Skip to main content
Glama

zas-agent

An MCP server that lets a coding agent — Claude Code, Codex, or anything that speaks MCP — send files and notes into your Zas channels, and read items back out of them.

npm CI CodeQL OpenSSF Scorecard License: MIT

What is Zas

Zas moves things between your devices and the people you choose: files, photos, text, code. You put something into a channel on one device and use it on another. Whatever you do not pin leaves on its own after a few days, so there is nothing to tidy up later. Everything is encrypted on the device before it is uploaded: the database and the object storage receive encrypted bytes, not filenames, content or previews.

This package is the piece that lets a coding agent use your channels the way your other devices do, under an identity of its own that you approve, that you scope to the channels you choose, and that you can revoke.

Related MCP server: brain-mcp

What it does

Your coding agent gets thirteen tools. It can send a file or a note into a channel you picked, send or receive a file live through Directo, list what is in that channel, pull one item back onto disk, and change what it sent: an item's title or text, or the bytes under a file, keeping the item id. Everything it sends is encrypted on your machine before it leaves, lands in your account, and is marked in the channel as sent by that agent. The agent has an identity of its own and never holds your account key: pairing mints a key pair here, you approve it from the web app, and from then on it signs a challenge to get a short-lived session.

Install

Install Node.js LTS (22 or newer) and your agent's command-line tool first. Reopen your terminal after installing. Run these commands on the computer where you use the agent.

Choose your agent and pair it. On Windows (PowerShell or CMD):

Codex

npx.cmd -y zas-agent@latest pair --profile codex

Claude Code

npx.cmd -y zas-agent@latest pair --profile claude-code

Open the printed link, approve the channels, and enter the code in the terminal if the page shows one. Leave the terminal open until pairing finishes. Then run the matching registration command:

Codex

cmd /d /c codex mcp add zas "--" npx.cmd -y zas-agent@latest --profile codex

Claude Code

cmd /d /c claude mcp add zas "--" npx.cmd -y zas-agent@latest --profile claude-code

On macOS, Linux, or WSL, use npx in place of npx.cmd and omit cmd /d /c . Pair and register in the same environment. Restart your agent and ask it to send something to Zas.

If a command is not recognized, install Node.js or the named agent's CLI and reopen the terminal. The first download needs internet access and may take a few minutes. Use @latest as shown so npm requests the published package instead of selecting an unbuilt local workspace.

What pairing does

zas-agent pair mints the key pair, registers the public halves, opens the approval page in your browser, and waits. The terminal shows:

Open this page signed in to your Zas account:
  https://zas.red/agents/pair?p=...#port=53211
Fingerprint: 1a2b 3c4d 5e6f 7a8b
Waiting for approval… (expires in 10 minutes)

Signed in, name the agent and tick the channels it may use — sending is the default, reading is a separate switch — and approve. Approval creates nothing by itself: the page hands a one-time claim code to this terminal over 127.0.0.1 (the port in the link), and the agent exists only once the terminal claims with that code and the secret it holds. A link that reached somebody else is approved on their machine, where nothing listens, and expires with nothing created.

If the browser cannot reach the terminal — the link was opened on a phone, or the browser refused the local connection — the page shows the code and the terminal asks for it. Type it there and nowhere else: with that code, another terminal that started a pairing could claim it. Pass --no-open or set ZAS_NO_OPEN=1 to keep the browser closed; the link is printed either way. The pairing is good for ten minutes before approval and five after; past that, run the command again.

You can also start the flow from the coding agent with the zas_pair tool: the first call hands back the URL, a later call says whether the approval landed, and if the page shows a code, a call with code claims with it.

Why you can trust it

Every line here is a fact. The ones about this package you can check in this repository. Where a property is enforced by the Zas server, which is not open source, the sentence says so.

  • The agent has an identity of its own. zas-agent pair generates two key pairs on your machine — X25519 to receive channel keys, P-256 to sign sign-ins — and the private halves never leave it. The agent never holds your account key, and the key-derivation service refuses account-key derivation to an agent (server-side).

  • You approve it, and you choose the channels. Pairing never auto-approves. The approval page shows the harness, the host and the key fingerprint, and nothing exists until the terminal that started the pairing claims it with a code only the approving page received (server-side). A pairing link sent to you by someone else creates nothing on your account.

  • It holds one key per granted channel, and no key for any other. Each grant carries that channel's key sealed to the agent's X25519 public key. A channel you did not grant has no key here to decrypt with, and the server checks the live grant on every request (server-side).

  • No password and no API key. Signing in is a signed challenge traded for a one-hour token. There is no password, no API key and no refresh token on disk: the agent re-signs from its P-256 key when the token ages out.

  • Everything it sends is visible as its work. Every item carries the >_ agent mark and the agent's name, in the channel, on every device you read Zas from.

  • You can revoke it at any time. Settings → Agents → the agent → Revoke. The session stops, its refresh tokens are revoked (server-side), and the next tool call answers "the owner revoked this agent". What it already sent stays where it is. You can also drop a single channel and keep the rest.

  • Content is encrypted on your machine before it leaves, the same way the app does it. The chunking, the manifest and the envelope formats under src/shared/ are the same modules the Zas web app ships. The server stores ciphertext and never sees a channel key, a channel name or item plaintext (server-side).

  • The source is here, and the releases are built from it. Every npm release is published by the release.yml workflow in this repository, with npm provenance, so the tarball on npm can be traced back to a commit and a workflow run.

What it cannot do

The package refuses some of these on its own, before a request is made. The ones marked (server-side) are enforced by the Zas server.

  • No channel you did not grant. Not by name, not by id.

  • No shared channel you joined, unless its owner allows it. You can grant a channel you joined, but the grant stays grant_pending until that channel's owner allows this agent in Zas. The plan also caps how many of these channels one agent holds: 2 on Free (server-side).

  • No workspace channel, unless the organization allows agents. A channel an organization manages, or one you created inside its workspace, can be granted only while the organization is active and an admin turned agents on (server-side).

  • No reading unless the grant says so. read is a separate switch from send; without it, zas_list_items and zas_get_item are refused.

  • No stored sending into a view-only channel, and none into a channel in Directo mode. Both are refused before a byte is uploaded. A channel in Directo mode takes zas_send_direct, a live transfer that stores nothing.

  • No changing what it did not send. zas_edit_item and zas_replace_file act only on items carrying this agent's mark; anything else is not_yours, and the server refuses it too (server-side). A replace is for agents only: no web or mobile client gets one. An item with a public share is not replaced until the share is removed.

  • No receiving unless the grant says read. Receiving through Directo writes a file onto this machine, so zas_receive_direct takes the same read switch as listing. And it only ever runs inside a tool call: the agent never watches your channels, so nothing arrives unasked.

  • Nothing outside its allowlist. The API refuses an agent on every route that is not on a short, explicit list, and Firestore rules refuse it your account document, your devices, and any channel without an active read grant (server-side).

  • Rate limited by the server, on its own buckets, with the key-derivation budget charged to your account so ten agents are not ten times your own allowance (server-side).

  • As many agents as your plan or your organization allows (server-side).

  • Files up to 5 GiB, and in practice less: the agent reads a file into memory to hash it, so the machine's memory is the real ceiling.

The error vocabulary

The agent answers in a closed set of codes. Anything a server route says that is not in this set collapses to upload_failed or network, so no raw server string ever reaches a terminal.

Code

What it means

not_paired

This agent is not paired yet.

identity_corrupt

The identity file on disk is damaged.

agent_revoked

The owner revoked this agent.

agent_forbidden

Only the account owner can do that.

grant_missing

This agent has no access to that channel.

grant_pending

That channel belongs to somebody else, and its owner has not allowed this agent yet.

send_forbidden

This agent cannot send to that channel.

read_forbidden

This agent cannot read that channel.

direct_mode

That channel is in Directo mode.

not_direct_mode

That channel is not in Directo mode.

not_claimed

Nobody received the file within ten minutes; the offer was withdrawn.

no_offer

Nobody offered a file through Directo while the call waited.

offer_taken

Another device received that file first.

direct_cancelled

The offer was cancelled from the other side.

direct_failed

The Directo transfer failed in flight.

direct_not_failed

That job is not a Directo transfer that failed in flight.

file_changed

The file changed since the Directo offer.

webrtc_unavailable

The WebRTC engine could not be loaded on this machine.

fallback_unavailable

Reliable delivery is not available right now.

key_stale

The channel key changed; the owner refreshes it by opening Zas.

quota_exceeded

The account reached its storage limit.

plan_inactive

The organization's plan is inactive, so sending to its channels is paused; the owner or a billing admin reactivates it.

rate_limited

Too many sends in a row.

file_too_big

The file is over the plan limit.

duplicate

That item is already in the channel.

not_found

That item is not in the channel.

not_yours

That item was not sent by this agent; it can only change its own items.

stale

That item changed while this agent was working on it; read it again and retry.

not_a_note

That item is a file, not a note; only its title can change.

not_a_file

That item is a note, not a file.

item_shared

That item has a public share; the owner removes the share first.

invalid_cap

That file is no longer available.

write_failed

The download destination could not be written.

pairing_expired

The pairing expired; pair again.

pairing_cancelled

The owner cancelled the pairing.

claim_mismatch

The code does not match.

pairing_not_approved

Nobody has approved this pairing yet.

pairing_claimed

This pairing was already claimed; pair again.

agent_limit

The account cannot take another agent; the owner deletes one from Settings → Agents.

grant_limit

The plan allows fewer channels per agent than this pairing grants.

foreign_limit

The plan allows this agent fewer channels of other people than this pairing asks for.

feature_disabled

Agents are not enabled for this account yet.

upload_failed

The upload failed.

oprf_failed

Zas did not answer correctly while preparing the file.

network

Zas cannot be reached.

sign_in_failed

Zas did not accept this agent session.

bad_signature

Zas rejected this agent's signature; pair it again.

missing_token

The session token is missing; pair the agent again.

internal

Something failed inside the agent.

Every code comes back as one sentence in English, never as a stack trace.

Tools

Tool

What it does

zas_status

Says whether this agent is paired with a Zas account, and lists the owner's channels it may send to or read from.

zas_pair

Pairs this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, a call with code claims with it. In a profile that is already paired, approval replaces the old agent.

zas_send_file

Sends a file from this machine into one of the owner's channels. Returns the item id, or a job id when the upload takes longer than a minute.

zas_send_note

Sends a note — plain text, or a code snippet with its language — into one of the owner's channels.

zas_send_direct

Sends a file through Directo: a live, device-to-device transfer into a channel in Directo mode. Nothing is stored. The owner presses Receive on another device within ten minutes; the call returns the result, or a job id after a minute.

zas_send_direct_fallback

After a Directo send failed in flight, delivers the same file through reliable delivery: encrypted on this machine, stored in Cloudflare R2 for up to 24 hours, off the owner's quota. The owner's choice; the model is told to ask.

zas_receive_direct

Receives a file the owner sends through Directo, onto this machine. Waits for the offer, takes it, and writes the file to disk. Needs a grant that includes reading, and a channel in Directo mode. Returns the path written, or a job id after a minute.

zas_receive_direct_fallback

After a Directo receive failed in flight, downloads the encrypted copy the sender chose to store, and decrypts it to the same destination.

zas_list_items

Lists the most recent items in one of the owner's channels. Needs a grant that includes reading.

zas_get_item

Fetches one item. A note comes back as text; a file is written to disk. It never overwrites, so the path it answers with can differ from the one you asked for.

zas_edit_item

Changes an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Needs a grant that includes reading and sending. The owner's activity log records it.

zas_replace_file

Replaces the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Returns the item id, or a job id after a minute. Refuses notes, shared items, and items sent by anyone else.

zas_jobs

Lists the sends and Directo transfers this server started, newest first, with the phase each one reached — and where a job_id from a long send is redeemed.

channel takes a channel name or a channel id. A name has to match exactly one of the channels you granted; with exactly one grant, zas_send_file, zas_send_note, zas_send_direct, zas_receive_direct, zas_edit_item and zas_replace_file can leave it out.

A replace runs the same pipeline as a send — hash, key derivation, encryption, then upload or proof per chunk — and posts the new set with the old one to release. The server moves both sets, the account's storage tally and the item in one transaction, so a failure leaves everything as it was; a chunk present in both versions is neither uploaded nor released. Both tools read the item first and write only over the version they read: an item that changed in between answers stale, and nothing is lost.

Directo needs a native module, node-datachannel, WebRTC for Node. npm installs a prebuilt binary for Windows, macOS and Linux; the module loads the first time a Directo tool runs, and a machine where it cannot load answers webrtc_unavailable. Every other tool works without it.

Two things worth knowing before you point a model at your account:

  • zas_send_file and zas_send_direct send any file this process can read — ~/.ssh/id_rsa and a .env included. Confirm with the owner before sending secrets, keys or credentials. Its tool description says so, so the model reads it too.

  • zas_get_item and zas_receive_direct write a new file under dest, or under the system temp directory when you leave dest out. Neither ever overwrites an existing file: a name that is taken gets a suffix, and the path they answer with is the one they actually wrote.

Everything those tools touch lands inside your own account and your own machine. Revoking the agent stops all of them.

What it sends back

This package reports how it is used, so defects like a release that could not receive a file at all stop being invisible. It is on by default and it is yours to turn off:

npx -y zas-agent telemetry off     # and `on` again, and `telemetry` to see

ZAS_AGENT_TELEMETRY=0 and the cross-vendor DO_NOT_TRACK=1 do the same without writing anything. The choice lives in ~/.zas/agent/settings.json and covers every profile on the machine; pairing again does not reset it. zas_status always says which way it is set.

What one report carries, and nothing else: the tool that ran, whether it worked, the closed error code when it did not, which of four duration buckets it fell in, and the package version. Item transfers also report item category, transport, byte counts, stage durations, and success/failure/cancellation, joined by a random per-attempt ID. No file name, no file contents, no path, no channel name, no error message, no stack.

Where it goes: to Zas, never to an analytics service directly. This package holds no analytics token and opens no connection to a third party, so no address of yours reaches one. The report is attributed to the Zas account the agent is paired with, which the server reads from the session — the request carries no account or content identifier. Nothing is reported before pairing, because until then there is no account it could belong to.

A report is never allowed to matter: it is sent after the answer, waited on for at most five seconds, tried once, and dropped in silence if it fails.

Data on disk

One directory per profile, so one machine can hold a Claude Code agent and a Codex agent side by side without either reading the other's keys:

OS

Path

macOS, Linux

~/.zas/agent/<profile>/

Windows

%USERPROFILE%\.zas\agent\<profile>\

Four files in the profile directory, all written through a temporary file and renamed into place, so a crash mid-write cannot leave half a file behind:

  • identity.json — the agent uid, the owner uid, the name, and the two key pairs. Back it up like a private key, or delete it and pair again.

  • pending.json — a pairing that has not been claimed yet. Removed on completion, and on a pairing that expired or was cancelled.

  • grants.json — a one-minute cache of GET /v1/agents/me: which channels, and the sealed key for each. The channel name stays encrypted here. Disposable.

  • fingerprints.json — hashes of what an identical send produced in the last ten minutes, so a retried tool call answers without touching the network. It stores hashes, never a title or a note's first line. Disposable.

One more file sits next to the profiles, in ~/.zas/agent/:

  • settings.json — whether this machine reports usage, and when the notice above was last printed. It belongs to the machine, not to a profile, so one decision covers every agent on it.

On macOS and Linux the directory is created 0700 and every file 0600. On Windows those bits have no effect: the files carry the permissions of the user profile they live in, and the package does not try to set any others.

Deleting the directory makes this machine forget the agent. It does not revoke anything: the account side is closed from the web app, under Settings → Agents → Revoke.

Pairing again

A pairing is one profile's key pair, not the machine and not the program. A profile holds one agent. Running zas-agent pair in a profile that is already paired opens a replacement: the terminal signs the request with the old identity, the approval page says which agent it replaces and fills in its name and channels, and the old agent is revoked in the same step that creates the new one. Its row stays under Settings → Agents as revoked until you remove it, and it keeps costing a slot until then. If the old agent was already revoked or removed, pair says so and creates a new agent.

One machine that runs Claude Code and Codex has two profiles (claude-code and codex), two agents, two approvals and two rows. Revoking one does not touch the other. Two programs pointed at the same --profile act as one agent: same keys, same channels, one row.

Configuration

Setting

Default

What it changes

--profile <name>

claude-code

Which identity directory this process uses. Letters, digits, ., _ and -, up to 64, and it may not start with a dot.

ZAS_AGENT_HOME

~/.zas/agent

Where the profile directories live.

ZAS_AGENT_TELEMETRY

unset

0 turns usage reporting off for this process, 1 on. It outranks the stored choice.

DO_NOT_TRACK

unset

1 turns usage reporting off. Read only to turn it off.

ZAS_WEB_BASE

https://zas.red

The web app the pairing URL points at.

ZAS_API_BASE

https://zas.red/api

The API.

ZAS_TOKEN_BASE

https://zas.red/anon-token

The challenge and token routes.

ZAS_OPRF_BASE

https://zas.red/oprf

The blind key-derivation service.

ZAS_FIREBASE_PROJECT

zas-me

The project whose Firestore the read path queries.

ZAS_FIREBASE_API_KEY

the public web key

The key used to exchange a custom token for a session.

Only --profile, ZAS_AGENT_HOME and the two telemetry switches are worth setting by hand. The rest exist so the package can be pointed at a test deployment.

Development

git clone https://github.com/soke1556/zas-agent
cd zas-agent
npm ci
npm test
npm run typecheck
npm run build
node dist/cli.js --version

This repository is the public mirror of the agent/ package of Zas's private monorepo. It is produced by scripts/export-public.mjs, which builds the package with esbuild and uses the build's own metafile to decide what to copy: src/, test/, the package files, and the nine src/shared/* modules the agent imports. Those shared modules are the client-side crypto and format code — the chunker, the manifest, the envelope, the key derivation — that the Zas web app also ships, which is why the encryption the agent performs is the encryption the app performs. The Zas server is not open source.

Pull requests are welcome against this repository. The maintainer applies accepted changes back into the monorepo, and the next export brings them here. See CONTRIBUTING.md.

Security

Please report vulnerabilities privately. SECURITY.md says how, and what to expect.

License

MIT. See LICENSE.

Available Tools

13 tools
zas_edit_itemA

Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesItem id, as `zas_list_items` reports it.
langNoLanguage of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text.
textNoNew body, for a note.
titleNoNew label. An empty string clears it, so the file name or the first line shows again.
secretNoHide the body behind a cover until the reader opens it. False removes the cover.
channelNoChannel name or id. Optional when the agent holds exactly one channel.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden and does so well: it discloses the authorization grant required, the ownership restriction that causes refusal, the empty-value clearing semantics, and the side effect that the owner sees every sent item marked with the agent name on every device. This is far beyond what structured fields provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and scope are front-loaded in the first clause, and every sentence carries information. The middle sentences are dense compound statements, but no sentence is filler; slight tightening would help readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description covers authorization, ownership refusal, partial-update semantics, and visibility side effects. Nothing an agent needs to call it correctly is missing, and return-value documentation is unnecessary here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3, but the description adds real meaning the schema lacks: PATCH-style semantics ('Pass only the fields to change') and the behavior of empty values ('an empty title clears it'), which qualifies the schema's per-field descriptions rather than repeating them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Change an item this agent sent, keeping its id') and enumerates exactly which fields are editable (title, text, language, secret cover). It explicitly carves out the sibling boundary by noting file bytes change with zas_replace_file, so an agent can distinguish it from the other 12 tools without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit preconditions ('Needs a grant that includes reading and sending'), an exclusion ('Refuses items sent by anyone else'), and an alternative ('A file's bytes change with zas_replace_file'). It also specifies partial-update usage ('Pass only the fields to change'), leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_get_itemA

Fetch one item from a Zas channel. A note comes back as text; a file is written to disk. Returns the path written; it can differ from dest when a file with that name already exists. Writes a new file under dest (or the system temp directory); it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesItem id, as `zas_list_items` reports it.
destNoWhere to write a file. A directory means "inside it". Defaults to a fresh temporary directory.
channelYesChannel name or id.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does real work: it discloses that notes come back as text while files are written to disk, that it never overwrites an existing file, that the returned path can differ from dest, and that the default destination is a temp directory. It omits auth/permission needs, but the destructive-safety profile is well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action is front-loaded and the file-writing caveats follow logically. The closing sentence about the owner seeing every item this agent sends is tangential for a fetch tool and is the one sentence that does not clearly earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly explains the return value (the written path, which may differ from dest) and the note-vs-file duality. It is essentially complete for correct invocation, missing only edge behavior such as what happens when the id does not exist.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents channel, id, and dest semantics. The description's added detail ('writes a new file under dest... never overwrites') is really return-value behavior rather than new parameter meaning, so the baseline 3 holds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Fetch one item from a Zas channel.' The word 'one' implicitly contrasts with the sibling zas_list_items, so an agent can distinguish retrieval-by-id from enumeration without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the tool is clearly for pulling a single item given a channel and id. There is no explicit when-to-use/when-not guidance and no pointer to alternatives such as zas_list_items for discovering ids, so the agent must infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_jobsA

List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended — including any job_id a send returned; a finished job keeps its result here. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations the description carries the full burden, and it does disclose meaningful traits: results are ordered newest-first, each entry carries the phase reached and how it ended, returned job_ids are surfaced, and completed jobs retain their results here. It also notes the visibility model (owner sees items with the agent mark/name on every device). It stops short of stating read-only safety, pagination, or result limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action and ordering. The second sentence about owner visibility is the least essential and slightly tangential, but it is short and not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool with no output schema and no annotations, the description covers the important ground: what is listed, ordering, per-item fields, job_id retention, and result persistence. Missing only operational details such as pagination or result-count limits.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; there is no schema-level parameter meaning to add or compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('List') and resource ('the sends and Directo transfers this server started'), plus the ordering ('newest first') and the fields surfaced (phase, outcome, job_id). It is clearly distinguishable from write-oriented siblings like zas_send_direct, though it never names a sibling to sharpen the boundary against zas_list_items or zas_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'a finished job keeps its result here' suggests this is where you check the outcome of a prior send, but there is no explicit when-to-use, when-not-to-use, or named alternative (e.g. zas_status) to route the agent. The final sentence adds context but not selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_list_itemsA

List the most recent items in one of the owner's Zas channels. Needs a grant that includes reading. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoHow many items, 1 to 50. Defaults to 20.
channelYesChannel name or id.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose a real behavioral requirement (a reading grant is needed) and a visibility trait (the owner sees items with the agent mark on every device), which is useful. However it omits return format, pagination/cursor behavior, and ordering caveats beyond 'most recent'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, purpose front-loaded, and the permission constraint follows closely. The final sentence about device-wide agent marking is somewhat tangential but does carry transparency value, so it earns its place marginally.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with no output schema and no annotations, the description covers the essential purpose and the key permission prerequisite. It is nearly complete; only return/pagination detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: 'limit' documents its 1-50 range and default of 20, and 'channel' documents name-or-id. The description adds no parameter meaning beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('List') and resource ('items in one of the owner's Zas channels'), with the 'most recent' scoping. It is distinguishable from the singular zas_get_item and the send_* siblings, though it doesn't explicitly name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a prerequisite ('Needs a grant that includes reading') but offers no explicit when-to-use-vs-alternatives guidance, e.g. versus zas_get_item or the receive_direct tools. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_pairA

Pair this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, call again with code. In a profile that is already paired, approval replaces the old agent. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeNoThe code the pairing page shows when the browser could not reach this machine.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that this is a stateful, multi-call flow, that re-approval replaces the prior agent, and the side effect that the owner sees every item this agent sends (with the >_ mark and agent name) on all devices. It omits auth/permission requirements and failure behavior, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences with the core purpose front-loaded, then the protocol, the code branch, and the re-pairing case. The closing sentence about cross-device visibility is slightly tangential but still earns its place as behavioral context; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 1-optional-param pairing tool with no output schema and no annotations, the description covers the interaction sequence, the code parameter's role, re-pairing semantics, and the resulting visibility. It is close to complete, missing only error/permission handling an agent might want.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real value beyond the schema text: it explains the conditional trigger for `code` ('If the page shows a code, call again with `code`'), tying the optional parameter to a runtime condition rather than just its content.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Pair this agent with a Zas account.' This is unambiguous and clearly distinct from the sibling send/receive/status tools, none of which handle account pairing. An agent can tell what this tool is for without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It lays out the multi-call protocol clearly: first call returns a URL for the owner, a later call reports approval, and a code-bearing page means calling again with `code`. It also notes the already-paired case (approval replaces the old agent). It stops short of naming explicit alternatives or when-not-to-call, but the when/how context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_receive_directA

Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
destNoWhere to write the file. A directory means "inside it". Defaults to a fresh temporary directory.
channelNoChannel name or id. Optional when the agent holds exactly one channel.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the one-minute call timeout, the ten-minute offer wait, the returned job id to poll via zas_jobs, the returned path, the no-overwrite guarantee, and that nothing is stored. It does not describe failure/timeout outcomes when no offer arrives, which is the main remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then trigger, then constraints, then return/behavior — good ordering. The closing sentence about the owner seeing items "this agent sends" with the >_ mark concerns sends, not receives, so it is slightly off-topic for this tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by stating the return value (path written) and the async job-id pattern. Combined with timing and permission preconditions, an agent has nearly everything needed, missing only explicit error/no-offer handling and sibling disambiguation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters (dest, channel), and the description adds only indirect hints ("writes the file to disk", "returns the path written") without new syntax or default semantics. Baseline 3 applies since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb+resource (receive a file the owner sends through Directo) and the effect (written to disk on this machine). It is distinguishable from zas_send_direct and zas_send_file, but never mentions zas_receive_direct_fallback, which is the closest alternative an agent would need to disambiguate from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Call it when the owner says they are sending you something" gives a clear trigger, and preconditions are spelled out: Directo-mode channel only, grant must include reading. No exclusion or explicit fallback routing is provided, so the agent cannot tell when to prefer zas_receive_direct_fallback instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_receive_direct_fallbackA

After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job’s id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
jobYesThe job id zas_receive_direct or zas_jobs reported for the receive that failed.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden and it does well: it discloses that decryption happens locally, that the file is written to the same destination, and the reliable-delivery precondition. It omits what happens if the precondition is unmet (error vs. silent no-op) and whether the download is idempotent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The functional content is front-loaded and clear, but the final sentence about the owner seeing items with the agent mark and name is tangential marketing copy that dilutes the definition and doesn't help the agent invoke the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, the description covers trigger, precondition, and side effects (local decryption, write destination) adequately. Missing only failure semantics when the precondition isn't met.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already defines the single 'job' parameter with a clear description. The description adds the provenance of the id ('the failed job's id'), which is mildly useful routing context but essentially restates the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (download) and resource (the encrypted stored copy) and ties it to a precise triggering condition (after a zas_receive_direct job failed in flight). The link to the named sibling zas_receive_direct makes the relationship unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly conditions use on two things: a prior zas_receive_direct failure and the sender having chosen reliable delivery for that transfer. It also names the required argument (the failed job's id), so the agent knows exactly when this applies and what to supply.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_replace_fileA

Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesItem id, as `zas_list_items` reports it.
pathYesAbsolute or relative path of the new file.
titleNoNew label. Defaults to the label the item has.
channelNoChannel name or id. Optional when the agent holds exactly one channel.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so richly: refusals (foreign items, notes, publicly shared items), the dual return shape (item id, or job id for uploads over a minute), and the owner-visible agent mark across devices. These are exactly the operational facts an agent needs before invoking a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each front-loaded with a distinct fact: what it does, what it refuses, what it returns, and the visibility/safety caveat. No filler and nothing repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter mutation tool with no annotations and no output schema, the description supplies the missing pieces an agent needs: refusal conditions, return value semantics including the async job-id case, and a safety warning. Nothing material is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so id, path, title, and channel are already documented in the schema. The description reinforces that the item id must match an item the agent itself sent and that channel is optional only with a single channel, but adds no syntax or format detail beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource: replacing the bytes of a file the agent previously sent, from a local path. It also names the preserved attributes (item id, channel position, pin), which distinguishes it from zas_edit_item (metadata edits) and zas_send_file (new item). An agent can differentiate it from siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly delineates when this tool refuses to act: items sent by anyone else, notes, and items with a public share, plus a pre-send caution about secrets/keys/credentials. It does not, however, explicitly name the alternative tools (e.g. zas_edit_item for metadata, zas_send_file for new uploads), leaving the agent to infer the boundary from the refusal list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_send_directA

Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute or relative path of the file to send.
channelNoChannel name or id. Optional when the agent holds exactly one channel.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does: 'Nothing is stored', a one-minute synchronous wait followed by a job id, a ten-minute owner receive window, owner visibility with the >_ agent mark and agent name on every device, and a cautions note about secrets/keys/credentials. These are exactly the behavioral traits an agent needs before firing the call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the mechanism and the key timing constraint, and most sentences earn their place. The trailing sentence about the >_ agent mark and agent name on every device is awareness-heavy but still operationally relevant; overall slightly long but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but the description explains both possible returns (transfer result or job id) and names zas_jobs for polling, covering the return contract. The remaining gap is failure/fallback behavior: the existence of zas_send_direct_fallback is never acknowledged, so an agent hitting a failed transfer has no stated next step.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters (path, channel) are already documented in the schema. The description adds only that it sends 'any file this process can read', which marginally constrains path but adds no syntax or format detail. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (send) and resource (a file) and immediately qualifies the mechanism: a live device-to-device transfer into a channel in Directo mode. That mechanism distinguishes it from siblings like zas_send_file and zas_send_direct_fallback without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear preconditions and context: the target channel must be in Directo mode and the owner must press Receive on another device within ten minutes. It routes to zas_jobs for status, but never states when to prefer zas_send_file or zas_send_direct_fallback instead, so the alternative-selection guidance is incomplete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_send_direct_fallbackA

After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
jobYesThe job id zas_send_direct or zas_jobs reported for the Directo send that failed.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden and delivers: local encryption, storage of only the encrypted copy in Cloudflare R2, a 24-hour retention window, no consumption of owner space, download by the claiming device, and the behavioral shift that bytes now pass through storage. It also discloses owner visibility via the agent mark.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and trigger are front-loaded and most sentences carry distinct information. A few clauses are conversational ('This stops being Directo', 'it is their choice') and could be tightened without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers trigger, consent gate, encryption/storage mechanics, retention, and visibility for a tool with no annotations and no output schema. It omits what the call returns and what happens to the original failed job, which would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single job parameter is fully documented in the schema. The description's 'Pass the failed job's id' restates rather than extends that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (deliver), resource (the same file), and a precise trigger condition (after a zas_send_direct job failed in flight), which distinguishes it cleanly from zas_send_direct and zas_receive_direct_fallback. An agent can identify the scenario without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('after a zas_send_direct job failed in flight') and a hard prerequisite ('Ask the owner before you use it; it is their choice'). It also names the originating tool whose failure selects this path, so the when-to-use decision is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_send_fileA

Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute or relative path of the file to send.
titleNoLabel for the item. Defaults to the file name.
channelNoChannel name or id. Optional when the agent holds exactly one channel.
expires_in_daysNoHow many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the plan grants. Worth setting for output that is stale tomorrow, such as a build log or a test run.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses the async return shape (item id, or a job id when the upload exceeds a minute), a hard refusal condition for Directo channels, a capability boundary ('any file this process can read'), and an audit/visibility behavior ('owner sees every item ... with the >_ agent mark and this agent's name, on every device').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four compact sentences, each carrying distinct information (action, return shape, refusal/alternative, safety warning, visibility), with the core action front-loaded and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description must cover both; it explains the return values (item id vs job id), the refusal path, and the safety/visibility implications. Nothing an agent needs to invoke this correctly appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description adds meaning beyond it by tying the `channel` parameter to the Directo-mode refusal and by characterizing `path` as limited to files 'this process can read'. It does not restate the `expires_in_days` clamping semantics, but the schema already covers that well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: 'Send a file from this machine into one of the owner's Zas channels.' It also explicitly differentiates from a sibling by noting that a channel in Directo mode refuses this tool and that zas_send_direct should be used there.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit exclusion rule ('A channel in Directo mode refuses this tool: use zas_send_direct there') naming the alternative tool, plus a safety precondition ('confirm with the owner before sending secrets, keys or credentials'). Both when-not-to-use and the alternative are stated outright.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_send_noteB

Send a note — plain text, or a code snippet with its language — into one of the owner's Zas channels. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault
langNoLanguage of the snippet, for highlighting (for example "ts", "py").
textYesThe body of the note.
titleNoLabel for the item. Defaults to the first line.
secretNoHide the body behind a cover until the reader opens it.
channelNoChannel name or id. Optional when the agent holds exactly one channel.
expires_in_daysNoHow many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the plan grants. Worth setting for output that is stale tomorrow, such as a build log or a test run.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses a useful trait — every item is visibly marked with the >_ agent mark and this agent's name on every device — but says nothing about permissions, rate limits, or mutability, which matters for a write tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the verb and resource. Efficient overall, though the second sentence leans toward reassurance about attribution rather than operational guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the definition covers purpose and the visibility/attribution trait, and the schema fully documents parameters. However, it omits usage routing against siblings and deeper behavioral context such as auth or limits, leaving clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters are already documented in the schema. The description reinforces the text-vs-snippet distinction and the channel destination but adds no syntax or format detail beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Send a note' — and clarifies the payload variants (plain text or code snippet with language) plus the destination ('one of the owner's Zas channels'). It is clear, but it does not explicitly distinguish itself from siblings like zas_send_file or zas_send_direct, leaving the differentiation to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use, when-not-to-use, or alternative-tool guidance. It states the destination channel but never says when a note is preferable to zas_send_file or zas_send_direct, so the agent must guess from sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

zas_statusA

Say whether this agent is paired with a Zas account, and list the owner's channels it may send to or read from. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose a meaningful behavioral trait: the owner sees every item sent by this agent with the >_ agent mark and agent name on every device (an auditing/visibility property). It does not explicitly confirm the call is side-effect-free or describe behavior when unpaired.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose (pairing status plus channel list). The second sentence about owner-visible agent marking is somewhat tangential to invocation but adds legitimate context, so it earns its place without bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description must convey return content, and it does: pairing status plus the list of channels the agent may send to or read from. It omits the unpaired/error case and any note on caching or refresh, but is otherwise complete for a zero-parameter status tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema coverage is 100%, so the baseline is 4 and there are no parameter semantics for the description to add. Nothing is missing on this dimension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: reports whether the agent is paired with a Zas account and lists the owner's channels available for send/read. It is clearly distinguishable from zas_pair, but it never names a sibling or scope boundary explicitly, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is a status/introspection check, likely before sending. There is no explicit when-to-use, when-not, or alternative (e.g., 'use zas_pair if not yet paired'), so the guidance is adequate but thin.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 13 tool updatesv0.10.0
    • First observedzas_edit_item
    • First observedzas_get_item
    • First observedzas_jobs
    • First observedzas_list_items
    • First observedzas_pair
    • First observedzas_receive_direct
    • First observedzas_receive_direct_fallback
    • First observedzas_replace_file
    • First observedzas_send_direct
    • First observedzas_send_direct_fallback
    • First observedzas_send_file
    • First observedzas_send_note
    • First observedzas_status

TDQS

A4/5.0

Scored across 13 tools

Disambiguation5/5

Each tool targets a distinct action or resource: status/pairing, file sending, note sending, Directo transfer, fallback recovery, receiving, item listing/fetch/edit/replace, and job tracking. The descriptions explicitly separate modes (e.g., Directo vs stored delivery) so an agent can reliably choose the right tool.

Naming Consistency5/5

All 13 tools use the same zas_ prefix and lower snake_case convention, mostly following verb_noun patterns like zas_send_file, zas_list_items, and zas_get_item. The fallback tools extend the pattern predictably rather than introducing a new style.

Tool Count5/5

With 13 tools, the set fits comfortably in the well-scoped range and each tool appears to earn its place. The fallback and job-tracking tools support edge cases without bloating the surface unnecessarily.

Completeness4/5

The surface covers pairing, status, sending files and notes, Directo send/receive, fallback recovery, item listing/fetching/editing/replacing, and job tracking. The main gap is deletion or removal of items, though agents may work around this by editing or replacing where possible.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables secure credential storage for AI agents by encrypting secrets and providing agent-invisible references, ensuring sensitive data never leaks to the model.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to securely read and write to an Obsidian-compatible Markdown vault with per-agent access control, audit logging, and conflict resolution.
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables Claude Code agents to communicate across sessions, terminals, and repositories through shared channels with persistent context.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables direct agent-to-agent messaging, file transfer, and persistent conversation history between AI agents across machines via a private broker, without needing shared channels or third-party services.
    4 npm
    1
    MIT