ZCode MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ZCode MCP Serverstart a ZCode session and have it fix the failing auth tests"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mnehmos.zcode.mcp
An MCP server that controls ZCode (the Z.ai / Zhipu desktop AI coding agent) programmatically.
Status: working. All 15 tools are implemented and dispatch through the MCP protocol, and a real agent turn runs end to end — one
zcode_chatcall creates a session, sends the prompt, and returns the answer. Two capabilities are declared limitations rather than bugs, because a bare agent runtime is a subset of what the desktop can do (see Capability boundaries below).Start with
specs/001-zcode-control/quickstart.md. The audit is inZCODE_*.md; corrections from a second pass are in.re/findings_ADDENDUM.md, which wins where they disagree.
What was found
ZCode is not a monolith and not a VS Code fork. It is three tiers: an Electron shell, a host/broker process, and a separate headless agent runtime. That third tier is the discovery that makes this project possible:
printf '{"id":1,"method":"session/list","params":{}}\n' \
| node "E:/zcode/resources/glm/zcode.cjs" app-server --stdio
# → {"id":1,"result":{"sessions":[ … real sessions … ]}}zcode app-server is documented in ZCode's own --help as "Run the ZCode Protocol stdio app
server". It speaks a named, versioned, zod-validated protocol ("ZCode Protocol", v1; v4 wire
version 3) over newline-delimited JSON on stdin/stdout, exposing 65 methods plus 21 v4
methods, including v4/command with 30 command types.
The whole design rests on this: control ZCode by owning one of its agent runtimes and speaking its own protocol — never by simulating a user.
The five findings that shaped the design
# | Finding | Consequence |
1 | The agent runtime is spawnable and scriptable by an unrelated process, over stdio | Rating A control surface; no UI automation anywhere |
2 | The runtime needs its own model-provider config and does not inherit the desktop's — not even the providers configured in ZCode's own model management | The MCP must provision a provider, and the key reaches it by environment. The key itself has to be placed in the environment of whatever launches this server; this server never generates a file containing one, and never reads ZCode's credential store |
3 | Owning the runtime makes us its only client, so it sends us the approval requests | A default-deny policy module is mandatory, not a nicety, or turns deadlock |
4 |
| The chat tool must observe a terminal turn event before claiming success |
5 | ZCode has no editor document service | "get active editor" / "replace selection" are not buildable; file mutation goes through the agent's own tools, which is the only path that produces checkpoints and participates in rewind |
Related MCP server: agentic-remote-pc
Repository contents
The reverse-engineering audit
Document | What it covers |
three-tier architecture, processes, flows, boundaries — the main reconstruction | |
every process, service, module and dependency, with the process diagram | |
every communication surface: 66 protocol methods, 129 IPC channels, host RPC, HTTP endpoints, env vars | |
all six command/event registries, the 25 session-event types, the 30+ agent tools | |
UI surfaces → internal actions, and the editor-API non-capability | |
the split state model, every entity, persistence map, safe-write rules | |
model providers, registry sync, turn lifecycle, tools, permissions, subagents, MCP | |
surfaces ranked A–F, and the full control-surface matrix per operation | |
the evidence log: what was run, what was seen, labelled CONFIRMED / INFERRED / HYPOTHESIS | |
open questions, each with the experiment that settles it | |
the proposed MCP architecture and tool surface | |
staged build order from smallest proof of control | |
corrections from the second deep CLI pass — read this alongside the above |
Working artifacts (ASAR reader, protocol prober, extracted bundles, raw agent reports) are in .re/.
The specification (Spec Kit)
.specify/memory/constitution.md the eight articles every design decision must pass
specs/001-zcode-control/
├── spec.md user stories P1–P5, 45 functional requirements, 12 success criteria
├── plan.md technical context, Constitution Check, project structure
├── research.md the decision record, each decision with its alternatives
├── data-model.md external entities + internal entities + state transitions
├── contracts/ 15 files: the shared envelope + one per tool
├── quickstart.md clone → first successful call, with checkpoints
└── tasks.md 85 tasks in 8 phases, grouped by user storyThe tool surface
14 tools with discriminated-union actions — deliberately not one tool per operation, because the model provider rejects requests above roughly 89–94 registered tools.
Tool | Actions | Read-only? | Status |
|
| ✅ | works |
|
| mixed | works |
|
| ❌ | works |
|
| mixed | works |
|
| mixed | works |
|
| ✅ | works |
|
| ✅ | works |
|
| mixed | works |
|
| mixed | works |
|
| mixed | works; |
|
| mixed | works, gated |
|
| ❌ | works |
|
| mixed | declared limitation |
|
| mostly | partial — see below |
★ = the P1 journey. Everything else is prerequisite plumbing or convenience.
Capability boundaries
An owned agent runtime is a subset of what the desktop can do. Two capabilities resolve to methods that exist in the protocol's vocabulary but need a host tier that is not present:
zcode_automation—automation/*answers-32601. Scheduling appears to be a host-side capability; the desktop's host provides it and its client inherits it. Reported asmethod_not_supported: unreliable.zcode_files changes/rewind_preview—v4/conversation/fileChangesrequires abaseRevisionthat no call exposes to a bare runtime's client.baseLogEpochis obtainable (fromrowsRange.atLogEpoch, confirmed because a wrong epoch is rejected) but every derivable revision is rejected withproto.staleRevision. Reported astoken_unobtainable: unreliable.
The rest of zcode_files works, including rewind_apply, which is implemented as a fork — the
safe form, since it keeps the pre-rewind state reachable.
Both are recorded in .re/findings_ADDENDUM.md §A22 and §A23, with the full evidence.
Non-capabilities, stated plainly
These were requested but cannot be built on any stable interface, because ZCode has no editor document service (CONFIRMED, not inferred):
zcode.editor.active · zcode.editor.selection · zcode.editor.replace_selection ·
zcode.file.read (as the editor sees it) · zcode.file.save · zcode.diff.accept/.reject (only
partially, via rewind)
The substitutes are documented per tool in specs/001-zcode-control/contracts/, and the reasoning is
in ZCODE_UI_MAP.md §7.
Design principles
From .specify/memory/constitution.md:
Semantic control only. Every tool resolves to a named protocol method, a parser-verified CLI flag, or a documented config file. No clicks. No minified identifiers. No live-DB writes.
No success without read-back. Every mutating action re-reads and fails on contradiction. Admission is not completion.
noopis not success.Schemas are contracts. zod before spawn; protocol version asserted at first contact; loud on drift.
Secret handling. API keys travel by environment, never a file this server generates; redaction is on by default; ZCode's credential store is never read or written. Where the key physically lives is the launcher's business — a
.envfornpm run start:env, or theenvblock of the MCP client's registration for a client that starts the server itself. The one place that does not work is ZCode's model-management config, which a spawned runtime does not read.Deny by default. The approval policy defaults to deny; blanket auto-approval is prohibited.
Bounded resources. Timeouts, owned process groups, hard kill on every path, no orphans.
The repo is the memory. Audit row per call, hashed artifacts, evidence labels on every claim.
Tests are reflexes. Codec, schemas, redaction, policy and log-token retry are unit-tested; a real turn, a denied write with no side effect (verified by hash), and zero orphans are integration-tested.
Safety: what this server will not do
Simulate mouse or keyboard input.
Write to ZCode's live SQLite databases.
Read, write or relocate
~/.zcode/v2/credentials.json.Auto-approve tool use.
Report a mutation as successful without reading the result back from ZCode.
Expose arbitrary protocol methods by default (the escape hatch is off, allowlisted, and kill-switchable).
Known hazards, disclosed in the tools themselves
Hazard | Where |
|
|
Desktop settings changes need a ZCode restart |
|
Enabling plugins consumes the model's tool budget ( |
|
Creating an automation grants standing unattended authority at the recorded mode |
|
|
|
Open items
ZCODE_UNKNOWNS.md — 9 of 14 questions are resolved. What remains is low-impact except U-14 (the
un-analysed hooks trust family). The two that mattered most resolved decisively:
U-1 — Web Remote Control. There is no local network surface: the desktop opens no listener and is an outbound
wsclient to a Z.ai relay. This ruled out the "attach to the running desktop" design entirely, which is why stdio to an owned runtime is the only boundary.U-4 — credential protection. Provider keys in
config.jsonare plaintext;credentials.jsonis AES-256-GCM but with a key derived from the machine's own identity whenZCODE_CREDENTIAL_SECRETis unset, so it is obfuscated rather than truly encrypted.
Open in this server
zcode_models select scope=serverdoes not warn that a workspace which already remembers a model keeps it. A switch can therefore look applied and have no effect on the next turn.zcode_commandis withheld. Its schema is designed and its protocol methods exist, but no dispatcher was written, so calling it returnedunknown toolwhile it was still advertised. An advertised tool that cannot work is worse than an absent one, so it is not published until it has a dispatcher, a contract and tests.The tool budget needs re-measuring. The recorded 87 was taken while these 15 tools were being rejected by the client, so it is roughly 15 too low (14 published tools plus one withheld). The 89-94 ceiling is a GLM limitation and does not apply to other providers.
Giving it a model
Configure your provider in ZCode — that is the whole setup. The model menu writes
~/.zcode/v2/config.json, and this server reads the credential for the provider it is about to call
from there. Nothing needs to be duplicated anywhere, and no key has to be pasted a second time.
Resolution order, and the environment always wins:
source | when |
| you set one deliberately — it wins |
the matching provider in | the fallback, so the model menu alone is enough |
A key that came from the registry is reported as provider_key_from_registry (advisory) naming the
provider, so which credential is being spent is never a mystery. Point the server at a model and
endpoint with ZCODE_MCP_MODEL and ZCODE_MCP_BASE_URL.
Switching models
A runtime spawned from the environment knows exactly one model, so its catalogue has one entry and
there is nothing to switch to. zcode_settings upsert_provider widens that catalogue on a running
runtime, gated behind ZCODE_MCP_ALLOW_PROVIDER_EDIT=1; zcode_models select then switches:
scope | mechanism | can introduce a new model |
| this process's default, for runtimes spawned afterwards | yes |
|
| only from the runtime's catalogue |
|
| only from the runtime's catalogue |
Measured end to end: the catalogue goes 1 → 2 models, a switch selects the added one, and the turn
that follows runs on it. One limit worth knowing: a workspace that already remembers a model keeps
it — select scope=server applies to runtimes spawned afterwards in a workspace with no stronger
persisted state.
Two things this deliberately does not do: it never opens ~/.zcode/v2/credentials.json (that
file has a machine-derivable cipher and is off-limits by policy, not by difficulty), and it never puts
a key in a tool result, a log line, or a warning — only the provider's id.
Two things worth doing on your machine
Set
ZCODE_CREDENTIAL_SECRET. Without it, the key protecting~/.zcode/v2/credentials.jsonis derived from the machine's own identity rather than from a secret you hold — so the file is obfuscated, not really encrypted, and anyone with a copy of it can read your tokens.Treat provider keys in
~/.zcode/v2/config.jsonas plaintext secrets, because they are. They sit in a JSON file, not a keychain.
Neither is something this MCP uses; both are reported because the audit found them. The Web Remote
Control QR is also a bearer secret (hash=<passHash>), so a photographed QR stays live until
reset-pairing is run.
License
MIT. See LICENSE.
Available Tools
14 toolszcode_approvalA
Answer the agent's approval, input and elicitation requests. Owning a runtime makes this server the runtime's only client, so unanswered requests block turns. The default policy is DENY. persist_rule writes a durable permission rule and requires ZCODE_MCP_ALLOW_PERSIST_RULES=1.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden well: it discloses the default DENY policy, the turn-blocking consequence of not responding, and the ZCODE_MCP_ALLOW_PERSIST_RULES=1 precondition for writing durable rules. It still does not explain how decisions like 'escalate' or 'modify' behave.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the core action and followed by the two facts an agent most needs (blocking behavior, deny default). No filler, though the persist_rule sentence could be tighter given it duplicates schema text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool whose schema defines four distinct action modes (policy, list, respond), the description never mentions the action discriminator or distinguishes the modes. It covers the respond/persist path and the deny default but leaves the policy and list modes to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents request_id, decision, persist_rule and session_id, making 3 the baseline. The description only adds the env-var gate on persist_rule, which the schema itself already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (answer) and resource (the agent's approval, input and elicitation requests), which clearly separates it from session/chat/config siblings. It stops short of naming a sibling, but no sibling covers this domain, so the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the operational context (the server is the runtime's only client, so unanswered requests block turns) and states the default policy is DENY, which implies urgency. However, it never explicitly says when to prefer this tool over others or when each action applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_automationB
Manage scheduled agent runs. Creating an automation grants STANDING, UNATTENDED authority at the mode recorded at creation time. At most 20 automations are retained.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that creating an automation grants standing unattended authority at the creation-time mode and that at most 20 automations are retained. It still omits key behavioral context for update/delete reversibility, auth needs, action-specific effects, and scheduling semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no wasted words. The purpose is front-loaded, followed by the two most important behavioral warnings about authority and retention.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex multi-action tool with no annotations and no output schema. The description gives useful safety context for creation and a retention limit, but does not cover the action inventory, update/delete consequences, required action selection, or scheduling parameters, leaving substantial gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is reported as 100%, so the schema is the primary source for parameter meaning. The description adds no parameter-level detail, such as action semantics, cron/interval behavior, mode/model selection, or max_runs handling, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear resource and domain: scheduled agent runs. This distinguishes it from most zcode_* siblings, which cover status, sessions, chat, files, and settings. However, the verb 'Manage' is broad and the description never enumerates the supported actions (list, create, update, delete, check_binding).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use, when-not-to-use, or alternative-tool guidance. The description does not explain conditions for choosing this tool over related zcode_* tools, leaving usage to inference from the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_chatB
Submit work to the ZCode agent and follow it to a terminal state. Success is only reported after a terminal turn event is observed; an accepted-but-unobserved command is reported degraded. Use tool_allowlist:["Read"] for a guaranteed non-mutating turn.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It usefully explains terminal-event success semantics and degraded reporting for accepted-but-unobserved commands, but it omits the mutating or destructive effects of stop, steer, and cancel_background, as well as any auth or rate-limit behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three compact sentences, front-loads the core purpose, and has no filler or redundant restatement. Each sentence contributes a distinct operational point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool supports multiple actions (send, steer, stop, cancel_background, wait) and has no annotations or output schema. The description only covers the send/follow path and one parameter tip, leaving the other action variants and important behavioral context unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents most parameters. The description only repeats the tool_allowlist example already present in the schema and adds no new parameter meaning, making the baseline score appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: submitting work to the ZCode agent and following it to a terminal state. This clearly identifies the primary chat/turn workflow, but it does not distinguish the tool from siblings such as zcode_session or zcode_status, and it omits the stop/steer/cancel variants exposed by the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool for submitting work and provides one safety-oriented usage tip for tool_allowlist. However, it does not state when to choose this tool over zcode_session, zcode_status, or other siblings, and it gives no when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_conversationA
Read a conversation: rows, messages, events, plans, usage. Read-only. Reads carry logEpoch and revision; on staleness the read is retried once, then reported degraded.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does meaningfully address it: it declares read-only behavior, notes that reads carry logEpoch and revision, and describes the staleness path (retry once, then reported degraded). This is genuine behavioral context beyond the schema. It omits auth requirements and pagination behavior, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the resource and its variants, followed by the read-only and staleness semantics. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five action variants, no annotations, and no output schema, the description covers safety and staleness but never explains what each action returns or how the limit/paging parameters behave per action. The safety profile is complete; the per-action contract is not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents session_id and the shape of each action variant. The description only names the action labels and adds no detail on limit, before_row_id, or row_id semantics, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (a conversation) and enumerates the five action variants (rows, messages, events, plans, usage), which is enough to distinguish it from write-oriented siblings like zcode_chat. It stops short of explicitly naming which sibling handles what, so this lands at a strong 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is 'Read-only,' which tells the agent this is safe but not when to choose it over zcode_chat, zcode_session, or zcode_usage. There is no guidance on selecting among the five actions or on prerequisites beyond session_id.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_filesA
Inspect what a turn changed, preview a rewind, and move attachments. ZCode has NO editor document API: there is no "read the file as the editor sees it". File mutation goes through the agent's own Write/Edit tools, which is the only path that produces checkpoints and participates in rewind. rewind_apply is destructive and requires confirm:true.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full behavioral burden and does well on the highest-risk item: rewind_apply is called out as destructive and gated behind confirm:true. It also discloses the architectural constraint that checkpoints/rewind only exist for mutations made via the agent's Write/Edit tools, which is non-obvious context. It omits behavior for the attachment actions (read-only vs write, size/cost implications) and any auth/permission notes, so it is not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the three capability clusters, then the constraining architecture note, then the destructive-call warning — a sensible risk-ordering. Sentences are dense but each carries information; nothing is filler, though the multi-paragraph shape makes it slightly longer than a minimal tool definition needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-way union schema with no output schema and no annotations, the description supplies the missing safety and capability context: what mutation path produces checkpoints, and that rewind_apply is destructive. It does not describe what a 'changes' or 'rewind_preview' result contains, which is a modest gap given there is no output schema to cover it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself documents session_id, entity_id's extra-read cost, and the max_bytes cap; the description adds only the confirm:true requirement, which is already encoded as a const in the schema. Baseline 3 applies when the schema does the heavy lifting and the description adds little parameter-specific meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a concrete verb list tied to the tool's domain: 'Inspect what a turn changed, preview a rewind, and move attachments.' That maps directly onto the five action consts (changes, rewind_preview, rewind_apply, read_attachment, put_attachment), so an agent can tell it apart from zcode_session or zcode_chat. It stops short of naming how the multi-action dispatch works, but the purpose is not tautological.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the negative case — there is no editor document API, so 'read the file as the editor sees it' is not available — and routes file mutation to the agent's own Write/Edit tools, the only path producing checkpoints. It also flags that rewind_apply needs confirm:true. It does not, however, say when to prefer rewind_preview over rewind_apply beyond the destructive implication.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_headlessB
One-shot headless run via the zcode CLI, requiring no protocol. Emits only flags verified to parse; unverified flags are reported as skipped. Needs a configured model provider.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| text | Yes | ||
| action | Yes | ||
| output | No | ||
| resume | No | A sessionId from zcode_session list, e.g. sess_… | |
| target | No | ||
| continue | No | ||
| workspace | No | ||
| timeout_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full burden. It does disclose a real behavioral trait — only verified flags are emitted and unverified ones are reported as skipped, plus the model-provider prerequisite. However it omits that modes like 'build'/'edit'/'yolo' can mutate workspaces, whether the call blocks until completion, and any auth requirements beyond the provider note.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with the core purpose front-loaded and no filler. Each sentence carries information, though the flag-emission note sits mid-description rather than last.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with no output schema and near-zero schema coverage, the description leaves most calling details (mode semantics, output format, timeout, resume/continue behavior) unexplained. The flag note is helpful but insufficient for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 11% across 9 parameters, so most parameters (mode, output, target, workspace, timeout_ms, continue, action) are undocumented in both schema and description. The description adds no parameter meaning at all, failing to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: a one-shot headless run via the zcode CLI. The phrase 'requiring no protocol' differentiates it from protocol-driven siblings such as zcode_protocol and zcode_chat, so an agent can distinguish it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides one useful prerequisite ('Needs a configured model provider') and implies one-shot/non-interactive use, but never states when to prefer this over zcode_chat or zcode_protocol, nor any exclusions. Usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_mcpA
Inspect and manage ZCode's MCP client surface. WARNING: "list" and "status" START the configured MCP servers as a side effect; the started instance ids are reported. Use "servers" to read configuration without starting anything. Config edits require ZCODE_MCP_ALLOW_MCP_CONFIG_EDIT=1 and a restart.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so well: it discloses that 'list' and 'status' start configured MCP servers as a side effect, that started instance ids are reported, that 'servers' avoids starting anything, and that config edits require an environment variable and a restart. These are exactly the behavioral traits an agent needs before invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose first, then the critical warning, then the safer alternative, then the config-edit requirement. Every sentence carries operational weight, and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action tool with no annotations and a complex anyOf schema, the description covers the most consequential behaviors and prerequisites. It is not fully complete because it does not enumerate every action (e.g., add_server, remove_server) or clarify all action-specific parameters, but the schema supplies those constraints and the description adds the missing behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high, so the baseline is 3, but the description adds important action-specific meaning beyond the schema: it explains the side effects of 'list' and 'status', the non-starting behavior of 'servers', and the environment requirement for config edits. It does not explain the workspace, server, scope, name, or spec parameters, which leaves some semantic gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb set (Inspect and manage) and a specific resource (ZCode's MCP client surface), which is enough to distinguish it from most siblings. It does not explicitly contrast itself with zcode_settings or other zcode_* tools, so it falls short of a perfect sibling-differentiating statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use and when-not-to-use guidance: 'list' and 'status' start servers, while 'servers' reads configuration without starting anything. It also states the prerequisite for config edits (ZCODE_MCP_ALLOW_MCP_CONFIG_EDIT=1 and a restart), leaving little to inference for the critical actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_modelsA
Discover models and providers, and select one. ACTION "catalog" is the decision surface: it lists what ZCode can talk to with context windows, modalities, reasoning levels and whether this server holds a credential for that provider — filterable, and deliberately NOT ranked, because choosing a model is the job of the caller. "available" reports what the runtime has wired up (a different question). "select" applies a choice at session, workspace or server scope; server scope affects only newly spawned runtimes in this process and does not persist.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and mostly delivers: it discloses that catalog is filterable and NOT ranked, that select mutates state at three scopes, and critically that server scope "affects only newly spawned runtimes in this process and does not persist." That is exactly the kind of non-obvious side-effect an agent needs. It omits what the `current` action does and any auth/permission caveats for select.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose, then walks the actions in a logical order with zero filler sentences. The quoted action names and asides are stylistic but each clause carries information. Dense and slightly telegraphic, yet nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema defines four action branches (catalog, available, current, select) inside an anyOf, but the description only explains three — `current` is never mentioned, leaving an agent to infer it. There is no output schema, which is acceptable, but with no annotations and a complex union schema the omission of one action branch is a real completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema already documents min_context, session_id, model, scope and provider. The description adds meaning at the action level (filterability, non-ranking, scope persistence) rather than adding per-parameter detail the schema lacks. Adequate, but it does not extend parameter meaning beyond the already-documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource pair ("Discover models and providers, and select one") and then decomposes it into named actions, so the agent knows this is the model/provider discovery-and-selection surface. It is distinguishable from siblings like zcode_settings or zcode_session by resource, though it never explicitly contrasts with them. A clean, concrete purpose that stops short of true sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes between the two read actions: catalog is "the decision surface" while available "reports what the runtime has wired up (a different question)." It also frames catalog as deliberately unranked because "choosing a model is the job of the caller," which tells the agent what work it must do itself. It does not state prerequisites (e.g., needing a session_id for session scope) or when not to use select.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_pluginsB
Enumerate and manage extensions. Enabling plugins consumes the model's tool budget: the provider rejects requests above roughly 89-94 registered tools with [1210] Invalid API parameter, so this warns when the count approaches the budget. install/update/uninstall require ZCODE_MCP_ALLOW_PLUGIN_INSTALL=1.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose real behavioral traits: that enabling plugins consumes the tool budget, the concrete failure mode ([1210] Invalid API parameter above roughly 89-94 tools), and the env-var gate on install/update/uninstall. However, it says nothing about reversibility, side effects on disk, or whether uninstall/reset_config destroy state — notable gaps for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, and each carries information (budget constraint with a concrete error code, and the install prerequisite). The middle sentence is dense but earns its place. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with twelve action variants, no annotations, and no output schema, the description covers the operational hazards (tool-budget ceiling, install gating) but omits the action taxonomy entirely, leaving the agent to discover the capability surface from the anyOf schema. Adequate but not complete for this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents the plugin_id and workspace fields itself. The description adds no parameter-level meaning — it never explains the twelve action variants (list, overview, describe, set_enabled, configure, reset_config, validate, install, update, uninstall, marketplace, cancel_operation) despite them being the core discriminator. Baseline 3 applies given the rich schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Enumerate and manage extensions" gives a concrete verb plus resource, and the domain (plugins/extensions) is distinct from siblings like zcode_settings or zcode_mcp. It does not explicitly differentiate itself from those siblings or mention the action taxonomy, but the purpose is unambiguous. Slight terminology drift ("extensions" vs the tool name's "plugins") is a minor blemish.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no alternatives among the many zcode_* siblings are named. The one conditional statement ("install/update/uninstall require ZCODE_MCP_ALLOW_PLUGIN_INSTALL=1") is a prerequisite rather than usage routing. An agent must infer context entirely from the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_protocolA
Escape hatch: raw ZCode Protocol access. Disabled by default (ZCODE_MCP_DISABLE_PROTOCOL=1 turns it off entirely) and restricted to an allowlist; mutating methods need ZCODE_MCP_PROTOCOL_ALLOW_MUTATIONS=1. Results are always marked unreliable because no read-back or schema guarantee is applied.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: disabled by default, disabled outright via ZCODE_MCP_DISABLE_PROTOCOL=1, allowlist-restricted, mutating methods gated behind ZCODE_MCP_PROTOCOL_ALLOW_MUTATIONS=1, and results always flagged unreliable due to no read-back or schema guarantee. That is a rich disclosure of gating, side-effect risk, and output trustworthiness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler, and the identity ('Escape hatch') is front-loaded ahead of the enablement constraints. The information is dense but every clause earns its place; only slight compression cost keeps it off a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The gating and reliability story is complete, but the schema defines two distinct modes ('methods' to enumerate vs 'call' to invoke with method/params) and the description never explains this split or what a call returns. For a raw-protocol tool with no output schema and no annotations, that operational gap is meaningful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is reported at 100%, so the structured fields already document the inputs and the baseline is 3. The description adds only indirect context ('mutating methods', no schema guarantee) and does not explain the action/method/params/workspace semantics beyond what the schema encodes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening phrase 'Escape hatch: raw ZCode Protocol access' states a specific verb-and-resource relationship and immediately distinguishes this from the high-level zcode_* siblings (status, session, chat, etc.). An agent knows this is the unmediated low-level channel rather than another curated wrapper.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Calling it an 'escape hatch' implies its when-to-use condition (raw protocol needs the curated tools don't cover) and it clarifies the prerequisites for enablement. It stops short of explicitly telling the agent to prefer the wrapping tools first, so the routing guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_sessionC
ZCode session lifecycle and per-session settings. Mutating actions re-read the session and fail if the observed value disagrees with the request.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It does surface one genuinely non-obvious trait: mutating actions re-read the session and fail on observed-value mismatch (compare-and-swap semantics), which is useful and not derivable from the schema. However, it says nothing about which of the 13 actions are destructive (close, compact, fork), permission requirements, or side effects of lifecycle transitions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with zero filler, and the resource domain is front-loaded ahead of the transactional caveat. It is held back from a 5 only because the extreme brevity comes at the cost of hiding the action menu that defines the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 13-action polymorphic tool with no annotations and no output schema, the description omits the single most important fact: that invocation is action-dispatched. An agent gets no read-vs-write map across the actions, no hint about the create/resume/close lifecycle ordering, and no return-value expectations, so it must reverse-engineer intent entirely from the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is reported at 100%, and the schema itself carries the load: session_id format, the first_input foreign-key warning, and the persistence default are all documented inline. The description adds no parameter meaning at all, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource domain ("ZCode session lifecycle and per-session settings") but never states a verb and never reveals that this is a polymorphic dispatcher covering 13 distinct actions (list, get, create, resume, close, fork, compact, set_model, set_mode, set_thought_level, goal, subagents, usage). Without opening the schema an agent cannot tell what it actually does. It also does not differentiate from siblings like zcode_chat, zcode_conversation, zcode_settings, or zcode_usage, whose territory overlaps with this tool's settings/usage actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage-relevant statement is an implicit caution about mutating actions failing on value disagreement; there is no explicit when-to-use, when-not-to-use, or alternative-tool routing. For a tool whose scope overlaps zcode_chat, zcode_settings and zcode_usage, the absence of any 'use this instead of X when Y' guidance is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_settingsA
Read and change configuration. Protocol-backed actions take effect immediately; file-backed actions (set_desktop) are read by ZCode at startup and report that a restart is required. Provider mutations require ZCODE_MCP_ALLOW_PROVIDER_EDIT=1. Secrets are redacted in all output.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral load and does well: it discloses the immediate-vs-restart-required split between protocol-backed and file-backed actions, an environment-variable gate for provider mutations, and that secrets are redacted in all output. It still doesn't state that actions like remove_provider are destructive or whether mutations persist across sessions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core read/write purpose, then behavior, then the mutation gate. No filler and each sentence carries a distinct behavioral fact an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a high-complexity multiplexed tool with a dozen action variants and no output schema. The description covers the important cross-cutting behaviors but never sketches the action taxonomy (read_state, get, set_default_model, hook_trust_grant, etc.), leaving the agent to infer the full surface from the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the structured schema already documents parameters, making 3 the baseline. The description names set_desktop and provider mutations but adds no per-action semantics (e.g. what read_state versus get return or how workspace scoping behaves) beyond what the schema encodes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb pair and resource: 'Read and change configuration', and reinforces scope by naming concrete action families ('set_desktop', provider mutations). It is clear what the tool does, but it never distinguishes itself from plausible siblings like zcode_status, zcode_models, or zcode_plugins, which could also touch configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied. The description gives one precondition (ZCODE_MCP_ALLOW_PROVIDER_EDIT=1 for provider mutations) but never says when to reach for this tool over zcode_status or zcode_models, and offers no exclusions or negative guidance. Enough to not mislead, not enough to route an agent confidently.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_statusB
Report the state of this MCP server and of ZCode itself. Read-only; starts no turn. "probe" is the diagnostic entry point (runtime version, protocol identity, session count).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses 'Read-only; starts no turn' — a genuine trait an agent cannot get from the schema, and important since it clarifies this does not inject into the conversation. However, it says nothing about the behavior of the other five actions (e.g., what doctor diagnoses, whether sessions/runs pagination or scoping costs anything).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core purpose and zero filler. The trailing probe note is somewhat tacked on but earns its place as the only action-level guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, so the description must carry the load — yet it documents one of six action modes and none of the return content for the others. For a multi-mode diagnostic tool, an agent cannot tell what doctor, runtimes, sessions, or runs yield or when to select them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is reported at 100%, so the baseline is 3. The description explains the meaning of the 'probe' action only, adding marginal value over the self-describing const values; the remaining actions (runtimes, workspace, sessions, doctor, runs) and the shared 'workspace'/'limit' fields get no explanation in either place.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Report the state of this MCP server and of ZCode itself', which is clearly a status/diagnostic tool. It does not distinguish itself from plausible siblings like zcode_usage or zcode_protocol, which also surface server/runtime information, so an agent still has to infer routing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only routing guidance is that '"probe" is the diagnostic entry point', which covers one of the six action variants (runtimes, workspace, sessions, probe, doctor, runs). No when-to-use vs alternatives, no when-not-to-use, no mention of when doctor vs probe vs runtimes should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_usageC
Token and activity analytics. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| range | Yes | ||
| action | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden, and 'Read-only' is the only trait disclosed. It says nothing about permissions, rate limits, scope of accounting, or what the returned metrics represent, which is thin for a zero-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with zero filler. The terseness is efficient but sits at the edge of under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A two-parameter, no-output-schema tool still needs its parameters explained and its read-only guarantee expanded, since there are no annotations to fall back on. The description leaves both the parameter semantics and the behavioral profile largely uncovered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and does not. The 'range' enum (all/7d/30d) and the fixed 'action=stats' are understandable from the schema, but the description adds no meaning about default behavior, timezone/accounting semantics of the ranges, or what the action selector implies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the domain ('token and activity analytics') which tells an agent this is a usage-metrics tool, distinct from zcode_status or zcode_session. However, it gives no verb or concrete sense of what is returned (counts? breakdown by model? time series?), so the purpose is implied rather than specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all, nor any mention of alternatives among the many sibling analytics/status tools. An agent must guess whether this is the right tool for a given stats question.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v0.4.0- First observed
zcode_approval - First observed
zcode_automation - First observed
zcode_chat - First observed
zcode_conversation - First observed
zcode_files - First observed
zcode_headless - First observed
zcode_mcp - First observed
zcode_models - First observed
zcode_plugins - First observed
zcode_protocol - First observed
zcode_session - First observed
zcode_settings - First observed
zcode_status - First observed
zcode_usage
TDQS
Scored across 14 tools
Each tool targets a distinct ZCode subsystem (status, session, chat, conversation, files, settings, plugins, MCP, automation, usage, models, approval, headless, protocol), limiting direct overlap. However, execution-related tools (zcode_chat, zcode_headless, zcode_automation, zcode_protocol) and read/analytics tools (zcode_conversation, zcode_usage) could be confused at a glance, so not entirely unambiguous.
All 14 tools use the identical zcode_ snake_case prefix and noun-based naming pattern (zcode_status, zcode_session, etc.). No mixing of camelCase, verb styles, or other conventions.
14 tools is within the well-scoped 3–15 range and matches the breadth of the ZCode platform. Each tool corresponds to a distinct subsystem rather than a trivial action, so the set is not bloated.
The surface covers core lifecycle and management areas: status, session, chat, conversation, files, settings, plugins, MCP, automation, usage, models, approval, headless, and raw protocol. Minor gaps remain—e.g., no explicit abort/cancel-turn operation and no direct file-read tool (an intentional architectural limitation)—so an agent may need workarounds for edge cases.
Maintenance
Related MCP Connectors
Remote MCP server to read and manage your Atako AI agents, messages, files, and integrations.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Chat with your Zihin.ai agents, list them and load platform skills from any MCP client.
Real-time chat for AI agents. Claude Code, Cursor, Cline and Codex join channels over MCP.
Related MCP Servers
- AlicenseAqualityBmaintenanceA local stdio MCP service that unifies coding agents like Codex and Claude into cs_agent_* tools, enabling the root agent to create, invoke, and manage child agents with recursive delegation.1449 npm2MIT
- FlicenseNot gradedqualityBmaintenanceEnables AI agents to securely control a remote Windows/Linux PC via MCP and REST, executing shell commands and driving coding-agent CLIs like Claude, Cursor, and Codex.-
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to securely create, manage, and monitor local processes such as dev servers, docker-compose, and test watchers, including restarting, checking status, and retrieving logs via MCP, HTTP, or WebSocket messaging.62 npm1MIT
- AlicenseAqualityBmaintenanceEnables an AI agent to run local tools on the user's own machine via stdio, including command execution, workspace file read/write, and system status checks.52MIT