Agents and MCP in Zas

A coding agent on your machine finishes something: a screenshot of the bug it just fixed, a build, a migration note. Getting that to your phone is a manual errand. Zas gives the agent a way in. It sends files and notes into the channels you choose, and reads them back where you allow it.

​

An agent is not you

The lazy way to build this would be to sign the agent in as you. Zas refuses that on purpose. Your sign-in holds every channel key you own, and every item the agent sent would look like yours. An agent gets a narrower identity instead: a delegated principal under your account.

​

The mark

Every item an agent sends shows a violet >_ square, then the agent’s name, on the item row itself. You see it on the web, and on every device you read Zas from. The mark is a square, never a circle. A circle means a person in Zas, and an agent must never read as one. A channel that has an agent also shows the mark next to its name in your channel list, and a strip above the items naming each agent and what it may do. Forgetting who can write into a channel is the whole risk, so Zas keeps it on screen.

​

What an agent can do

Your agent gets eleven tools over MCP. Reference has the arguments and the full error vocabulary.

​

Directo from an agent

An agent can be either end of a Directo transfer. It sends with zas_send_direct and receives with zas_receive_direct, both only in a channel that is in Directo mode, and receiving also needs the read switch because it writes a file onto the machine. Nothing is stored on either path. If the live connection fails in flight, the two fallback tools deliver the same file through an encrypted copy that lives for up to 24 hours — and the tool descriptions tell the model to ask you first, because that copy passes through storage. zas_send_file in a Directo channel is refused with direct_mode, and zas_send_direct in a normal channel with not_direct_mode. The two paths never guess at each other.

​

How long an agent’s items last

An agent’s items run the same clock as yours: five days, or two in an anonymous session. Both sending tools also take expires_in_days, so an agent can ask for a shorter life — one day at the least. It can only ask for less. A request longer than your plan allows is answered with your plan’s number rather than refused.

​

Changing what it sent

An agent can change an item it sent without making a new one. zas_edit_item rewrites the title, or a note’s text, language and cover; zas_replace_file swaps the bytes under a file. The item keeps its id, its place in the channel and its pin, and your activity log shows the change under the agent’s name. Only the agent that sent an item can change it, and the server checks that too. Replacing a file is for agents only: the web app and the phones have no such button.

​

What an agent cannot do

We would rather list this than let you assume it.

• No channel you did not grant. Not by name, not by id.
• No channel you only joined. A grant exists only on a channel your own account owns, or one an organization manages and has opened to agents.
• No organization channel your organization has not opened. An administrator turns that on, one organization at a time. See Agents in an organization.
• No changing what it did not send. zas_edit_item and zas_replace_file act only on items carrying this agent’s mark. The server refuses the rest as well, and the agent reports it as not_yours.
• No view-only channel.
• No reading unless you switched it on. Reading is separate from sending.
• Nothing else in your account. The API answers an agent on a fixed allowlist of routes and refuses every other one, and that includes your account document and your devices.
• No account key. The key-derivation service refuses an agent that asks for one.

​

What it costs

Agents are part of the free plan. An organization sets its own number, and inside an organization there is no channels-per-agent cap. See Agents in an organization.

​

Where to go next