Tutorial

OpenClaw v2026.3.31-beta.1: ACP/plugins, interface notes

March 31, 20264 min readUpdated September 11, 2026By OpenClawBlog Team

v2026.3.31-beta.1 changes a surface that users can see. The release record describes a skills, plugin, marketplace, or SDK change; this article follows the state behind the screen instead of treating a new button as proof that the workflow is complete.

Because this is a pre-release, use a disposable Gateway first and leave the stable version available for comparison. The release body cannot certify every local combination of provider, channel, platform, and account; use the bounded test below for the path you actually run.

Channel
Pre-Release

Primary signals
ACP/plugins; Agents/LLM; Agents/MCP

Publication date
2026-03-31

State that a reader can see

ACP/plugins

Evidence from the release. add an explicit default-off ACPX plugin-tools MCP bridge config, document the trust boundary, and harden the built-in bridge packaging/logging path so global installs and stdio MCP sessions work reliably.

Operator reading. Read ACP/plugins as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Agents/LLM

Evidence from the release. add a configurable idle-stream timeout for embedded runner requests so stalled model streams abort cleanly instead of hanging until the broader run timeout fires.

Operator reading. Agents/LLM changes a capability choice, not automatically a billing or privacy agreement. Record provider, model id, context setting, and fallback behavior before changing a default.

Agents/MCP

Evidence from the release. materialize bundle MCP tools with provider-safe names (serverNametoolName), support optional streamable-http transport selection plus per-server connection timeouts, and preserve real tool results from aborted/error turns unless truncation explicitly drops them.

Operator reading. Agents/MCP changes a capability choice, not automatically a billing or privacy agreement. Record provider, model id, context setting, and fallback behavior before changing a default.

Agents/OpenAI Responses

Evidence from the release. normalize raw bundled MCP tool schemas on the WebSocket/Responses path so bare-object, object-ish, and top-level union MCP tools no longer get rejected by OpenAI during tool registration.

Operator reading. The safe reading of Agents/OpenAI Responses is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

The wiring behind the screen

ACP/security

replace ACP's dangerous-tool name override with semantic approval classes, so only narrow readonly reads/searches can auto-approve while indirect exec-capable and control-plane tools always require explicit prompt approval.

Treat ACP/security as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

A bounded check for this version

Start with a disposable checkpoint: record the version, host, provider, and workspace tied to ACP/plugins.
Check the release's migration notes and make a restorable backup before changing persistent state.
Ask the same small question through the affected route and record the account, model id, context, and response time.
Compare the answer, tool permissions, and fallback behavior with the baseline before changing a default.
If the result differs from the release body, stop the rollout and attach the log, screenshot, or transcript to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Close the loop with evidence

A useful maintenance record names the changed behavior, the behavior that stayed stable, the identity that approved the test, and the step that would undo it. Preserve that record beside the release tag.

Edge cases in this tag

Agents/OpenAI Responses. normalize raw bundled MCP tool schemas on the WebSocket/Responses path so bare-object, object-ish, and top-level union MCP tools no longer get rejected by OpenAI during tool registration. Record the failure that this correction addresses before declaring the upgrade complete.

ACP/security. replace ACP's dangerous-tool name override with semantic approval classes, so only narrow readonly reads/searches can auto-approve while indirect exec-capable and control-plane tools always require explicit prompt approval. This is the edge case to include in a regression check, especially when the release is pre-release.

The authoritative record is the v2026.3.31-beta.1 GitHub release. The release index gives the surrounding sequence, while the skills documentation supplies the operational background.