Z.ai Open-Sourced ZCode. Its Headless Mode Defaults to Yolo.

Z.ai, the Hong Kong listed lab behind the GLM models, open-sourced ZCode on September 20. Its whole coding workbench went public in one commit: desktop app, browser interface, terminal agent, backend plus runtime, all under Apache 2.0. It took 5,368 stars plus 1,539 forks inside its first day, a 28.7% fork ratio we have never seen at that scale. The repo also ships a NOTICE file that is the most candid disclosure document in agent tooling, written in Chinese, which almost nobody forking it has read. It confirms that running the CLI headless without a mode flag drops you into yolo, with no default operating system sandbox. Coding Plan traffic routes through Z.ai’s own gateway with auth headers intact. Computer Use is a stub in the open build. Best for developers wanting an open Claude Code alternative. Not ideal for anyone running it unattended before reading the notice.

Z.ai flipped its coding agent from closed to open on Saturday with a single commit titled “feat: open source.”

By Sunday it had 5,368 stars. More striking, it had 1,539 forks.

People do not fork a coding agent to admire it. They fork it to run it.

Sitting in the root of that repository is a document called NOTICE.md. It explains, in unusual detail, what ZCode does with your files, your credentials plus your model traffic. Thorough, fair to the reader, plus written entirely in Chinese.

Here is what it says.

What ZCode Actually Is

Verified against the repository plus the GitHub API on September 21.

Z.ai is not a small shop. It listed on the Hong Kong Stock Exchange in January, carries a market value around $62 billion, plus ships GLM-5.3 as open weights. ZCode is its answer to Claude Code and Codex.

A Notice File Worth Reading

Most open-source releases ship a licence plus a README. ZCode ships NOTICE.md, roughly seventy lines of plain statements about risk.

What it covers

AI output being wrong. Tools running with your operating system permissions. Every category of network request the app can make, with what gets sent. Where credentials are stored plus how they are protected. Which defaults differ between the desktop app, the web interface plus the CLI.

It is written defensively, as a legal document would be. It is also written for the person running the software, which is rarer.

Why this deserves credit

Compare it to how Western vendors typically handle this. Unity shipped an official Claude Code plugin with 28 of 31 skills declaring no tool permissions, plus a restrictive licence its announcement never mentioned. TypeSafe published honest caveats on Jev’s benchmark, then watched every repost drop them.

Z.ai wrote down the uncomfortable parts itself, in its own repository, on release day. Nothing below required reverse engineering. It required reading.

The problem

Z.ai wrote the notice in Chinese. The 1,539 people forking ZCode are overwhelmingly reading the English repo description, then running it.

So the most useful thing we can do is translate the parts that change how you should run it.

Headless Mode Defaults to Yolo

This is the one to know before anything else.

What the code says

ZCode’s CLI can run a task non-interactively, meaning you pass a prompt plus it works without stopping to ask you anything. In the CLI source, line 42 sets the default mode for that path:

DEFAULT_HEADLESS_PROMPT_MODE: CliPermissionMode = "yolo"

So running a prompt without specifying a mode puts the agent in yolo. The notice confirms it directly: when the standalone CLI runs a non-interactive task through its prompt flag without a mode, it uses yolo.

What yolo means here

The notice explains that yolo, without read-only planning constraints switched on, lets ordinary tool operations through without confirmation. Interactive tools plus tools that explicitly demand confirmation keep their own rules.

In plain terms: headless ZCode reads files, writes files, runs shell commands plus touches git without pausing for approval.

No sandbox underneath it

The notice states that the shared agent execution adapter provides no default operating system sandbox. Working directory, workspace identity, git worktrees plus browser page isolation should not, in Z.ai’s own words, be treated as system-level isolation for every tool.

Combine the two. An unattended agent with no confirmation step plus no sandbox runs with whatever your user account can do.

Why a sensible default still bites

Yolo in headless mode is defensible. Nobody is present to approve anything, so a confirmation prompt would simply hang. Claude Code plus Codex make similar trade-offs for scripted runs.

The risk sits with anyone who wires ZCode into a script, a cron job or CI because it was trending, without realising the default. Pass --mode plan or --mode build explicitly. Run it inside a container. Do both.

The Gateway Is Z.ai’s Own

The second finding needs care, because it is easy to overstate.

What the code does

A file named official-coding-plan-gateway.ts contains a table of exactly two URLs. Both are Z.ai’s own Anthropic-format endpoints for GLM, one on open.bigmodel.cn plus one on api.z.ai.

When a request matches either, ZCode rewrites it to go through the ZCode platform gateway instead. The code comment states that method, body, auth headers plus the response pass through unchanged.

What it does not do

It does not touch Anthropic’s API. The table contains nothing pointing at api.anthropic.com. Neither are OpenAI endpoints or any third-party provider.

According to the code comment, the purpose is Coding Plan entitlement checks. Your subscription gets verified, then the request forwards to the model service.

Two details that still deserve attention

First, there is no per-request confirmation. Matching is by URL, so the notice warns that a user-created provider pointing at those two URLs is still rerouted. Creating your own provider entry does not opt you out.

Second, the notice states plainly that the gateway’s internal handling after it receives your request is outside what the client source can verify. Z.ai is telling you that your prompts, code plus auth header reach a server whose behaviour you cannot inspect from this repository.

That is true of every hosted model service. Most simply do not say so.

Hooks, Plugins plus MCP Run Before You Approve Anything

The permission modes govern model tool calls. The notice is clear that several other things execute outside that approval flow.

Lifecycle hooks

ZCode supports hooks on session start, prompt submission, before a tool runs, on permission requests, after a tool succeeds or fails, then on stop. Each can trigger a command or a process.

The notice says hook input may include prompts, working paths, tool arguments, tool results plus replies. Hooks can also add context, rewrite tool inputs or take part in permission decisions.

That last part deserves a second read. A hook can change what a tool is about to do.

Plugins bring their own

Enabling a plugin can bring in hooks that run automatically, local programs plus remote tools. Plugin hooks follow a different admission path from workspace hooks, so trusting one does not mean the other got reviewed.

Workspace MCP connects on its own

The current agent configuration includes workspace-level MCP in its automatic connection scope. When MCP is enabled plus the runtime starts, ZCode can use the commands, environment variables, auth headers or OAuth connections in that configuration.

Clone a repository containing an MCP config, open it in ZCode with MCP enabled, then its servers can connect. The notice says tool approval does not cover connection, discovery or token refresh.

The same gap we keep finding

This matches what we found reading vendor agent skills, where instructions loaded automatically into a tool with file access carry no scoping by default. ZCode at least tells you. Opening an untrusted repository in any agent with hooks plus MCP enabled is running somebody else’s code.

Who Z.ai Is

Worth a paragraph, since most English-language readers know the models better than the company.

The company

Z.ai was known outside China as Zhipu AI until 2025. Tang Jie plus Li Juanzi founded it in Beijing in 2019. In January 2026 it became the first major Chinese LLM company to list publicly, on the Hong Kong Stock Exchange. Its market value sat around $62 billion by August.

The models

The GLM family runs from the older ChatGLM releases through GLM-5.3, which Z.ai has released as open weights. The company positions GLM-5.3 for agentic coding plus defensive cybersecurity.

Its Coding Plan is a subscription for running GLM inside coding agents, including third-party ones like OpenCode plus Pi, alongside its own ZCode.

Why open-sourcing the agent fits

Z.ai sells model access. An open agent that runs well on GLM, while also accepting other providers, is distribution for the models rather than a product to protect. The client is free. The subscription is where the money sits.

That is the same bargain behind most open coding agents right now, plus it explains why a publicly listed company would hand its workbench source to 1,539 forks.

The Forks Have Already Started

One day in, the downstream is visible.

A community fork

At least one full fork of the repository already mirrors the codebase under a different account, identical README included. With 1,539 forks that is unsurprising. It does mean copies of ZCode will circulate that Z.ai does not maintain.

An unofficial headless wrapper

A separate MIT-licensed project called zagent turns the ZCode runtime into a scriptable terminal agent. It describes itself as unofficial, not affiliated with or endorsed by Z.ai, shipping no Z.ai binaries while driving the ZCode runtime you already installed.

That wrapper exists specifically for headless use, which is precisely where the yolo default applies. Anyone running it inherits the same questions.

What to watch

Forks drift. Security fixes landing in zai-org/ZCode will not reach copies automatically. If you run ZCode from anywhere other than the official repository, check how far behind it sits before trusting it with credentials.

The Open Build Is Not the Full Product

This one surprises people who assume open source means everything.

Computer Use is a placeholder

The repository includes a Computer Use package. Open the entry file and every call returns an error reading “Computer Use is not available in this build.”

The notice confirms it: the bundled Computer Use package is an unavailable placeholder, offering no screenshot or control capability.

Why that happens

Third-party licences. The notice explains that Apache 2.0 covers first-party code only. Anything carrying its own terms, meaning copied code, native binaries, fonts, icons plus other assets, keeps them.

It adds that, because of third-party copyright plus redistribution conditions, Z.ai does not promise the open release carries every feature of the official product.

What that means for you

If you download the official ZCode desktop app, you may get capabilities the open repository does not. If you build from source, check which ones you actually have before assuming parity with anything you saw in a demo.

This is common. It is also rarely written down this clearly.

Where Your Credentials Actually Live

Coding agents hold API keys, OAuth tokens plus SSH configuration. The notice is specific about where ZCode puts them.

Not the system keychain

The CLI’s shared credential file uses encryption, though the default key can be derived from local machine information, plus the reader also accepts plaintext entries. The desktop app plus Node services use local encrypted files with configurable or environment-derived keys.

The notice says plainly that these are not the system keychain. Web OAuth credentials can sit in browser localStorage.

Remote environments receive them automatically

When you connect ZCode to an SSH host, WSL or a container, provider configuration plus synced API keys along with OAuth access plus refresh tokens can be pushed to that environment automatically. That happens when the environment first comes online, then again whenever credentials change.

The notice states there is no separate per-item confirmation for that sync.

What to do with that

Treat any remote host you connect as a place your keys will live. Do not connect ZCode to a shared box, a client’s server or anything you do not fully control.

The Other Defaults Worth Knowing

A handful of smaller settings change what stays on your machine.

Memory

The standalone CLI ships with memory switched on. The desktop app ships with it off. Memory analyses saved sessions, then reuses what it learns in later tasks, which the notice says can trigger extra model requests.

Local model logs

ZCode writes model input plus output logs locally by default in both development plus production runs, test environments excepted. They can hold prompts, code, context, tool arguments plus model replies.

ZCode redacts request headers plus some images. The notice says not all user text should be assumed redacted.

Session sharing

Sharing a session can publish user text, model replies, reasoning, tool inputs plus outputs. The notice says the UI defaults to public-importable. Attachments may upload before final publish confirmation.

Attachments

Files added to the input box may begin transferring to the execution host before you press send, once an execution session exists.

None of these are hidden. All of them are the kind of thing a person running a trending repo never looks up.

Why 1,539 People Forked It in a Day

A 28.7% fork ratio at over five thousand stars is the highest this column has recorded. It needs explaining.

The timing

Anthropic cut Claude Code weekly limits by 17% on September 14. Codex users spent the following week posting about exhausted quotas. Developers were actively shopping for somewhere else to run an agent.

We saw the same pressure lift Hermes past 246,000 stars as the open harness that runs on any model.

The product

ZCode is not a thin CLI. It is the full workbench, with desktop, browser plus terminal from one codebase. Z.ai’s product lead has posted that it now supports more model providers beyond GLM, so it is not locked to one vendor’s models.

The promotion that just ended

Z.ai ran an offer from September 3 to 20 giving GLM Coding Plan subscribers unlimited GLM-5.3-Flash inside ZCode during set hours. The open-source commit landed on the final day of that promotion.

Nothing proves those events are connected. Worth knowing when you read the fork count, since some share of it will be existing subscribers wanting their tool on their own terms.

What the ratio actually signals

Forks cost intent. A fork ratio this high means people are cloning ZCode to run it, modify it or rebuild it, which is exactly why the notice matters more than the star count.

What You Should Actually Do

If you are about to run it headless

Pass an explicit mode. --mode plan for read-only work, --mode build when you want edits with confirmation. Never rely on the default in a script.

Run it inside a container or a disposable VM. The notice says no default sandbox exists, so provide your own.

If you use the GLM Coding Plan

Understand that your Coding Plan requests route through Z.ai’s gateway with your auth header. That is Z.ai’s own service handling its own subscription, disclosed in the code. Decide whether you are comfortable with it, then move on.

If you are connecting remote environments

Assume your API keys plus OAuth tokens will be copied to every host you connect. Only connect machines you own outright.

If you want an open Claude Code alternative

ZCode is a serious option, from a serious company, under a permissive licence. Our Claude Pro review covers what you give up leaving Anthropic’s subscription, plus this week’s Fresh Commits tracks what else is climbing in the same space.

Whatever you decide, read NOTICE.md

Paste it into a translator. It takes five minutes. You will learn things about ZCode no launch post has mentioned.

The Part Worth Keeping

Z.ai did something unusual. It open-sourced a coding agent, then wrote down in its own repository exactly where that agent is risky, what it sends where, plus which defaults you probably want to change.

Then 1,539 people forked it within a day, almost none of whom can read the document.

Yolo as the headless default is sensible. That gateway belongs to Z.ai’s own service. A licensing reason sits behind the stubbed Computer Use. None of it is scandalous. All of it matters the moment you point ZCode at a real repository with real credentials unattended.

Five minutes with a translator closes the gap. The notice is the best documentation this release has. It just needs someone to read it.

Charts and Blocks

Fork ratio at scale, compared

Defaults that change how you run it