Zas
NPM · ZAS-AGENT · SCANNED SEP 21
Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 172 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to soke1556/zas-agent). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 11 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1984 tokens (~152/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "zas_send_file" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Zas MCP server?
Zas runs locally as an npm package, launched with npx -y zas-agent. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · zas-agent
claude mcp add soke1556-zas-agent -- npx -y zas-agent
{
"mcpServers": {
"soke1556-zas-agent": {
"command": "npx",
"args": [
"-y",
"zas-agent"
]
}
}
} {
"servers": {
"soke1556-zas-agent": {
"command": "npx",
"args": [
"-y",
"zas-agent"
]
}
}
} codex mcp add soke1556-zas-agent -- npx -y zas-agent
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"soke1556-zas-agent": {
"type": "local",
"command": [
"npx",
"-y",
"zas-agent"
],
"enabled": true
}
}
} openclaw mcp add soke1556-zas-agent --command npx --arg -y --arg zas-agent
mcp_servers:
soke1556-zas-agent:
command: "npx"
args: ["-y", "zas-agent"] {
"McpServers": {
"soke1556-zas-agent": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"zas-agent"
]
}
}
} assistant mcp add soke1556-zas-agent -t stdio -c npx -a -y zas-agent
{
"mcpServers": {
"soke1556-zas-agent": {
"command": "npx",
"args": [
"-y",
"zas-agent"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Supply Chain Security rose 1.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 0
- Stability: 0.20 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 1561 → 1984 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.8.0 → 0.9.0 functional
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/zas-agent@0.9.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | soke1556/zas-agent |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/soke1556/zas-agent/.github/workflows/release.yml@refs/tags/v0.9.0 |
| Rekor log index | 2774624795 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:b3e59398f74be628f4dc1ae99c65e0fc811eb1be18eeb30c7fe37edb45b1b99fa8478ebf993ebe56d916cd0a963f75e968b228ecbcb75c2126c811a68 |
Background: How many MCP packages publish verified provenance →
Dependencies 172 packages
| Packages resolved | 172 |
|---|---|
| Stale | 51 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
zas_edit_item ~234
Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
| lang | string | – | Language of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text. |
| secret | boolean | – | Hide the body behind a cover until the reader opens it. False removes the cover. |
| text | string | – | New body, for a note. |
| title | string | – | New label. An empty string clears it, so the file name or the first line shows again. |
No output schema declared.
No examples provided.
zas_get_item ~155
Fetch one item from a Zas channel. A note comes back as text; a file is written to disk. Returns the path written; it can differ from `dest` when a file with that name already exists. Writes a new file under `dest` (or the system temp directory); it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | yes | Channel name or id. |
| dest | string | – | Where to write a file. A directory means "inside it". Defaults to a fresh temporary directory. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
No output schema declared.
No examples provided.
zas_jobs ~75
List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended — including any `job_id` a send returned; a finished job keeps its result here. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
zas_list_items ~86
List the most recent items in one of the owner's Zas channels. Needs a grant that includes reading. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | yes | Channel name or id. |
| limit | integer | – | How many items, 1 to 50. Defaults to 20. |
No output schema declared.
No examples provided.
zas_pair ~109
Pair this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, call again with `code`. In a profile that is already paired, approval replaces the old agent. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | The code the pairing page shows when the browser could not reach this machine. |
No output schema declared.
No examples provided.
zas_receive_direct ~186
Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| dest | string | – | Where to write the file. A directory means "inside it". Defaults to a fresh temporary directory. |
No output schema declared.
No examples provided.
zas_receive_direct_fallback ~115
After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job’s id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| job | string | yes | The job id zas_receive_direct or zas_jobs reported for the receive that failed. |
No output schema declared.
No examples provided.
zas_replace_file ~189
Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
| path | string | yes | Absolute or relative path of the new file. |
| title | string | – | New label. Defaults to the label the item has. |
No output schema declared.
No examples provided.
zas_send_direct ~163
Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| path | string | yes | Absolute or relative path of the file to send. |
No output schema declared.
No examples provided.
zas_send_direct_fallback ~158
After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| job | string | yes | The job id zas_send_direct or zas_jobs reported for the Directo send that failed. |
No output schema declared.
No examples provided.
zas_send_file ~233
Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| expires_in_days | integer | – | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p… |
| path | string | yes | Absolute or relative path of the file to send. |
| title | string | – | Label for the item. Defaults to the file name. |
No output schema declared.
No examples provided.
zas_send_note ~224
Send a note — plain text, or a code snippet with its language — into one of the owner's Zas channels. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| expires_in_days | integer | – | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p… |
| lang | string | – | Language of the snippet, for highlighting (for example "ts", "py"). |
| secret | boolean | – | Hide the body behind a cover until the reader opens it. |
| text | string | yes | The body of the note. |
| title | string | – | Label for the item. Defaults to the first line. |
No output schema declared.
No examples provided.
zas_status ~57
Say whether this agent is paired with a Zas account, and list the owner's channels it may send to or read from. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Zas MCP server?
Zas is an MCP server listed in the public MCP registry as io.github.soke1556/zas-agent. Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo. This page covers its npm package (zas-agent).
Is the Zas MCP server safe to use?
Zas scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zas MCP server expose?
Zas exposes 13 tools: zas_status, zas_pair, zas_send_file, zas_send_direct, zas_send_direct_fallback, and 8 more. Their descriptions and schemas cost roughly 1,984 tokens of context every time the server is loaded.
Is the Zas MCP server still maintained?
Zas is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Zas MCP server under?
Zas declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.