Remote ACP Bridge: letting websites use a user's local ACP agent, with local consent and permissions

[brstic]

Hi all 👋 I've been building Remote ACP Bridge, an open-source (Apache-2.0) desktop app that connects local ACP agents to websites the user explicitly approves. It currently supports Codex via codex-acp and Claude Code via claude-agent-acp. I'd love feedback from people who know ACP well.

The idea: ACP stays local, over stdio, between the desktop app and the agent. A website never speaks raw ACP. It gets a small, allowlisted task API through an outbound-only relay: start a task, stream sanitized session/update events, cancel. The desktop mediates everything:

• per-site consent (verified domain, one project folder, read-only or "can edit" access)
• per-task approval
• session/request_permission is always answered locally; the website can only observe it
• sessions are switched to restricted modes (read-only / default), and permissive modes are never selected
• an output firewall stops the task if a tool call touches paths outside the project folder. I added this after finding that adapters read files with their own tools rather than fs/*, and that Codex's read-only mode can read the whole disk.

Websites can also pass systemPrompt (append mode) and their own mcpServers (HTTP, restricted to the site's verified domain). That enables things like the flagship example: an issue tracker with "Fix with my agent". The user's own agent fixes the bug locally, runs the tests, and reports back through the tracker's MCP tools.

Repo: https://github.com/brstic/remote-acp

Things I'd especially value input on:

1. Is there interest in a standard "remote/delegated client" pattern like this, versus raw ACP over WebSocket?
2. Mapping website-supplied instructions onto systemPrompt: is append mode the right default?
3. Any adapter behaviours I should account for (modes, permission kinds, auth) beyond codex-acp and claude-agent-acp?

Thanks for ACP, it made this possible.