ZCode

What it is

ZCode is Z.ai’s open-source coding agent harness, published under the zai-org GitHub organisation and written in TypeScript. The repository describes it as “Z.ai’s coding agent harness. Powerful, intelligent, extensible.”

Why it showed up

ZCode appeared after reports that an older version uploaded repository-related user data without clear consent. Zhipu apologized, said it had fixed the issue, and later opened the repository. The release then went from zero to 4.7k stars within a day, making both its distribution and its trust story unusually important.

Use cases

Running a coding agent against a real repository: reading code, making changes and iterating, with the harness handling the tool loop.

Who should look at it?

Developers comparing open coding-agent harnesses should start with the tool loop and approval model. ZCode is interesting as a public implementation of the part that turns model output into repository operations.

What to inspect

Read the TypeScript entry points, tool definitions and setup instructions. Focus on how the harness represents a task, how it decides which tool to call, and where a user can inspect or stop an operation before it changes files.

Watch point

The central issue is no longer star velocity. Public reporting established a controversy around the older closed client, but the current repository cannot prove exactly what that build transmitted. The open code still initializes broad desktop telemetry while also including redaction for paths, URLs, secrets and click content. Watch for a published third-party audit, a precise disclosure of the old payloads, an explicit telemetry off switch and evidence that consent is clear before repository data leaves the machine.

Sources

• GitHub: zai-org/ZCode
• Tencent News / TechWeb: ZCode data-upload controversy
• Zhihu: incident discussion and timeline
• Hacker News discussion