zcode-mcp
Delegate coding work from an MCP client to the local zcode agent, plus inspect its availability and sessions.
Run zcode in a project directory to read/edit files, run shell commands, and use git, returning a final answer and
session_id.Choose mode (
planread-only,build,edit,yolo,auto), model (GLM-5.3orGLM-5.3-Flash), reasoning level, and timeout.Continue earlier conversations by passing
session_idfor follow-up tasks.Health-check the backend: binary path, credentials, and available models.
List recent zcode sessions for a workspace to find resumable session IDs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@zcode-mcpFix the failing tests in src/utils and add error handling"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
zcode-mcp
让 GPT 负责思考,让 zcode 负责写码。 Delegate coding to zcode from any MCP client — Codex, Claude Code, Cursor...
把本机 ZCode 桌面版的 agent 能力(GLM-5.3、文件读写、shell、git、自验证)封装成 MCP 工具,供其他 coding agent 调用。贵模型只出思路,活儿交给本地 zcode——省 token、省订阅。
┌────────────┐ MCP (stdio) ┌──────────────────┐ ZCode Protocol (stdio) ┌─────────────────────┐
│ Codex/GPT │ ──────────────▶ │ zcode-mcp │ ───────────────────────▶ │ zcode app-server │
│ (大脑) │ ◀────────────── │ (翻译层) │ ◀─────────────────────── │ (GLM-5.3 干活) │
└────────────┘ └──────────────────┘ └─────────────────────┘zcode 没有官方 mcp serve,CLI -p 无头模式又无法指定模型;本项目逆向了 ZCode 桌面版驱动 agent 的内部协议(zcode app-server),补齐了模型选择、多轮会话、事件流与凭据注入。
📋 目录
Related MCP server: mcp-opencode
✨ 亮点
真·agent 委派——不是单轮问答:zcode 在目标目录里自主读改文件、跑命令、跑 git、自验证,返回最终答复 + 会话 id
多轮会话——
session_id续接上一轮,上下文不丢,追问不用重复铺陈零额外登录——直接复用 ZCode 桌面版凭据(
~/.zcode/v2/credentials.json,AES-GCM 加密,运行时解密注入)环境自动适配——自动导出 macOS 系统根证书解决 api.z.ai 新证书链、自动透传系统代理、自动为 zcode 0.17+ 选用 Node ≥ 24 运行时(便携版,不动系统)
Skill 一键部署——附带 zcode skill(部署/使用/排障指南 + 幂等 setup 脚本)
输入边界校验——所有 MCP 参数(session_id/cwd/mode/reasoning)在进入协议层前经白名单校验
🛠️ 工具一览
工具 | 签名 | 说明 |
|
| 委派任务;返回最终答复 + |
|
| 健康检查:二进制路径、凭据、可用模型;排障第一步 |
|
| 列出可续接的历史会话 |
zcode_run 参数速查:
参数 | 默认 | 说明 |
| 必填 | 任务指令,要具体:改什么、在哪、如何验证 |
| server cwd | 目标项目绝对路径(文件操作的必备项) |
|
|
|
|
| 可选 |
|
|
|
| – | 续接上一轮(来自上次返回值) |
| 600000 | 上限 3600000(1 小时) |
🚀 快速开始
前置:ZCode 桌面版已安装并登录过一次;系统 Node ≥ 18。
方式 A —— skill 一键部署(推荐,zcode 用户):
git clone https://github.com/TechYan/zcode_mcp.git
bash zcode_mcp/skill/scripts/setup.sh # 构建 + Node24 运行时 + 注册 Codex/Claude Code装完还能把 zcode_mcp/skill/ 复制到 ~/.zcode/skills/zcode-mcp/,以后在 zcode 里说"部署/排障 zcode-mcp"即可触发。
方式 B —— 手动三步:
git clone https://github.com/TechYan/zcode_mcp.git && cd zcode_mcp
npm install && npm run build
# 按「接入配置」注册到你的客户端验证:客户端里调用 zcode_check,期望:
binary: /Applications/ZCode.app/Contents/Resources/glm/zcode.cjs
credentials: found (~/.zcode/v2/credentials.json)
models: GLM-5.3, GLM-5.3-Flash
status: ok⚙️ 接入配置
Codex(~/.codex/config.toml,<repo> = 仓库绝对路径):
[mcp_servers.zcode]
command = "node"
args = ["<repo>/dist/index.js"]Codex 自身有工具调用超时,真实任务动辄数分钟,记得调大;
zcode_run侧另有timeout_ms。
Claude Code:
claude mcp add zcode -- node <repo>/dist/index.js通用 mcpServers:
{ "mcpServers": { "zcode": { "command": "node", "args": ["<repo>/dist/index.js"] } } }🎯 使用示例
外部 agent(Codex/GPT)的典型工作流——先问、再做、再追问:
用户: 帮我在 ~/proj 里加一个重试装饰器,单测要过
GPT: zcode_run(mode=plan, cwd=~/proj,
prompt="分析项目结构,给出加通用重试装饰器的改造点清单")
← zcode 返回改造点清单(只读,未改文件)
GPT: zcode_run(cwd=~/proj,
prompt="按清单实现 retry 装饰器 + 单测,跑 pytest 全绿后汇报")
← 返回正文 + 元数据:
session_id: sess_d01ae756-...
model: GLM-5.3 (account:bigmodel-individual-coding-plan)
tools_used: Read(12), Edit(3), Bash(2)
tokens: in=68604 out=312 duration: 25s
GPT: (审查 diff)zcode_run(session_id=sess_d01ae756..., prompt="单测里补一个超时分支")
← 同一会话续接,8s 完成委派心法:调用方拆解与审查,zcode 执行;一次一个可验证闭环;prompt 自包含(zcode 看不到调用方上下文);session_id 传回续接。更多见 skill/references/usage.md。
⚙️ 配置参考
变量 | 默认 | 说明 |
| App 包内 | zcode CLI 入口(绝对路径, |
| 自动探测 | app-server 子进程的 Node(zcode 0.17+ 需 ≥ v24) |
|
| 首选账号 provider |
|
| 默认模型 |
|
| 默认推理档位 |
| server 进程 cwd |
|
|
| 自动检测 macOS 系统代理并透传( |
| – |
|
| 机器指纹派生 | 凭据加密密钥(与 zcode 客户端一致,一般无需设) |
场景化组合(抄走即用):
# 省额度:机械改动走 Flash
ZCODE_MODEL=GLM-5.3-Flash ZCODE_REASONING=high
# 公司代理环境(通常无需手动,自动检测;不生效时显式指定)
HTTPS_PROXY=http://127.0.0.1:7897
# 自定义 Node 运行时(如 volta/nvm 安装的 24)
ZCODE_NODE_BIN=$HOME/.volta/bin/node🏗️ 工作原理
zcode 桌面版本身也是 spawn zcode app-server 子进程、经一套内部协议驱动 agent;zcode-mcp 在 MCP 侧重演"桌面客户端"角色:
传输:stdio 行分隔 JSON。注意不是 JSON-RPC——带
jsonrpc键会被严格 zod 校验拒绝;事件类型在params.type顶层provider 物化:app-server 不持有账号 provider;由客户端经
provider/updateAccountConfig推送定义(无密钥),并在每次模型请求时响应interaction/requestProviderRuntimeHeaders注入凭据(运行时解密本地加密 api-key)会话:
session/create(mode/model)→session/subscribe→session/send(modelSelection 含必填 reasoningLevel)→session/event至turn.completed/failed→session/messages取结构化结果TLS/代理:Node 内置 CA 缺 api.z.ai 的 Sectigo 新链 → 自动导出 macOS 系统根证书到
~/.zcode-mcp-system-roots.pem经NODE_EXTRA_CA_CERTS注入;系统代理经HTTPS_PROXY透传(zcode 原生支持)运行时:zcode 0.17+ 的 SQLite 迁移依赖
node:sqlite isTransaction(Node ≥ 24)→ 自动选用~/.zcode-mcp/runtime/便携 Node(官方 tarball 解压即得)/ZCODE_NODE_BIN/ 系统 Node≥24,fork的execPath指定进程隔离:zcode 入口软链到
~/.zcode-mcp/zcode-entry.cjs,子进程以固定字面量参数 fork,无动态命令拼接
🔧 排障
第一步永远是 zcode_check;ZCODE_MCP_DEBUG=1 可开日志。按症状对号:
症状 | 根因 | 处置 |
| Node < 24 缺 | 跑 |
| 桌面版从未登录 | 打开 ZCode 桌面版登录一次 |
| provider 推送未生效 | 重启 server;仍失败设 |
| Node CA 缺新链 | 确认 |
连接超时 | Node 不走系统代理 | 自动透传已开启;手动设 |
| 任务超时 | 调大 |
| 同会话并发 | 每会话串行;或开新会话 |
| 非 yolo 模式权限被自动拒绝 | 无头委派用 |
完整版见 skill/references/troubleshooting.md。
📊 同类项目对比
项目 | 做法 | 与本项目差异 |
| Claude Code 内置 MCP 服务端 | zcode 无对应能力,本项目补位 |
包装 | zcode | |
双向桥接其他 CLI | 同形态;本项目面向 zcode + GLM,并解决凭据/TLS/代理本地化 |
❓ FAQ
Q: 默认 yolo 安全吗? 等于把本机代码执行权交给调用方 agent。只注册给信任的客户端;更保守用 plan(只读)起步。
Q: 能省多少 token? 编码细节(读文件、跑测试的 IO)全部消耗在 zcode 侧;调用方只花规划与审查。参考:一次典型任务 zcode 侧 in≈70k tokens,调用方仅见数百 token 的答复。
Q: 桌面版更新会坏吗? 协议在 0.16.9→0.17.1 间未变;若有变动,全部隔离在 src/protocol.ts。0.17 的破坏点是 Node ≥ 24(已自动处理)。
Q: Windows/Linux? 当前面向 macOS(ZCode 桌面版路径、系统证书导出、代理探测均为 macOS 实现);协议层本身跨平台。
🔒 安全须知
zcode_run默认yolo全自动执行——只给信任的 MCP 客户端app-server 上抛的权限/用户输入交互(
interaction/*)被自动拒绝(无头无法应答),不会挂起凭据只在本地解密、直传本机 zcode 子进程,不落盘、不出网
🧪 开发
npm run build # 编译到 dist/
npm test # 冒烟测试(真实起 server + zcode_check)
node scripts/e2e.mjs # 端到端:zcode_run 真实任务 + 追问 + 会话列表
node scripts/probe.mjs "..." # 直接驱动 app-server 协议(逆向用)已知限制:ZCode Protocol 为内部接口(已验证 0.16.9 / 0.17.1);build/edit 模式下需确认的操作会被拒绝失败——无头委派建议 yolo;切换 zcode 登录账号需重启 server。
License
Available Tools
3 toolszcode_checkCheck zcode availabilityA
Report whether the zcode agent backend is reachable: binary path, stored credentials, available models after booting the app-server. Run this first when zcode_run fails.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It reveals that the tool checks reachability and lists components, but it does not disclose potential side effects like booting the app-server (implied by 'after booting the app-server') or whether the operation is read-only. It also doesn't clarify the output format or error behavior, leaving gaps for a tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, tightly packed. The primary purpose and the key usage trigger are front-loaded, and every word adds value. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description covers the core purpose and provides a usage trigger. It hints at the output content (binary path, credentials, models) but stops short of specifying the exact return shape. For a diagnostic tool, this is mostly complete, but a note on whether it starts the app-server or requires prerequisites would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (vacuously). The description correctly omits parameter details, and the baseline for no-parameter tools is 4. It doesn't add misleading information, so a 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Report' and a clear resource 'zcode agent backend reachability', enumerating what is checked (binary path, stored credentials, available models). It distinguishes itself from siblings by positioning itself as a diagnostic for zcode_run failures, so an agent can tell it apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Run this first when zcode_run fails.' This is a concrete trigger condition. It doesn't mention when not to use it or contrast with zcode_sessions, but the given condition is actionable and sufficient for basic routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_runRun zcode agentA
Delegate a development task to the zcode coding agent. zcode works inside the given directory: it can read/edit files, run shell commands and git. Returns zcode's final answer plus a session_id that can be used to send follow-ups in the same conversation.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute path of the project directory zcode should work in (required for any file work). | |
| mode | No | Permission mode. yolo = no confirmations (default, suitable for headless delegation); plan = read-only analysis. | |
| model | No | Model id, e.g. GLM-5.3 (default) or GLM-5.3-Flash. | |
| prompt | Yes | Task instruction for zcode. Be concrete: what to change, where, and how to verify. | |
| session_id | No | Continue a previous zcode conversation (from an earlier zcode_run result). | |
| timeout_ms | No | Turn timeout in ms (default 600000 = 10 min, max 3600000 = 1 h). | |
| reasoning_level | No | Reasoning effort: low | high | max (default max). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It transparently discloses that zcode can read/edit files, run shell commands and git, and that it returns a response plus a session_id for follow-ups. It does not explicitly warn about autonomous state changes or side effects, but the description clearly indicates the agent operates inside the directory with file and command access.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no fluff: purpose first, then capabilities, then return value and follow-up behavior. Every sentence adds information an agent needs, and the structure front-loads the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 7 parameters and no output schema, the description explains the key return format (final answer + session_id) and the operational context (works inside a directory, can modify files and run commands). It does not mention topics like authentication, cost, or failure modes, but the rich schema covers parameter details well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 7 parameters. The description adds some useful context by linking 'given directory' to cwd and explaining that session_id supports follow-ups in the same conversation, but it does not meaningfully extend the schema's parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Delegate a development task to the zcode coding agent.' It clearly distinguishes this from sibling tools by describing what zcode_run does (running an agent) and what it returns (final answer + session_id), rather than checking or managing sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you need to delegate a development task to the zcode agent. It does not explicitly name alternatives like zcode_check or zcode_sessions or state when not to use this tool, but the run-vs-check/session distinction is strongly implied by the described behavior.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zcode_sessionsList zcode sessionsA
List recent zcode sessions (id, title, directory) for a workspace, usable as session_id in zcode_run.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Workspace directory to list sessions for (default: server cwd). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It says 'List recent zcode sessions' which implies a read-only, non-destructive operation, but it doesn't explicitly state that there are no side effects, no permissions required, or any rate limits. It does disclose the output fields, which is helpful, but lacks explicit behavioral detail for a listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the primary purpose, followed by a direct tie-in to its output's use in zcode_run. No wasted words; every clause adds value. The structure is clean and immediately scannable by an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description compensates by naming the returned fields (id, title, directory) and explaining how they are used (as session_id). It also mentions 'recent', implying a limited or time-ordered set, though it doesn't specify a count or ordering. For a simple list tool with one optional parameter, this is nearly complete; a note on whether it returns an array or object would push it to 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the cwd parameter has a clear description ('Workspace directory to list sessions for (default: server cwd)'). The tool description adds no additional meaning beyond what the schema already provides; it only reiterates the workspace context. Baseline 3 applies since the schema handles the parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list), the resource (zcode sessions), and the returned fields (id, title, directory). It also notes the workspace scope, which distinguishes it from siblings like zcode_run (executes sessions) and zcode_check (presumably checks something else). This is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the output is usable as session_id in zcode_run, giving a concrete use case and linking it to a sibling. It implies this is the tool to call before running a session, but doesn't explicitly say when not to use it or mention alternative conditions. Clear context with no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
zcode_check - First observed
zcode_run - First observed
zcode_sessions
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: zcode_run executes a task, zcode_check verifies backend health, and zcode_sessions lists past sessions. There is no overlap or ambiguity between them.
All tools share the consistent 'zcode_' prefix and snake_case convention. However, 'zcode_sessions' is a noun rather than a verb-based name, deviating slightly from the verb-oriented pattern of 'zcode_run' and 'zcode_check'.
Three tools form a well-scoped set for a coding-agent management server. Each tool serves a distinct and necessary function without bloat or redundancy.
The core workflow (check backend, run tasks, list sessions) is covered, and session_id reuse enables follow-ups. A minor gap exists in having no dedicated tool to inspect a single session's full details, but this is workable via the existing surface.
Maintenance
Related MCP Connectors
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
Hosted coding agent: start, follow up on and stop tasks that can open GitHub pull requests.
The team layer for AI coding agents: shared contracts, collision alerts, E2EE sessions.
Coordination hub for AI coding agents: message teammates, ask humans, audit every event.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceDelegates autonomous coding tasks to Z.ai's GLM models with a genuine agent loop, file operations, and verification via git and real process results.46 npmMIT
- AlicenseAqualityCmaintenanceEnables Codex/ChatGPT to coordinate OpenCode agents, managing tasks, sessions, parallel execution, and project context through 25 local tools.254 npm1MIT
- AlicenseNot gradedqualityBmaintenanceEnables ChatGPT conversations to directly inspect local workspaces and delegate coding tasks to a local Codex agent, with controlled concurrency, reusable sessions, and task/usage tracking.1,285 npmMIT
- AlicenseAqualityAmaintenanceEnables a DeepSeek Harness agent to delegate bounded coding tasks to a local ZCode runtime, follow their progress through events, and review the resulting diffs before accepting or continuing the work. It also exposes model catalog, default-model, and setup-diagnostics tools for managing those delegated tasks.12Apache 2.0