zcode-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@zcode-mcpFix the failing tests in src/utils and add error handling"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
zcode-mcp
把 zcode coding agent 封装成 MCP 工具,供外部 agent(Codex、Claude Code、Cursor……)调用:调用方负责思考和拆解任务,zcode 负责实际写代码。省 token、省订阅——贵模型只出思路,活儿交给本地 zcode/GLM 干。
┌────────────┐ MCP (stdio) ┌──────────────────┐ ZCode Protocol (stdio) ┌─────────────────────┐
│ Codex/GPT │ ──────────────▶ │ zcode-mcp │ ───────────────────────▶ │ zcode app-server │
│ (大脑) │ ◀────────────── │ (翻译层) │ ◀─────────────────────── │ (GLM-5.3 干活) │
└────────────┘ └──────────────────┘ └─────────────────────┘zcode 自身没有 mcp serve 服务端模式,CLI 的 -p 无头模式又要求先选模型而无法在命令行指定。本工具通过逆向 ZCode 桌面版驱动 agent 的内部协议(zcode app-server),完整解决了这些问题:指定模型、多轮会话、事件流、任务取消全部可用。
提供的 MCP 工具
工具 | 说明 |
| 委派一个开发任务给 zcode。参数: |
| 检查后端可用性:二进制路径、凭据、可用模型列表 |
| 列出某工作区的最近会话(可作为 |
Related MCP server: cursor-agent-bridge
前置条件
ZCode 桌面版(macOS)已安装,且登录过一次——登录凭据存放在
~/.zcode/v2/credentials.json,zcode-mcp 复用它们,无需再次登录。Node.js ≥ 18。
构建本工具:
git clone https://github.com/TechYan/zcode_mcp.git cd zcode_mcp npm install && npm run build
接入配置
Codex
~/.codex/config.toml(<repo> 替换为你克隆的绝对路径):
[mcp_servers.zcode]
command = "node"
args = ["<repo>/dist/index.js"]注意:Codex 对 MCP 工具调用有自己的超时。真实开发任务动辄几分钟,建议调大工具超时;
zcode_run侧也有自己的timeout_ms参数(默认 10 分钟)。
Claude Code / zcode 自身
claude mcp add zcode -- node <repo>/dist/index.js
# 或在任何支持 mcpServers 的客户端中等价配置通用 mcpServers 片段
{
"mcpServers": {
"zcode": {
"command": "node",
"args": ["<repo>/dist/index.js"]
}
}
}环境变量
变量 | 默认 | 说明 |
|
| zcode CLI 入口(绝对路径, |
|
| 首选账号 provider |
|
| 默认模型 |
|
| 默认推理档位 |
| server 进程 cwd |
|
|
| 自动检测 macOS 系统代理并透传给 zcode 子进程( |
| – |
|
| 机器指纹派生 | zcode 凭据加密密钥(与 zcode 客户端一致,一般无需设置) |
工作原理(逆向笔记)
zcode 桌面版并不直接跑 agent,而是 spawn zcode app-server 子进程,通过一套内部协议(ZCode Protocol)交互。本工具在 MCP 侧重演了"桌面客户端"的角色:
传输:stdio 上的行分隔 JSON(注意:不是 JSON-RPC,带
jsonrpc键会被严格 zod 校验拒绝)。provider 物化:app-server 自身不持有账号 provider。桌面版启动时通过
provider/updateAccountConfig推送 provider 定义(不带密钥),并在每次模型请求时响应interaction/requestProviderRuntimeHeaders注入凭据。zcode-mcp 读取~/.zcode/v2/credentials.json中加密的 coding-plan api-key(AES-256-GCM,密钥由机器指纹派生)完成同样的事。会话:
session/create(可带 mode/model)→session/subscribe→session/send(带modelSelection,含必填的reasoningLevel)→ 收session/event通知直到turn.completed/turn.failed→session/messages取结构化结果(答复文本、工具调用、token 用量)。TLS/代理:Node 内置 CA 库缺 api.z.ai 的 Sectigo 新证书链;首次启动会把 macOS 系统根证书导出到
~/.zcode-mcp-system-roots.pem并以NODE_EXTRA_CA_CERTS传给子进程。若设置了系统代理,也会自动以HTTPS_PROXY透传(zcode 原生支持)。进程隔离:zcode 入口脚本被软链到
~/.zcode-mcp/zcode-entry.cjs,子进程以固定相对路径 fork,不拼接任何动态命令。
安全须知
zcode_run等于把本机代码执行权交给调用方 agent(默认yolo模式,无确认直接执行)。只在你信任的 MCP 客户端里加载。需要更保守时用
mode: "plan"(只读分析)或"build";app-server 上抛的权限确认(interaction/*)会被自动拒绝,任务即失败返回,不会挂起。凭据只在本地解密并直传给本机的 zcode 子进程,不落盘、不出网。
开发
npm run build # 编译到 dist/
node scripts/probe.mjs "..." # 直接驱动 app-server 协议(逆向用)
node scripts/probe-fork.mjs # fork 模式事件流对照实验
node scripts/e2e.mjs # 端到端:起 MCP server,跑 zcode_check/zcode_run/追问/会话列表已知限制
ZCode Protocol 是内部接口,随 zcode 版本(当前验证 0.16.9)可能变动;协议层全部隔离在
src/protocol.ts,变动时只需改这一个文件。权限确认交互被自动拒绝,因此
build/edit模式下需要确认的操作会失败——无头委派场景建议yolo。每个工作区首次
session/create后模型列表会缓存;切换 zcode 登录账号需重启 MCP server。
License
Available Tools
3 toolszcode_checkCheck zcode availabilityA
Report whether the zcode agent backend is reachable: binary path, stored credentials, available models after booting the app-server. Run this first when zcode_run fails.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It reveals that the tool checks reachability and lists components, but it does not disclose potential side effects like booting the app-server (implied by 'after booting the app-server') or whether the operation is read-only. It also doesn't clarify the output format or error behavior, leaving gaps for a tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, tightly packed. The primary purpose and the key usage trigger are front-loaded, and every word adds value. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description covers the core purpose and provides a usage trigger. It hints at the output content (binary path, credentials, models) but stops short of specifying the exact return shape. For a diagnostic tool, this is mostly complete, but a note on whether it starts the app-server or requires prerequisites would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (vacuously). The description correctly omits parameter details, and the baseline for no-parameter tools is 4. It doesn't add misleading information, so a 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Report' and a clear resource 'zcode agent backend reachability', enumerating what is checked (binary path, stored credentials, available models). It distinguishes itself from siblings by positioning itself as a diagnostic for zcode_run failures, so an agent can tell it apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Run this first when zcode_run fails.' This is a concrete trigger condition. It doesn't mention when not to use it or contrast with zcode_sessions, but the given condition is actionable and sufficient for basic routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_runRun zcode agentA
Delegate a development task to the zcode coding agent. zcode works inside the given directory: it can read/edit files, run shell commands and git. Returns zcode's final answer plus a session_id that can be used to send follow-ups in the same conversation.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute path of the project directory zcode should work in (required for any file work). | |
| mode | No | Permission mode. yolo = no confirmations (default, suitable for headless delegation); plan = read-only analysis. | |
| model | No | Model id, e.g. GLM-5.3 (default) or GLM-5.3-Flash. | |
| prompt | Yes | Task instruction for zcode. Be concrete: what to change, where, and how to verify. | |
| session_id | No | Continue a previous zcode conversation (from an earlier zcode_run result). | |
| timeout_ms | No | Turn timeout in ms (default 600000 = 10 min, max 3600000 = 1 h). | |
| reasoning_level | No | Reasoning effort: low | high | max (default max). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It transparently discloses that zcode can read/edit files, run shell commands and git, and that it returns a response plus a session_id for follow-ups. It does not explicitly warn about autonomous state changes or side effects, but the description clearly indicates the agent operates inside the directory with file and command access.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no fluff: purpose first, then capabilities, then return value and follow-up behavior. Every sentence adds information an agent needs, and the structure front-loads the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 7 parameters and no output schema, the description explains the key return format (final answer + session_id) and the operational context (works inside a directory, can modify files and run commands). It does not mention topics like authentication, cost, or failure modes, but the rich schema covers parameter details well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 7 parameters. The description adds some useful context by linking 'given directory' to cwd and explaining that session_id supports follow-ups in the same conversation, but it does not meaningfully extend the schema's parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Delegate a development task to the zcode coding agent.' It clearly distinguishes this from sibling tools by describing what zcode_run does (running an agent) and what it returns (final answer + session_id), rather than checking or managing sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you need to delegate a development task to the zcode agent. It does not explicitly name alternatives like zcode_check or zcode_sessions or state when not to use this tool, but the run-vs-check/session distinction is strongly implied by the described behavior.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_sessionsList zcode sessionsA
List recent zcode sessions (id, title, directory) for a workspace, usable as session_id in zcode_run.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Workspace directory to list sessions for (default: server cwd). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It says 'List recent zcode sessions' which implies a read-only, non-destructive operation, but it doesn't explicitly state that there are no side effects, no permissions required, or any rate limits. It does disclose the output fields, which is helpful, but lacks explicit behavioral detail for a listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the primary purpose, followed by a direct tie-in to its output's use in zcode_run. No wasted words; every clause adds value. The structure is clean and immediately scannable by an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description compensates by naming the returned fields (id, title, directory) and explaining how they are used (as session_id). It also mentions 'recent', implying a limited or time-ordered set, though it doesn't specify a count or ordering. For a simple list tool with one optional parameter, this is nearly complete; a note on whether it returns an array or object would push it to 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the cwd parameter has a clear description ('Workspace directory to list sessions for (default: server cwd)'). The tool description adds no additional meaning beyond what the schema already provides; it only reiterates the workspace context. Baseline 3 applies since the schema handles the parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list), the resource (zcode sessions), and the returned fields (id, title, directory). It also notes the workspace scope, which distinguishes it from siblings like zcode_run (executes sessions) and zcode_check (presumably checks something else). This is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the output is usable as session_id in zcode_run, giving a concrete use case and linking it to a sibling. It implies this is the tool to call before running a session, but doesn't explicitly say when not to use it or mention alternative conditions. Clear context with no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
zcode_check - First observed
zcode_run - First observed
zcode_sessions
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: zcode_run executes a task, zcode_check verifies backend health, and zcode_sessions lists past sessions. There is no overlap or ambiguity between them.
All tools share the consistent 'zcode_' prefix and snake_case convention. However, 'zcode_sessions' is a noun rather than a verb-based name, deviating slightly from the verb-oriented pattern of 'zcode_run' and 'zcode_check'.
Three tools form a well-scoped set for a coding-agent management server. Each tool serves a distinct and necessary function without bloat or redundancy.
The core workflow (check backend, run tasks, list sessions) is covered, and session_id reuse enables follow-ups. A minor gap exists in having no dedicated tool to inspect a single session's full details, but this is workable via the existing surface.
Maintenance
Related MCP Connectors
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
The team layer for AI coding agents: shared contracts, collision alerts, E2EE sessions.
- ParleyOAuthdev.weldra
Coordination hub for AI coding agents: message teammates, ask humans, audit every event.
AI-powered spec-to-task decomposition and execution orchestration for coding agents.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceDelegates autonomous coding tasks to Z.ai's GLM models with a genuine agent loop, file operations, and verification via git and real process results.13 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients like Claude Code to delegate coding tasks to the local Cursor Agent CLI, with persistent per-workspace sessions that resume across calls.12 npmMIT
- AlicenseAqualityCmaintenanceEnables Codex/ChatGPT to coordinate OpenCode agents, managing tasks, sessions, parallel execution, and project context through 25 local tools.254 npm1MIT
- AlicenseAqualityBmaintenanceEnables ChatGPT Desktop and Codex to delegate substantial work to a locally installed Grok Build agent. Supports consultations, background builder/tester jobs, cancellation, session discovery, and transcript export.7MIT