zas-agent
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@zas-agentsend this README to my Zas code channel"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
zas-agent
An MCP server that lets a coding agent — Claude Code, Codex, or anything that speaks MCP — send files and notes into your Zas channels, and read items back out of them.
What is Zas
Zas moves things between your devices and the people you choose: files, photos, text, code. You put something into a channel on one device and use it on another. Whatever you do not pin leaves on its own after a few days, so there is nothing to tidy up later. Everything is encrypted on the device before it is uploaded: the database and the object storage receive encrypted bytes, not filenames, content or previews.
This package is the piece that lets a coding agent use your channels the way your other devices do, under an identity of its own that you approve, that you scope to the channels you choose, and that you can revoke.
Related MCP server: brain-mcp
What it does
Your coding agent gets thirteen tools. It can send a file or a note into a channel you picked, send or receive a file live through Directo, list what is in that channel, pull one item back onto disk, and change what it sent: an item's title or text, or the bytes under a file, keeping the item id. Everything it sends is encrypted on your machine before it leaves, lands in your account, and is marked in the channel as sent by that agent. The agent has an identity of its own and never holds your account key: pairing mints a key pair here, you approve it from the web app, and from then on it signs a challenge to get a short-lived session.
Install
Install Node.js LTS (22 or newer) and your agent's command-line tool first. Reopen your terminal after installing. Run these commands on the computer where you use the agent.
Choose your agent and pair it. On Windows (PowerShell or CMD):
Codex
npx.cmd -y zas-agent@latest pair --profile codexClaude Code
npx.cmd -y zas-agent@latest pair --profile claude-codeOpen the printed link, approve the channels, and enter the code in the terminal if the page shows one. Leave the terminal open until pairing finishes. Then run the matching registration command:
Codex
cmd /d /c codex mcp add zas "--" npx.cmd -y zas-agent@latest --profile codexClaude Code
cmd /d /c claude mcp add zas "--" npx.cmd -y zas-agent@latest --profile claude-codeOn macOS, Linux, or WSL, use npx in place of npx.cmd and omit
cmd /d /c . Pair and register in the same environment. Restart your agent
and ask it to send something to Zas.
If a command is not recognized, install Node.js or the named agent's CLI and
reopen the terminal. The first download needs internet access and may take a
few minutes. Use @latest as shown so npm requests the published package
instead of selecting an unbuilt local workspace.
What pairing does
zas-agent pair mints the key pair, registers the public halves, opens the
approval page in your browser, and waits. The terminal shows:
Open this page signed in to your Zas account:
https://zas.red/agents/pair?p=...#port=53211
Fingerprint: 1a2b 3c4d 5e6f 7a8b
Waiting for approval… (expires in 10 minutes)Signed in, name the agent and tick the channels it may use — sending is the
default, reading is a separate switch — and approve. Approval creates
nothing by itself: the page hands a one-time claim code to this terminal
over 127.0.0.1 (the port in the link), and the agent exists only once the
terminal claims with that code and the secret it holds. A link that reached
somebody else is approved on their machine, where nothing listens, and
expires with nothing created.
If the browser cannot reach the terminal — the link was opened on a phone,
or the browser refused the local connection — the page shows the code and
the terminal asks for it. Type it there and nowhere else: with that code,
another terminal that started a pairing could claim it. Pass --no-open or
set ZAS_NO_OPEN=1 to keep the browser closed; the link is printed either
way. The pairing is good for ten minutes before approval and five after;
past that, run the command again.
You can also start the flow from the coding agent with the zas_pair tool:
the first call hands back the URL, a later call says whether the approval
landed, and if the page shows a code, a call with code claims with it.
Why you can trust it
Every line here is a fact. The ones about this package you can check in this repository. Where a property is enforced by the Zas server, which is not open source, the sentence says so.
The agent has an identity of its own.
zas-agent pairgenerates two key pairs on your machine — X25519 to receive channel keys, P-256 to sign sign-ins — and the private halves never leave it. The agent never holds your account key, and the key-derivation service refuses account-key derivation to an agent (server-side).You approve it, and you choose the channels. Pairing never auto-approves. The approval page shows the harness, the host and the key fingerprint, and nothing exists until the terminal that started the pairing claims it with a code only the approving page received (server-side). A pairing link sent to you by someone else creates nothing on your account.
It holds one key per granted channel, and no key for any other. Each grant carries that channel's key sealed to the agent's X25519 public key. A channel you did not grant has no key here to decrypt with, and the server checks the live grant on every request (server-side).
No password and no API key. Signing in is a signed challenge traded for a one-hour token. There is no password, no API key and no refresh token on disk: the agent re-signs from its P-256 key when the token ages out.
Everything it sends is visible as its work. Every item carries the
>_agent mark and the agent's name, in the channel, on every device you read Zas from.You can revoke it at any time. Settings → Agents → the agent → Revoke. The session stops, its refresh tokens are revoked (server-side), and the next tool call answers "the owner revoked this agent". What it already sent stays where it is. You can also drop a single channel and keep the rest.
Content is encrypted on your machine before it leaves, the same way the app does it. The chunking, the manifest and the envelope formats under
src/shared/are the same modules the Zas web app ships. The server stores ciphertext and never sees a channel key, a channel name or item plaintext (server-side).The source is here, and the releases are built from it. Every npm release is published by the
release.ymlworkflow in this repository, with npm provenance, so the tarball on npm can be traced back to a commit and a workflow run.
What it cannot do
The package refuses some of these on its own, before a request is made. The ones marked (server-side) are enforced by the Zas server.
No channel you did not grant. Not by name, not by id.
No shared channel you joined, unless its owner allows it. You can grant a channel you joined, but the grant stays
grant_pendinguntil that channel's owner allows this agent in Zas. The plan also caps how many of these channels one agent holds: 2 on Free (server-side).No workspace channel, unless the organization allows agents. A channel an organization manages, or one you created inside its workspace, can be granted only while the organization is active and an admin turned agents on (server-side).
No reading unless the grant says so.
readis a separate switch fromsend; without it,zas_list_itemsandzas_get_itemare refused.No stored sending into a view-only channel, and none into a channel in Directo mode. Both are refused before a byte is uploaded. A channel in Directo mode takes
zas_send_direct, a live transfer that stores nothing.No changing what it did not send.
zas_edit_itemandzas_replace_fileact only on items carrying this agent's mark; anything else isnot_yours, and the server refuses it too (server-side). A replace is for agents only: no web or mobile client gets one. An item with a public share is not replaced until the share is removed.No receiving unless the grant says read. Receiving through Directo writes a file onto this machine, so
zas_receive_directtakes the samereadswitch as listing. And it only ever runs inside a tool call: the agent never watches your channels, so nothing arrives unasked.Nothing outside its allowlist. The API refuses an agent on every route that is not on a short, explicit list, and Firestore rules refuse it your account document, your devices, and any channel without an active read grant (server-side).
Rate limited by the server, on its own buckets, with the key-derivation budget charged to your account so ten agents are not ten times your own allowance (server-side).
As many agents as your plan or your organization allows (server-side).
Files up to 5 GiB, and in practice less: the agent reads a file into memory to hash it, so the machine's memory is the real ceiling.
The error vocabulary
The agent answers in a closed set of codes. Anything a server route says that
is not in this set collapses to upload_failed or network, so no raw server
string ever reaches a terminal.
Code | What it means |
| This agent is not paired yet. |
| The identity file on disk is damaged. |
| The owner revoked this agent. |
| Only the account owner can do that. |
| This agent has no access to that channel. |
| That channel belongs to somebody else, and its owner has not allowed this agent yet. |
| This agent cannot send to that channel. |
| This agent cannot read that channel. |
| That channel is in Directo mode. |
| That channel is not in Directo mode. |
| Nobody received the file within ten minutes; the offer was withdrawn. |
| Nobody offered a file through Directo while the call waited. |
| Another device received that file first. |
| The offer was cancelled from the other side. |
| The Directo transfer failed in flight. |
| That job is not a Directo transfer that failed in flight. |
| The file changed since the Directo offer. |
| The WebRTC engine could not be loaded on this machine. |
| Reliable delivery is not available right now. |
| The channel key changed; the owner refreshes it by opening Zas. |
| The account reached its storage limit. |
| The organization's plan is inactive, so sending to its channels is paused; the owner or a billing admin reactivates it. |
| Too many sends in a row. |
| The file is over the plan limit. |
| That item is already in the channel. |
| That item is not in the channel. |
| That item was not sent by this agent; it can only change its own items. |
| That item changed while this agent was working on it; read it again and retry. |
| That item is a file, not a note; only its title can change. |
| That item is a note, not a file. |
| That item has a public share; the owner removes the share first. |
| That file is no longer available. |
| The download destination could not be written. |
| The pairing expired; pair again. |
| The owner cancelled the pairing. |
| The code does not match. |
| Nobody has approved this pairing yet. |
| This pairing was already claimed; pair again. |
| The account cannot take another agent; the owner deletes one from Settings → Agents. |
| The plan allows fewer channels per agent than this pairing grants. |
| The plan allows this agent fewer channels of other people than this pairing asks for. |
| Agents are not enabled for this account yet. |
| The upload failed. |
| Zas did not answer correctly while preparing the file. |
| Zas cannot be reached. |
| Zas did not accept this agent session. |
| Zas rejected this agent's signature; pair it again. |
| The session token is missing; pair the agent again. |
| Something failed inside the agent. |
Every code comes back as one sentence in English, never as a stack trace.
Tools
Tool | What it does |
| Says whether this agent is paired with a Zas account, and lists the owner's channels it may send to or read from. |
| Pairs this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, a call with |
| Sends a file from this machine into one of the owner's channels. Returns the item id, or a job id when the upload takes longer than a minute. |
| Sends a note — plain text, or a code snippet with its language — into one of the owner's channels. |
| Sends a file through Directo: a live, device-to-device transfer into a channel in Directo mode. Nothing is stored. The owner presses Receive on another device within ten minutes; the call returns the result, or a job id after a minute. |
| After a Directo send failed in flight, delivers the same file through reliable delivery: encrypted on this machine, stored in Cloudflare R2 for up to 24 hours, off the owner's quota. The owner's choice; the model is told to ask. |
| Receives a file the owner sends through Directo, onto this machine. Waits for the offer, takes it, and writes the file to disk. Needs a grant that includes reading, and a channel in Directo mode. Returns the path written, or a job id after a minute. |
| After a Directo receive failed in flight, downloads the encrypted copy the sender chose to store, and decrypts it to the same destination. |
| Lists the most recent items in one of the owner's channels. Needs a grant that includes reading. |
| Fetches one item. A note comes back as text; a file is written to disk. It never overwrites, so the path it answers with can differ from the one you asked for. |
| Changes an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Needs a grant that includes reading and sending. The owner's activity log records it. |
| Replaces the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Returns the item id, or a job id after a minute. Refuses notes, shared items, and items sent by anyone else. |
| Lists the sends and Directo transfers this server started, newest first, with the phase each one reached — and where a |
channel takes a channel name or a channel id. A name has to match exactly one
of the channels you granted; with exactly one grant, zas_send_file,
zas_send_note, zas_send_direct, zas_receive_direct, zas_edit_item and
zas_replace_file can leave it out.
A replace runs the same pipeline as a send — hash, key derivation, encryption,
then upload or proof per chunk — and posts the new set with the old one to
release. The server moves both sets, the account's storage tally and the item
in one transaction, so a failure leaves everything as it was; a chunk present
in both versions is neither uploaded nor released. Both tools read the item
first and write only over the version they read: an item that changed in
between answers stale, and nothing is lost.
Directo needs a native module, node-datachannel,
WebRTC for Node. npm installs a prebuilt binary for Windows, macOS and Linux;
the module loads the first time a Directo tool runs, and a machine where it
cannot load answers webrtc_unavailable. Every other tool works without it.
Two things worth knowing before you point a model at your account:
zas_send_fileandzas_send_directsend any file this process can read —~/.ssh/id_rsaand a.envincluded. Confirm with the owner before sending secrets, keys or credentials. Its tool description says so, so the model reads it too.zas_get_itemandzas_receive_directwrite a new file underdest, or under the system temp directory when you leavedestout. Neither ever overwrites an existing file: a name that is taken gets a suffix, and the path they answer with is the one they actually wrote.
Everything those tools touch lands inside your own account and your own machine. Revoking the agent stops all of them.
What it sends back
This package reports how it is used, so defects like a release that could not receive a file at all stop being invisible. It is on by default and it is yours to turn off:
npx -y zas-agent telemetry off # and `on` again, and `telemetry` to seeZAS_AGENT_TELEMETRY=0 and the cross-vendor DO_NOT_TRACK=1 do the same
without writing anything. The choice lives in ~/.zas/agent/settings.json and
covers every profile on the machine; pairing again does not reset it.
zas_status always says which way it is set.
What one report carries, and nothing else: the tool that ran, whether it worked, the closed error code when it did not, which of four duration buckets it fell in, and the package version. Item transfers also report item category, transport, byte counts, stage durations, and success/failure/cancellation, joined by a random per-attempt ID. No file name, no file contents, no path, no channel name, no error message, no stack.
Where it goes: to Zas, never to an analytics service directly. This package holds no analytics token and opens no connection to a third party, so no address of yours reaches one. The report is attributed to the Zas account the agent is paired with, which the server reads from the session — the request carries no account or content identifier. Nothing is reported before pairing, because until then there is no account it could belong to.
A report is never allowed to matter: it is sent after the answer, waited on for at most five seconds, tried once, and dropped in silence if it fails.
Data on disk
One directory per profile, so one machine can hold a Claude Code agent and a Codex agent side by side without either reading the other's keys:
OS | Path |
macOS, Linux |
|
Windows |
|
Four files in the profile directory, all written through a temporary file and renamed into place, so a crash mid-write cannot leave half a file behind:
identity.json— the agent uid, the owner uid, the name, and the two key pairs. Back it up like a private key, or delete it and pair again.pending.json— a pairing that has not been claimed yet. Removed on completion, and on a pairing that expired or was cancelled.grants.json— a one-minute cache ofGET /v1/agents/me: which channels, and the sealed key for each. The channel name stays encrypted here. Disposable.fingerprints.json— hashes of what an identical send produced in the last ten minutes, so a retried tool call answers without touching the network. It stores hashes, never a title or a note's first line. Disposable.
One more file sits next to the profiles, in ~/.zas/agent/:
settings.json— whether this machine reports usage, and when the notice above was last printed. It belongs to the machine, not to a profile, so one decision covers every agent on it.
On macOS and Linux the directory is created 0700 and every file 0600. On
Windows those bits have no effect: the files carry the permissions of the user
profile they live in, and the package does not try to set any others.
Deleting the directory makes this machine forget the agent. It does not revoke anything: the account side is closed from the web app, under Settings → Agents → Revoke.
Pairing again
A pairing is one profile's key pair, not the machine and not the program. A
profile holds one agent. Running zas-agent pair in a profile that is already
paired opens a replacement: the terminal signs the request with the old
identity, the approval page says which agent it replaces and fills in its name
and channels, and the old agent is revoked in the same step that creates the
new one. Its row stays under Settings → Agents as revoked until you remove it,
and it keeps costing a slot until then. If the old agent was already revoked
or removed, pair says so and creates a new agent.
One machine that runs Claude Code and Codex has two profiles (claude-code
and codex), two agents, two approvals and two rows. Revoking one does not
touch the other. Two programs pointed at the same --profile act as one
agent: same keys, same channels, one row.
Configuration
Setting | Default | What it changes |
|
| Which identity directory this process uses. Letters, digits, |
|
| Where the profile directories live. |
| unset |
|
| unset |
|
|
| The web app the pairing URL points at. |
|
| The API. |
|
| The challenge and token routes. |
|
| The blind key-derivation service. |
|
| The project whose Firestore the read path queries. |
| the public web key | The key used to exchange a custom token for a session. |
Only --profile, ZAS_AGENT_HOME and the two telemetry switches are worth
setting by hand. The rest exist
so the package can be pointed at a test deployment.
Development
git clone https://github.com/soke1556/zas-agent
cd zas-agent
npm ci
npm test
npm run typecheck
npm run build
node dist/cli.js --versionThis repository is the public mirror of the agent/ package of Zas's private
monorepo. It is produced by scripts/export-public.mjs, which builds the
package with esbuild and uses the build's own metafile to decide what to copy:
src/, test/, the package files, and the nine src/shared/* modules the
agent imports. Those shared modules are the client-side crypto and format code — the
chunker, the manifest, the envelope, the key derivation — that the Zas web app
also ships, which is why the encryption the agent performs is the encryption the
app performs. The Zas server is not open source.
Pull requests are welcome against this repository. The maintainer applies accepted changes back into the monorepo, and the next export brings them here. See CONTRIBUTING.md.
Security
Please report vulnerabilities privately. SECURITY.md says how, and what to expect.
License
MIT. See LICENSE.
Available Tools
13 toolszas_edit_itemA
Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Item id, as `zas_list_items` reports it. | |
| lang | No | Language of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text. | |
| text | No | New body, for a note. | |
| title | No | New label. An empty string clears it, so the file name or the first line shows again. | |
| secret | No | Hide the body behind a cover until the reader opens it. False removes the cover. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and does so well: it discloses the authorization grant required, the ownership restriction that causes refusal, the empty-value clearing semantics, and the side effect that the owner sees every sent item marked with the agent name on every device. This is far beyond what structured fields provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and scope are front-loaded in the first clause, and every sentence carries information. The middle sentences are dense compound statements, but no sentence is filler; slight tightening would help readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description covers authorization, ownership refusal, partial-update semantics, and visibility side effects. Nothing an agent needs to call it correctly is missing, and return-value documentation is unnecessary here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds real meaning the schema lacks: PATCH-style semantics ('Pass only the fields to change') and the behavior of empty values ('an empty title clears it'), which qualifies the schema's per-field descriptions rather than repeating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Change an item this agent sent, keeping its id') and enumerates exactly which fields are editable (title, text, language, secret cover). It explicitly carves out the sibling boundary by noting file bytes change with zas_replace_file, so an agent can distinguish it from the other 12 tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit preconditions ('Needs a grant that includes reading and sending'), an exclusion ('Refuses items sent by anyone else'), and an alternative ('A file's bytes change with zas_replace_file'). It also specifies partial-update usage ('Pass only the fields to change'), leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_get_itemA
Fetch one item from a Zas channel. A note comes back as text; a file is written to disk. Returns the path written; it can differ from dest when a file with that name already exists. Writes a new file under dest (or the system temp directory); it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Item id, as `zas_list_items` reports it. | |
| dest | No | Where to write a file. A directory means "inside it". Defaults to a fresh temporary directory. | |
| channel | Yes | Channel name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does real work: it discloses that notes come back as text while files are written to disk, that it never overwrites an existing file, that the returned path can differ from dest, and that the default destination is a temp directory. It omits auth/permission needs, but the destructive-safety profile is well covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core action is front-loaded and the file-writing caveats follow logically. The closing sentence about the owner seeing every item this agent sends is tangential for a fetch tool and is the one sentence that does not clearly earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly explains the return value (the written path, which may differ from dest) and the note-vs-file duality. It is essentially complete for correct invocation, missing only edge behavior such as what happens when the id does not exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents channel, id, and dest semantics. The description's added detail ('writes a new file under dest... never overwrites') is really return-value behavior rather than new parameter meaning, so the baseline 3 holds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Fetch one item from a Zas channel.' The word 'one' implicitly contrasts with the sibling zas_list_items, so an agent can distinguish retrieval-by-id from enumeration without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the tool is clearly for pulling a single item given a channel and id. There is no explicit when-to-use/when-not guidance and no pointer to alternatives such as zas_list_items for discovering ids, so the agent must infer routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_jobsA
List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended — including any job_id a send returned; a finished job keeps its result here. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full burden, and it does disclose meaningful traits: results are ordered newest-first, each entry carries the phase reached and how it ended, returned job_ids are surfaced, and completed jobs retain their results here. It also notes the visibility model (owner sees items with the agent mark/name on every device). It stops short of stating read-only safety, pagination, or result limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and ordering. The second sentence about owner visibility is the least essential and slightly tangential, but it is short and not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only list tool with no output schema and no annotations, the description covers the important ground: what is listed, ordering, per-item fields, job_id retention, and result persistence. Missing only operational details such as pagination or result-count limits.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is no schema-level parameter meaning to add or compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('List') and resource ('the sends and Directo transfers this server started'), plus the ordering ('newest first') and the fields surfaced (phase, outcome, job_id). It is clearly distinguishable from write-oriented siblings like zas_send_direct, though it never names a sibling to sharpen the boundary against zas_list_items or zas_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'a finished job keeps its result here' suggests this is where you check the outcome of a prior send, but there is no explicit when-to-use, when-not-to-use, or named alternative (e.g. zas_status) to route the agent. The final sentence adds context but not selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_list_itemsA
List the most recent items in one of the owner's Zas channels. Needs a grant that includes reading. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many items, 1 to 50. Defaults to 20. | |
| channel | Yes | Channel name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose a real behavioral requirement (a reading grant is needed) and a visibility trait (the owner sees items with the agent mark on every device), which is useful. However it omits return format, pagination/cursor behavior, and ordering caveats beyond 'most recent'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, purpose front-loaded, and the permission constraint follows closely. The final sentence about device-wide agent marking is somewhat tangential but does carry transparency value, so it earns its place marginally.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema and no annotations, the description covers the essential purpose and the key permission prerequisite. It is nearly complete; only return/pagination detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: 'limit' documents its 1-50 range and default of 20, and 'channel' documents name-or-id. The description adds no parameter meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('items in one of the owner's Zas channels'), with the 'most recent' scoping. It is distinguishable from the singular zas_get_item and the send_* siblings, though it doesn't explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a prerequisite ('Needs a grant that includes reading') but offers no explicit when-to-use-vs-alternatives guidance, e.g. versus zas_get_item or the receive_direct tools. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_pairA
Pair this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, call again with code. In a profile that is already paired, approval replaces the old agent. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | The code the pairing page shows when the browser could not reach this machine. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that this is a stateful, multi-call flow, that re-approval replaces the prior agent, and the side effect that the owner sees every item this agent sends (with the >_ mark and agent name) on all devices. It omits auth/permission requirements and failure behavior, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences with the core purpose front-loaded, then the protocol, the code branch, and the re-pairing case. The closing sentence about cross-device visibility is slightly tangential but still earns its place as behavioral context; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 1-optional-param pairing tool with no output schema and no annotations, the description covers the interaction sequence, the code parameter's role, re-pairing semantics, and the resulting visibility. It is close to complete, missing only error/permission handling an agent might want.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real value beyond the schema text: it explains the conditional trigger for `code` ('If the page shows a code, call again with `code`'), tying the optional parameter to a runtime condition rather than just its content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Pair this agent with a Zas account.' This is unambiguous and clearly distinct from the sibling send/receive/status tools, none of which handle account pairing. An agent can tell what this tool is for without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It lays out the multi-call protocol clearly: first call returns a URL for the owner, a later call reports approval, and a code-bearing page means calling again with `code`. It also notes the already-paired case (approval replaces the old agent). It stops short of naming explicit alternatives or when-not-to-call, but the when/how context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_receive_directA
Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| dest | No | Where to write the file. A directory means "inside it". Defaults to a fresh temporary directory. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the one-minute call timeout, the ten-minute offer wait, the returned job id to poll via zas_jobs, the returned path, the no-overwrite guarantee, and that nothing is stored. It does not describe failure/timeout outcomes when no offer arrives, which is the main remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then trigger, then constraints, then return/behavior — good ordering. The closing sentence about the owner seeing items "this agent sends" with the >_ mark concerns sends, not receives, so it is slightly off-topic for this tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by stating the return value (path written) and the async job-id pattern. Combined with timing and permission preconditions, an agent has nearly everything needed, missing only explicit error/no-offer handling and sibling disambiguation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (dest, channel), and the description adds only indirect hints ("writes the file to disk", "returns the path written") without new syntax or default semantics. Baseline 3 applies since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource (receive a file the owner sends through Directo) and the effect (written to disk on this machine). It is distinguishable from zas_send_direct and zas_send_file, but never mentions zas_receive_direct_fallback, which is the closest alternative an agent would need to disambiguate from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Call it when the owner says they are sending you something" gives a clear trigger, and preconditions are spelled out: Directo-mode channel only, grant must include reading. No exclusion or explicit fallback routing is provided, so the agent cannot tell when to prefer zas_receive_direct_fallback instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_receive_direct_fallbackA
After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job’s id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| job | Yes | The job id zas_receive_direct or zas_jobs reported for the receive that failed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden and it does well: it discloses that decryption happens locally, that the file is written to the same destination, and the reliable-delivery precondition. It omits what happens if the precondition is unmet (error vs. silent no-op) and whether the download is idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The functional content is front-loaded and clear, but the final sentence about the owner seeing items with the agent mark and name is tangential marketing copy that dilutes the definition and doesn't help the agent invoke the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description covers trigger, precondition, and side effects (local decryption, write destination) adequately. Missing only failure semantics when the precondition isn't met.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already defines the single 'job' parameter with a clear description. The description adds the provenance of the id ('the failed job's id'), which is mildly useful routing context but essentially restates the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (download) and resource (the encrypted stored copy) and ties it to a precise triggering condition (after a zas_receive_direct job failed in flight). The link to the named sibling zas_receive_direct makes the relationship unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly conditions use on two things: a prior zas_receive_direct failure and the sender having chosen reliable delivery for that transfer. It also names the required argument (the failed job's id), so the agent knows exactly when this applies and what to supply.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_replace_fileA
Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Item id, as `zas_list_items` reports it. | |
| path | Yes | Absolute or relative path of the new file. | |
| title | No | New label. Defaults to the label the item has. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so richly: refusals (foreign items, notes, publicly shared items), the dual return shape (item id, or job id for uploads over a minute), and the owner-visible agent mark across devices. These are exactly the operational facts an agent needs before invoking a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each front-loaded with a distinct fact: what it does, what it refuses, what it returns, and the visibility/safety caveat. No filler and nothing repeated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter mutation tool with no annotations and no output schema, the description supplies the missing pieces an agent needs: refusal conditions, return value semantics including the async job-id case, and a safety warning. Nothing material is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so id, path, title, and channel are already documented in the schema. The description reinforces that the item id must match an item the agent itself sent and that channel is optional only with a single channel, but adds no syntax or format detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource: replacing the bytes of a file the agent previously sent, from a local path. It also names the preserved attributes (item id, channel position, pin), which distinguishes it from zas_edit_item (metadata edits) and zas_send_file (new item). An agent can differentiate it from siblings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly delineates when this tool refuses to act: items sent by anyone else, notes, and items with a public share, plus a pre-send caution about secrets/keys/credentials. It does not, however, explicitly name the alternative tools (e.g. zas_edit_item for metadata, zas_send_file for new uploads), leaving the agent to infer the boundary from the refusal list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_send_directA
Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path of the file to send. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does: 'Nothing is stored', a one-minute synchronous wait followed by a job id, a ten-minute owner receive window, owner visibility with the >_ agent mark and agent name on every device, and a cautions note about secrets/keys/credentials. These are exactly the behavioral traits an agent needs before firing the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the mechanism and the key timing constraint, and most sentences earn their place. The trailing sentence about the >_ agent mark and agent name on every device is awareness-heavy but still operationally relevant; overall slightly long but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but the description explains both possible returns (transfer result or job id) and names zas_jobs for polling, covering the return contract. The remaining gap is failure/fallback behavior: the existence of zas_send_direct_fallback is never acknowledged, so an agent hitting a failed transfer has no stated next step.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters (path, channel) are already documented in the schema. The description adds only that it sends 'any file this process can read', which marginally constrains path but adds no syntax or format detail. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (send) and resource (a file) and immediately qualifies the mechanism: a live device-to-device transfer into a channel in Directo mode. That mechanism distinguishes it from siblings like zas_send_file and zas_send_direct_fallback without needing their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions and context: the target channel must be in Directo mode and the owner must press Receive on another device within ten minutes. It routes to zas_jobs for status, but never states when to prefer zas_send_file or zas_send_direct_fallback instead, so the alternative-selection guidance is incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_send_direct_fallbackA
After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| job | Yes | The job id zas_send_direct or zas_jobs reported for the Directo send that failed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and delivers: local encryption, storage of only the encrypted copy in Cloudflare R2, a 24-hour retention window, no consumption of owner space, download by the claiming device, and the behavioral shift that bytes now pass through storage. It also discloses owner visibility via the agent mark.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and trigger are front-loaded and most sentences carry distinct information. A few clauses are conversational ('This stops being Directo', 'it is their choice') and could be tightened without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers trigger, consent gate, encryption/storage mechanics, retention, and visibility for a tool with no annotations and no output schema. It omits what the call returns and what happens to the original failed job, which would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single job parameter is fully documented in the schema. The description's 'Pass the failed job's id' restates rather than extends that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (deliver), resource (the same file), and a precise trigger condition (after a zas_send_direct job failed in flight), which distinguishes it cleanly from zas_send_direct and zas_receive_direct_fallback. An agent can identify the scenario without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('after a zas_send_direct job failed in flight') and a hard prerequisite ('Ask the owner before you use it; it is their choice'). It also names the originating tool whose failure selects this path, so the when-to-use decision is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_send_fileA
Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path of the file to send. | |
| title | No | Label for the item. Defaults to the file name. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. | |
| expires_in_days | No | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the plan grants. Worth setting for output that is stale tomorrow, such as a build log or a test run. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses the async return shape (item id, or a job id when the upload exceeds a minute), a hard refusal condition for Directo channels, a capability boundary ('any file this process can read'), and an audit/visibility behavior ('owner sees every item ... with the >_ agent mark and this agent's name, on every device').
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four compact sentences, each carrying distinct information (action, return shape, refusal/alternative, safety warning, visibility), with the core action front-loaded and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description must cover both; it explains the return values (item id vs job id), the refusal path, and the safety/visibility implications. Nothing an agent needs to invoke this correctly appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the description adds meaning beyond it by tying the `channel` parameter to the Directo-mode refusal and by characterizing `path` as limited to files 'this process can read'. It does not restate the `expires_in_days` clamping semantics, but the schema already covers that well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with scope: 'Send a file from this machine into one of the owner's Zas channels.' It also explicitly differentiates from a sibling by noting that a channel in Directo mode refuses this tool and that zas_send_direct should be used there.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit exclusion rule ('A channel in Directo mode refuses this tool: use zas_send_direct there') naming the alternative tool, plus a safety precondition ('confirm with the owner before sending secrets, keys or credentials'). Both when-not-to-use and the alternative are stated outright.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_send_noteB
Send a note — plain text, or a code snippet with its language — into one of the owner's Zas channels. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
| lang | No | Language of the snippet, for highlighting (for example "ts", "py"). | |
| text | Yes | The body of the note. | |
| title | No | Label for the item. Defaults to the first line. | |
| secret | No | Hide the body behind a cover until the reader opens it. | |
| channel | No | Channel name or id. Optional when the agent holds exactly one channel. | |
| expires_in_days | No | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the plan grants. Worth setting for output that is stale tomorrow, such as a build log or a test run. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses a useful trait — every item is visibly marked with the >_ agent mark and this agent's name on every device — but says nothing about permissions, rate limits, or mutability, which matters for a write tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the verb and resource. Efficient overall, though the second sentence leans toward reassurance about attribution rather than operational guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the definition covers purpose and the visibility/attribution trait, and the schema fully documents parameters. However, it omits usage routing against siblings and deeper behavioral context such as auth or limits, leaving clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are already documented in the schema. The description reinforces the text-vs-snippet distinction and the channel destination but adds no syntax or format detail beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Send a note' — and clarifies the payload variants (plain text or code snippet with language) plus the destination ('one of the owner's Zas channels'). It is clear, but it does not explicitly distinguish itself from siblings like zas_send_file or zas_send_direct, leaving the differentiation to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use, when-not-to-use, or alternative-tool guidance. It states the destination channel but never says when a note is preferable to zas_send_file or zas_send_direct, so the agent must guess from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zas_statusA
Say whether this agent is paired with a Zas account, and list the owner's channels it may send to or read from. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a meaningful behavioral trait: the owner sees every item sent by this agent with the >_ agent mark and agent name on every device (an auditing/visibility property). It does not explicitly confirm the call is side-effect-free or describe behavior when unpaired.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose (pairing status plus channel list). The second sentence about owner-visible agent marking is somewhat tangential to invocation but adds legitimate context, so it earns its place without bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description must convey return content, and it does: pairing status plus the list of channels the agent may send to or read from. It omits the unpaired/error case and any note on caching or refresh, but is otherwise complete for a zero-parameter status tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so the baseline is 4 and there are no parameter semantics for the description to add. Nothing is missing on this dimension.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: reports whether the agent is paired with a Zas account and lists the owner's channels available for send/read. It is clearly distinguishable from zas_pair, but it never names a sibling or scope boundary explicitly, so it stops short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is a status/introspection check, likely before sending. There is no explicit when-to-use, when-not, or alternative (e.g., 'use zas_pair if not yet paired'), so the guidance is adequate but thin.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
13 tool updates
v0.10.0- First observed
zas_edit_item - First observed
zas_get_item - First observed
zas_jobs - First observed
zas_list_items - First observed
zas_pair - First observed
zas_receive_direct - First observed
zas_receive_direct_fallback - First observed
zas_replace_file - First observed
zas_send_direct - First observed
zas_send_direct_fallback - First observed
zas_send_file - First observed
zas_send_note - First observed
zas_status
TDQS
Scored across 13 tools
Each tool targets a distinct action or resource: status/pairing, file sending, note sending, Directo transfer, fallback recovery, receiving, item listing/fetch/edit/replace, and job tracking. The descriptions explicitly separate modes (e.g., Directo vs stored delivery) so an agent can reliably choose the right tool.
All 13 tools use the same zas_ prefix and lower snake_case convention, mostly following verb_noun patterns like zas_send_file, zas_list_items, and zas_get_item. The fallback tools extend the pattern predictably rather than introducing a new style.
With 13 tools, the set fits comfortably in the well-scoped range and each tool appears to earn its place. The fallback and job-tracking tools support edge cases without bloating the surface unnecessarily.
The surface covers pairing, status, sending files and notes, Directo send/receive, fallback recovery, item listing/fetching/editing/replacing, and job tracking. The main gap is deletion or removal of items, though agents may work around this by editing or replacing where possible.
Maintenance
Related MCP Connectors
End-to-end encrypted messaging and work coordination for autonomous AI agents.
Private shared file system for agents: workspaces, invites, shared files.
Encrypted A2A object storage for autonomous agent state and artifacts
Private, permanent encrypted storage for AI agents. Paid per call in USDC via x402.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables secure credential storage for AI agents by encrypting secrets and providing agent-invisible references, ensuring sensitive data never leaks to the model.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to securely read and write to an Obsidian-compatible Markdown vault with per-agent access control, audit logging, and conflict resolution.Apache 2.0
- AlicenseNot gradedqualityDmaintenanceEnables Claude Code agents to communicate across sessions, terminals, and repositories through shared channels with persistent context.MIT
- AlicenseNot gradedqualityBmaintenanceEnables direct agent-to-agent messaging, file transfer, and persistent conversation history between AI agents across machines via a private broker, without needing shared channels or third-party services.4 npm1MIT