# Zas (npm · zas-agent)

Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo.

- Trust score: 88/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `zas-agent`: 88/100 (this document), [markdown](https://verifymcp.io/servers/soke1556-zas-agent/zas-agent.md), [page](https://verifymcp.io/servers/soke1556-zas-agent/zas-agent)

## Channel facts

- Registry: `npm`
- Package: `zas-agent`
- Version: `0.9.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 51 of 172 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to soke1556/zas-agent).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1984 tokens (~152/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 60/100
  - Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "zas_send_file" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Zas MCP server?

Zas runs locally as an npm package, launched with npx -y zas-agent. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add soke1556-zas-agent -- npx -y zas-agent
```

### Cursor

```json
{
  "mcpServers": {
    "soke1556-zas-agent": {
      "command": "npx",
      "args": [
        "-y",
        "zas-agent"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "soke1556-zas-agent": {
      "command": "npx",
      "args": [
        "-y",
        "zas-agent"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add soke1556-zas-agent -- npx -y zas-agent
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "soke1556-zas-agent": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "zas-agent"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add soke1556-zas-agent --command npx --arg -y --arg zas-agent
```

### Hermes

```yaml
mcp_servers:
  soke1556-zas-agent:
    command: "npx"
    args: ["-y", "zas-agent"]
```

### Netclaw

```json
{
  "McpServers": {
    "soke1556-zas-agent": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "zas-agent"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add soke1556-zas-agent -t stdio -c npx -a -y zas-agent
```

### Other

```json
{
  "mcpServers": {
    "soke1556-zas-agent": {
      "command": "npx",
      "args": [
        "-y",
        "zas-agent"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 88, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Supply Chain Security rose 1.

### 2026-09-15 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-11 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-10 (score 82, 0)

- [security regression] Stability: 0.20 → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Schema quality: 1561 → 1984
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.8.0 → 0.9.0

### 2026-09-08 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (13)

### `zas_status` (~57 tokens)

Say whether this agent is paired with a Zas account, and list the owner's channels it may send to or read from. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

### `zas_pair` (~109 tokens)

Pair this agent with a Zas account. The first call returns a URL for the owner to open; a later call says whether they approved. If the page shows a code, call again with `code`. In a profile that is already paired, approval replaces the old agent. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `code` (string): The code the pairing page shows when the browser could not reach this machine.

### `zas_send_file` (~233 tokens)

Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `expires_in_days` (integer): How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p…
- `path` (string, required): Absolute or relative path of the file to send.
- `title` (string): Label for the item. Defaults to the file name.

### `zas_send_direct` (~163 tokens)

Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `path` (string, required): Absolute or relative path of the file to send.

### `zas_send_direct_fallback` (~158 tokens)

After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `job` (string, required): The job id zas_send_direct or zas_jobs reported for the Directo send that failed.

### `zas_receive_direct` (~186 tokens)

Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `dest` (string): Where to write the file. A directory means "inside it". Defaults to a fresh temporary directory.

### `zas_receive_direct_fallback` (~115 tokens)

After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job’s id. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `job` (string, required): The job id zas_receive_direct or zas_jobs reported for the receive that failed.

### `zas_send_note` (~224 tokens)

Send a note — plain text, or a code snippet with its language — into one of the owner's Zas channels. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `expires_in_days` (integer): How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the p…
- `lang` (string): Language of the snippet, for highlighting (for example "ts", "py").
- `secret` (boolean): Hide the body behind a cover until the reader opens it.
- `text` (string, required): The body of the note.
- `title` (string): Label for the item. Defaults to the first line.

### `zas_list_items` (~86 tokens)

List the most recent items in one of the owner's Zas channels. Needs a grant that includes reading. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string, required): Channel name or id.
- `limit` (integer): How many items, 1 to 50. Defaults to 20.

### `zas_get_item` (~155 tokens)

Fetch one item from a Zas channel. A note comes back as text; a file is written to disk. Returns the path written; it can differ from `dest` when a file with that name already exists. Writes a new file under `dest` (or the system temp directory); it never overwrites an existing file. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string, required): Channel name or id.
- `dest` (string): Where to write a file. A directory means "inside it". Defaults to a fresh temporary directory.
- `id` (string, required): Item id, as `zas_list_items` reports it.

### `zas_edit_item` (~234 tokens)

Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `id` (string, required): Item id, as `zas_list_items` reports it.
- `lang` (string): Language of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text.
- `secret` (boolean): Hide the body behind a cover until the reader opens it. False removes the cover.
- `text` (string): New body, for a note.
- `title` (string): New label. An empty string clears it, so the file name or the first line shows again.

### `zas_replace_file` (~189 tokens)

Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

Input parameters:

- `channel` (string): Channel name or id. Optional when the agent holds exactly one channel.
- `id` (string, required): Item id, as `zas_list_items` reports it.
- `path` (string, required): Absolute or relative path of the new file.
- `title` (string): New label. Defaults to the label the item has.

### `zas_jobs` (~75 tokens)

List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended — including any `job_id` a send returned; a finished job keeps its result here. The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/soke1556-zas-agent/zas-agent#diagnostics

## Score history

- 2026-09-21: 88
- 2026-09-20: 88
- 2026-09-19: 87
- 2026-09-18: 87
- 2026-09-17: 86
- 2026-09-16: 86
- 2026-09-15: 85
- 2026-09-14: 84
- 2026-09-13: 84
- 2026-09-12: 83
- 2026-09-11: 83
- 2026-09-10: 82
- 2026-09-09: 82
- 2026-09-08: 82
- 2026-09-07: 81
- 2026-09-06: 55
- 2026-09-05: 81
- 2026-09-04: 70
- 2026-09-03: 55

## Common questions

### What is the Zas MCP server?

Zas is an MCP server listed in the public MCP registry as io.github.soke1556/zas-agent. Move files and notes between a coding agent and your Zas channels, encrypted here or via Directo. This page covers its npm package (zas-agent).

### Is the Zas MCP server safe to use?

Zas scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Zas MCP server expose?

Zas exposes 13 tools: zas_status, zas_pair, zas_send_file, zas_send_direct, zas_send_direct_fallback, and 8 more. Their descriptions and schemas cost roughly 1,984 tokens of context every time the server is loaded.

### Is the Zas MCP server still maintained?

Zas is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Zas MCP server under?

Zas declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/zas-agent
- Socket report: https://socket.dev/npm/package/zas-agent
- Repository: https://github.com/soke1556/zas-agent
- Website: https://zas.red/
- Changelog RSS feed: https://verifymcp.io/servers/soke1556-zas-agent/zas-agent.xml
- Changelog JSON feed: https://verifymcp.io/servers/soke1556-zas-agent/zas-agent.json
- HTML version of this page: https://verifymcp.io/servers/soke1556-zas-agent/zas-agent