Zas
NPM · ZAS-AGENT
Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo.
Available components
Last scanned (3 hours ago)
Scores higher than 94% of npm servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 138 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to soke1556/zas-agent). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1984 tokens (~152/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "zas_send_file" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −4
- Stability: pass → 0.73 functional
- 29 Oct 26 +6
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- CVE-2023-54404 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.11.0 → 0.12.0 functional
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 23 Oct 26 +1
- Stability: 0.97 → pass security
- 22 Oct 26 −1
- Stability: pass → 0.97 functional
- 16 Oct 26 +1
- Stability: 0.97 → pass security
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Analysed npm/zas-agent@0.12.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | soke1556/zas-agent |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/soke1556/zas-agent/.github/workflows/release.yml@refs/tags/v0.12.0 |
| Rekor log index | 3570443255 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:622540f7f521732c7b13090e043f40a38a82d455dab1a21095be4d1e1434d255289b79159b25c6c68e4c359e5b6bc6cc1f63fe7d30067caa47233cfd4 |
Background: How many MCP packages publish verified provenance →
Dependencies 138 packages
| Packages resolved | 138 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
zas_edit_item ~234
Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
| lang | string | – | Language of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text. |
| secret | boolean | – | Hide the body behind a cover until the reader opens it. False removes the cover. |
| text | string | – | New body, for a note. |
| title | string | – | New label. An empty string clears it, so the file name or the first line shows again. |
No output schema declared.
No examples provided.
zas_get_item ~155
Fetch one item from a Zas channel. A note comes back as text; a file is written to disk. Returns the path written; it can differ from `dest` when a file with that name already exists. Writes a new file under `dest` (or the system temp directory); it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | yes | Channel name or id. |
| dest | string | – | Where to write a file. A directory means "inside it". Defaults to a fresh temporary directory. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
No output schema declared.
No examples provided.
zas_jobs ~75
List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended — including any `job_id` a send returned; a finished job keeps its result here. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
zas_list_items ~86
List the most recent items in one of the owner's Zas channels. Needs a grant that includes reading. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | yes | Channel name or id. |
| limit | integer | – | How many items, 1 to 50. Defaults to 20. |
No output schema declared.
No examples provided.
zas_pair ~109
Pair this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, call again with `code`. In a profile that is already paired, approval replaces the old agent. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | The code the pairing page shows when the browser could not reach this machine. |
No output schema declared.
No examples provided.
zas_receive_direct ~186
Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| dest | string | – | Where to write the file. A directory means "inside it". Defaults to a fresh temporary directory. |
No output schema declared.
No examples provided.
zas_receive_direct_fallback ~115
After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job’s id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| job | string | yes | The job id zas_receive_direct or zas_jobs reported for the receive that failed. |
No output schema declared.
No examples provided.
zas_replace_file ~189
Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| id | string | yes | Item id, as `zas_list_items` reports it. |
| path | string | yes | Absolute or relative path of the new file. |
| title | string | – | New label. Defaults to the label the item has. |
No output schema declared.
No examples provided.
zas_send_direct ~163
Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| path | string | yes | Absolute or relative path of the file to send. |
No output schema declared.
No examples provided.
zas_send_direct_fallback ~158
After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| job | string | yes | The job id zas_send_direct or zas_jobs reported for the Directo send that failed. |
No output schema declared.
No examples provided.
zas_send_file ~233
Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| expires_in_days | integer | – | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p… |
| path | string | yes | Absolute or relative path of the file to send. |
| title | string | – | Label for the item. Defaults to the file name. |
No output schema declared.
No examples provided.
zas_send_note ~224
Send a note — plain text, or a code snippet with its language — into one of the owner's Zas channels. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Channel name or id. Optional when the agent holds exactly one channel. |
| expires_in_days | integer | – | How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p… |
| lang | string | – | Language of the snippet, for highlighting (for example "ts", "py"). |
| secret | boolean | – | Hide the body behind a cover until the reader opens it. |
| text | string | yes | The body of the note. |
| title | string | – | Label for the item. Defaults to the first line. |
No output schema declared.
No examples provided.
zas_status ~57
Say whether this agent is paired with a Zas account, and list the owner's channels it may send to or read from. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Zas MCP server?
Zas runs locally as an npm package, launched with npx -y zas-agent --profile claude-code. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
npm · zas-agent
claude mcp add soke1556-zas-agent -- npx -y zas-agent --profile claude-code
What is the Zas MCP server?
Zas is an MCP server listed in the public MCP registry as io.github.soke1556/zas-agent. Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo. This page covers its npm package (zas-agent).
Is the Zas MCP server safe to use?
Zas scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 6 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zas MCP server expose?
Zas exposes 13 tools: zas_status, zas_pair, zas_send_file, zas_send_direct, zas_send_direct_fallback, and 8 more. Their descriptions and schemas cost roughly 1,984 tokens of context every time the server is loaded.
Is the Zas MCP server still maintained?
Zas is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Zas MCP server under?
Zas declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the Zas MCP server?
VerifyMCP ran 16 checks on Zas, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.