Z.ai open-sources ZCode and spells out what it uploads
Z.ai has published the source for ZCode, the coding agent it builds around GLM-5.3, alongside a disclosure that itemises what the tool sends back to its servers.
The harness behind GLM-5.3 is now public
Z.ai has published the source code for ZCode, the coding agent harness it builds around its GLM-5.3 model. The repository went public on 20 September 2026 under the Apache License 2.0, and by the following evening it had passed 5,500 stars and 1,500 forks - a reception that says more about the appetite for a genuinely open alternative to the closed coding agents than about the code itself, which arrived in two commits, an initial one and a single "feat: open source" commit.
ZCode is three products in one repository: an Electron desktop application, a browser and terminal workbench, and the command-line agent runtime that the other two sit on. The README pins it to Node.js 24.14.0 and pnpm 10.33.2, and the product site pitches it as the harness for GLM-5.3, aimed at multi-agent work with remote invocation from WeChat, Feishu or Telegram. Publishing all of that is a notable step for a vendor whose coding assistant is free to use - code is easy to publish when the business is the model subscription behind it.
The interesting document is not the source
The repository also ships a NOTICE.md: a feature, permission and third-party component statement that sets out what the software touches and what it sends off the machine. Section two is a table of upload interfaces and external requests, and it is specific.
Model and auxiliary-model requests may carry prompts, conversation history, code, diffs, tool results and attachments, plus client environment and session, request and trace identifiers. Requests to two named Anthropic-compatible model endpoints are automatically re-routed to a ZCode gateway that preserves the method, body, query parameters and every header except Host - including whatever authentication the request carries - with no extra confirmation per call, and the gateway's origin can be changed with an environment variable. Login, authorisation and account flows may query, fetch or create project API keys automatically, and SSH, WSL and container environments can receive provider configuration, account API keys and OAuth tokens whenever those credentials change.
Logs local, keys not in a keychain
Section three covers what stays behind. The standalone CLI keeps its session database in a single SQLite file under the user's home directory. Model input and output logs are written locally by default in development and production - test builds are the exception - and may contain prompts, code, context, tool arguments and replies, with rotation but no guarantee that every piece of user text has been scrubbed. Credentials live in encrypted files whose default key can be derived from information about the machine rather than in the operating system's keychain, and Web OAuth credentials may sit in browser storage. The first section notes that the shared agent execution adapter ships no default operating-system sandbox and that a non-interactive CLI run started without an explicit mode uses the most permissive setting.
Why the disclosure matters
The publication follows several days of reported scrutiny of what ZCode sends back to its servers, covered across the Chinese and international technology press between 19 and 21 September. The document itself is written as a description of behaviour rather than a response to criticism, and much of what it describes is unremarkable - agents need prompts and code to reach a model server, and every tool of this kind has a gateway. What is unusual is the itemisation: a vendor stating in one place which requests leave the machine, what they carry and which of them happen without asking. Readers can now check the claims against the code, which is the only reason publishing the source changes anything.
Our opinion
Open-sourcing an agent is not the same as making it trustworthy, and Z.ai has handed reviewers a remarkably detailed map rather than a clean bill of health: a document that admits requests are re-routed through the vendor's own gateway with their credentials intact, that keys may be created on your behalf, and that the most permissive permission mode is the default for unattended runs is telling you exactly where to look. That candour is worth more than a promise. It also sets an awkward bar for the rest of the market - Cursor, GitHub Copilot and Claude Code ask users to take far more on faith, and none of them publishes an equivalent table. The honest reading is that this raises the floor rather than clearing it: transparency about a data path does not make the data path safe, and the test of the next month is whether the gateway forwarding survives scrutiny now that its source is on GitHub.