Report the state of this MCP server and of ZCode itself. Read-only; starts no turn. "probe" is the diagnostic entry point (runtime version, protocol identity, session count).

ZCode session lifecycle and per-session settings. Mutating actions re-read the session and fail if the observed value disagrees with the request.

Submit work to the ZCode agent and follow it to a terminal state. Success is only reported after a terminal turn event is observed; an accepted-but-unobserved command is reported degraded. Use tool_allowlist:["Read"] for a guaranteed non-mutating turn.

Read a conversation: rows, messages, events, plans, usage. Read-only. Reads carry logEpoch and revision; on staleness the read is retried once, then reported degraded.

Inspect what a turn changed, preview a rewind, and move attachments. ZCode has NO editor document API: there is no "read the file as the editor sees it". File mutation goes through the agent's own Write/Edit tools, which is the only path that produces checkpoints and participates in rewind. rewind_apply is destructive and requires confirm:true.

Read and change configuration. Protocol-backed actions take effect immediately; file-backed actions (set_desktop) are read by ZCode at startup and report that a restart is required. Provider mutations require ZCODE_MCP_ALLOW_PROVIDER_EDIT=1. Secrets are redacted in all output.

Enumerate and manage extensions. Enabling plugins consumes the model's tool budget: the provider rejects requests above roughly 89-94 registered tools with [1210] Invalid API parameter, so this warns when the count approaches the budget. install/update/uninstall require ZCODE_MCP_ALLOW_PLUGIN_INSTALL=1.

Inspect and manage ZCode's MCP client surface. WARNING: "list" and "status" START the configured MCP servers as a side effect; the started instance ids are reported. Use "servers" to read configuration without starting anything. Config edits require ZCODE_MCP_ALLOW_MCP_CONFIG_EDIT=1 and a restart.

Manage scheduled agent runs. Creating an automation grants STANDING, UNATTENDED authority at the mode recorded at creation time. At most 20 automations are retained.

Token and activity analytics. Read-only.

Discover models and providers, and select one. ACTION "catalog" is the decision surface: it lists what ZCode can talk to with context windows, modalities, reasoning levels and whether this server holds a credential for that provider — filterable, and deliberately NOT ranked, because choosing a model is the job of the caller. "available" reports what the runtime has wired up (a different question). "select" applies a choice at session, workspace or server scope; server scope affects only newly spawned runtimes in this process and does not persist.

Answer the agent's approval, input and elicitation requests. Owning a runtime makes this server the runtime's only client, so unanswered requests block turns. The default policy is DENY. persist_rule writes a durable permission rule and requires ZCODE_MCP_ALLOW_PERSIST_RULES=1.

One-shot headless run via the zcode CLI, requiring no protocol. Emits only flags verified to parse; unverified flags are reported as skipped. Needs a configured model provider.

Escape hatch: raw ZCode Protocol access. Disabled by default (ZCODE_MCP_DISABLE_PROTOCOL=1 turns it off entirely) and restricted to an allowlist; mutating methods need ZCODE_MCP_PROTOCOL_ALLOW_MUTATIONS=1. Results are always marked unreliable because no read-back or schema guarantee is applied.