ACP: open-source zero-trust layer for cross-owner AI agent tasks

ACP is aimed at a gap that appears once agents stop being a single user's local tool. Existing multi-agent frameworks and standards such as MCP and Google A2A, the author argues, run into three walls when used across different owners: credential exposure, session mix-ups with unverifiable isolation claims, and the need to open inbound ports or share VPNs.

The design answers each of those directly. Credentials stay on the host and are injected only at request time, so a memory dump or remote code execution inside a worker yields nothing. Both sides connect outward to a relay, so neither opens a listening port. And because the receipt signature binds the effective isolation level (subprocess, container, etc.), a worker that claims container isolation but runs as a subprocess is rejected at the verification gate.

Rather than resting on the claim that the design is safe, the release ships a red-team suite that runs five attack scenarios — environment dumps, shell injection payloads, relay eavesdropping, SSRF and one-byte contract tampering — and reports that all are blocked. A public relay on Cloudflare Workers plus AGENTS.md and SKILL.md files let Claude Code, Codex or Cursor attempt a signed delegation demo quickly.