npm install
# Build
npm run build
# Dev mode (watch)
npm run dev
# Lint
npm run lint
# Format
npm run format
# Check (lint + format)
npm run check
Apache-2.0
FAQs
ACP adapter for Droid - Factory's AI coding agent
The npm package droid-acp receives a total of 17 weekly downloads. As such, droid-acp popularity was classified as not popular.
We found that droid-acp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.