# zot — Single-binary terminal coding agent harness in Go, with 30+ model providers and any-language extensions. > Source: The Agents Index — https://theagentsindex.com/zot (structured, researched, re-verified) > Facts last verified: 2026-09-28 zot is a coding agent harness shipped as one static Go binary that runs in the terminal, editing files and running shell commands through five built-in tools. It connects to a broad catalog of hosted and local model providers using your own credentials. | Fact | Value | | --- | --- | | Website | https://zot.sh | | Price | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction | | Free tier | Yes | The whole product is free and MIT-licensed with no paid tier, no account and no usage ceiling imposed by the vendor. Model inference is not included: you supply an API key or an existing subscription for Anthropic, OpenAI, Kimi, xAI or GitHub Copilot, or run a local Ollama or llama.cpp model at no cost. ## What it does **Writes code** · Yes — The agent authors and modifies files directly through built-in write and edit tools, driven from a prompt in the terminal rather than a chat window that returns snippets. > read, write, edit, glob, bash. The minimum viable toolbox for an agent that actually ships code. > — https://www.zot.sh/ · "The Agent Loop, Done Well." feature grid, Five Built-In Tools card **Debugs and fixes** · Partly — No dedicated debugging feature; the vendor names failure investigation only as an example of a task you can hand a background sub-agent, which then edits the same working directory. > Spawn one for a side task (“draft the migration”, “investigate this stack trace”, “write the test harness for module X”), keep going in the main thread, check in on it whenever you want. > — https://github.com/patriceckhart/zot · README, /swarm section **Writes tests** · Partly — Test authoring appears only as an example task for a swarm sub-agent; there is no test-generation feature in the tool set or the docs. > Spawn one for a side task (“draft the migration”, “investigate this stack trace”, “write the test harness for module X”), keep going in the main thread, check in on it whenever you want. > — https://github.com/patriceckhart/zot · README, /swarm section **Reviews code** · Partly — Structured review is not in the binary; it arrives as the vendor's own opt-in zot-review extension, which maps the repository and records findings rather than commenting on a pull-request diff. > This starts a structured review of the current project. The agent maps the repository into feature slices, reads relevant files, records concrete findings, and writes a Markdown report. > — https://www.zot.sh/extensions/patriceckhart/zot-review · Readme, Usage section, under the /review command **Whole-codebase work** · Partly — It works across a whole working directory with recursive glob search and a canned whole-project reading pass, but there is no repository index; large work depends on the model window and automatic compaction. > Run the canned prompt "Read and understand everything in the current directory." so the agent has full project context before you start asking targeted questions. > — https://github.com/patriceckhart/zot/blob/main/README.md · Slash commands table, /study row **Ships it** · Partly — There is no deployment feature; the agent stops at edits on disk and whatever your own shell commands do, since git and deploy scripts run through the generic bash tool. > bash: run a command in the session cwd with merged stdout/stderr and a timeout. > — https://github.com/patriceckhart/zot/blob/main/README.md · Tools section, bash bullet ## How much it does unattended **Runs autonomously** · Yes — Confirmation is opt-in rather than default, and the headless modes deliberately run tools without asking so pipelines complete unattended, bounded only by a step cap. > The flag is interactive-TUI only. In `-p`, `--json`, and `rpc` modes it is ignored with a stderr warning and tools still run freely, so scripts and automation keep working. > — https://www.zot.sh/docs/tool-gate · Tool gate page, closing paragraph on --no-yolo **Multi-agent** · Yes — Swarm runs several agents at once as separate processes, each with its own model loop and session, and they share one working directory with no per-agent branch isolation. > Each agent is a separate `zot` subprocess with its own model loop, its own persistent session file, and its own chat in the dashboard — but they all run in the same working directory as the host > — https://www.zot.sh/docs/swarm · Swarm page, opening paragraph **Agent permissions** · Partly — By default the agent acts without asking; per-call confirmation is a flag you must pass, it only exists in the interactive TUI, and the jail sandbox is described as a guardrail rather than a boundary. > Run with `--no-yolo` to confirm every tool call before it runs. The active transcript and tool preview remain visible while a dialog offers four choices: yes, yes-always-this-tool-this-session, yes-always-this-session, no. > — https://www.zot.sh/docs/tool-gate · Tool gate page, first paragraph ## Which models it runs on **Claude** · Yes — Anthropic is a first-class provider reachable either with an API key or by logging in with an existing Claude Pro or Max subscription through the OAuth flow. > Anthropic Claude Pro/Max (`anthropic`), OpenAI Codex / ChatGPT Plus/Pro (`openai-codex`), Kimi Code (`kimi`), xAI SuperGrok / X Premium (`xai`), and GitHub Copilot (`github-copilot`). > — https://www.zot.sh/docs/providers · Providers page, Subscription login section **GPT** · Yes — OpenAI is supported through both the Chat Completions and Responses APIs with a key, and through a ChatGPT Plus or Pro subscription via the Codex login flow. > Simple API-key providers can be configured through `/login` or environment variables. Examples include Anthropic, OpenAI, OpenAI Responses, DeepSeek, Google Gemini, Kimi/Moonshot > — https://www.zot.sh/docs/providers · Providers page, API-key providers section **Open models** · Yes — Open-weight models run locally through Ollama, LM Studio or a llama.cpp router, with in-app GGUF download and load management for the router path and no API key needed. > Managed GGUF models: connect the distinct `llama.cpp` provider to a recent llama.cpp router, then use `/llama` for download, load, unload, and removal. > — https://www.zot.sh/docs/providers · Providers page, Custom and local providers list **Model choice** · Yes — You choose the provider and model per run or per swarm agent, and you can register entirely new providers and endpoints yourself in a models file. > Named custom providers: define a new provider key with its own `baseUrl` and `api` format in `$ZOT_HOME/models.json`. > — https://www.zot.sh/docs/providers · Providers page, Custom and local providers list ## Where you use it **In your editor** · No — The vendor's complete inventory of run modes is terminal and headless only, with no editor plugin; an IDE surface would have to be built by someone else on the embedding interfaces. > `interactive` — full TUI with streaming output, slash commands, queued messages, and an inline side-chat. `print` — `zot -p`, one-shot, final assistant text to stdout. `json` — `zot --json`, NDJSON events to stdout. `rpc` — `zot rpc`, a long-lived child process > — https://www.zot.sh/docs · Documentation index, Run modes list (complete) **On the command line** · Yes — The terminal is the product: a single static binary dropped on your PATH gives an interactive TUI plus one-shot print and streaming invocations. > zot is a lightweight terminal coding agent, shipped as one static Go binary. No runtime. No Docker. No plugin system with a dedicated package manager. > — https://www.zot.sh/docs · Documentation index, opening paragraph **In your pipeline** · Partly — JSON event output is offered for scripts and CI, but nothing ties into a pull request or a hosted runner; you invoke the binary yourself inside your own pipeline. > `json` — `zot --json`, NDJSON events to stdout. Perfect for scripts and CI. > — https://www.zot.sh/docs · Documentation index, Run modes list **In a browser** · No — There is no hosted web application at all; the remote surface the vendor provides instead is a Telegram bridge that relays direct messages into a running local session. > Telegram Bridge Pair zot with a bot token and DM it from anywhere. It reads, writes, edits, and runs, same as the TUI. > — https://www.zot.sh/ · "The Agent Loop, Done Well." feature grid, Telegram Bridge card ## Whose machine it runs on **Self-hosted** · Yes — Everything runs on your own machine: one binary, no vendor service in the path, with all configuration, credentials and transcripts stored in a local state directory. > Lightweight and written (vibe-slopped) in Go. No runtime. No Docker. No package manager. Just the agent loop, done well. Drop it on your `$PATH` and go. > — https://www.zot.sh/ · Homepage hero paragraph **Open source** · Yes — The full source is published on GitHub under the MIT licence, which permits commercial use, modification and redistribution without a separate agreement. > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction > — https://github.com/patriceckhart/zot/blob/main/LICENSE · LICENSE file, MIT grant paragraph ## What it costs to run **How it meters** · Partly — The harness itself costs nothing and meters nothing; you pay your model provider per token or through an existing subscription, and zot only surfaces the running cost in its status line. > Use `/login` to store an API key or a subscription credential. zot supports Claude Pro/Max, ChatGPT/Codex, Kimi Code, SuperGrok/X Premium, and GitHub Copilot subscriptions, plus direct API keys for every provider in the catalog. > — https://www.zot.sh/docs/quickstart · Quickstart page, Log in section **Free tier** · Yes — There is no account, no sales contact and no paid tier: a one-line installer fetches the binary, and a local Ollama model gets you running without any credential at all. > No API key, `config.json`, or `models.json` is required for this command. zot defaults to http://localhost:11434. > — https://www.zot.sh/docs/quickstart · Quickstart page, "Or use local Ollama without login" section **API access** · Yes — A long-lived RPC child process exchanges newline-delimited JSON over stdin and stdout, and the vendor publishes a TypeScript SDK that wraps it for Node server runtimes. > It starts a long-lived `zot rpc` child process and talks newline-delimited JSON over stdin/stdout, so you get streaming output without hand-rolling the protocol. > — https://www.zot.sh/docs/node-sdk · Node.js SDK page, opening paragraph **MCP server** · Partly — MCP is deliberately absent from the binary and is framed as something to skip; reaching MCP servers requires installing a third-party bridge extension you must review and trust yourself. > No Mandatory MCP Build CLI tools with skills, or add an extension that speaks MCP if you actually need it. > — https://www.zot.sh/ · "Small at the Core, on Purpose." section, No Mandatory MCP card **Bring your own key** · Yes — Your own keys are the only way it works, resolved from a flag, provider environment variables or a local auth file, with an option to shell out to a password manager instead. > To keep an API key in a password manager instead of storing it directly in `auth.json`, configure an `api_key_command` for the provider: > — https://www.zot.sh/docs/providers · Providers page, API keys from commands section ## Buying it for a team **Admin controls** · Partly — Constraints exist but are machine-local, not centrally administered: a packaged agent can enforce tool permissions, and flags or settings restrict the tool list and confine paths to one directory. > A zotfile packages an agent's instructions, skills, requirements, and enforced tool permissions as a shareable agent. > — https://github.com/patriceckhart/zot/blob/main/README.md · zotfile agents section, opening sentence **Audit log** · Partly — Every session is written locally as a JSONL transcript with tool calls and results, but the vendor explicitly disclaims the extension event stream as an audit log and there is no central record. > Notifications are not a durable or exactly-once audit log. There is no acknowledgement, replay, or crash recovery. > — https://www.zot.sh/docs/extensions · Extensions page, "Best-effort delivery and sensitive content" callout **Single sign-on** · No — Authentication is per-developer provider credentials only; the documented lookup order is an exhaustive three-step chain with no identity provider, SAML or OIDC anywhere in it. > 1. `--api-key` flag 2. provider-specific env var (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, ... ) 3. `$ZOT_HOME/auth.json` (API key or OAuth token; mode 0600) > — https://github.com/patriceckhart/zot/blob/main/README.md · Authenticate section, Credential lookup order list (complete, three entries) ## What happens to your code **Opt out of training** · Partly — The vendor operates no service that could train on your code and keeps all state on your disk, but whether prompts train a model is decided by the provider you log in to, not by zot. > Anthropic retains Fable prompts and outputs by default for safety classifiers. Eligible enterprises can request a time-limited zero-data-retention exception through GitHub. Enabling the model alone does not grant that exception. > — https://www.zot.sh/docs/providers · Providers page, "Claude Fable data retention" callout **Data residency** · Partly — Your code, sessions and credentials never leave the machine, so residency for stored data is yours; in-flight prompts land wherever the chosen provider and region sit, such as a configured AWS region. > Bedrock API keys are bearer tokens. Set `AWS_BEARER_TOKEN_BEDROCK` and `AWS_REGION`, or use the standard AWS credential chain > — https://www.zot.sh/docs/providers · Providers page, Amazon Bedrock section **Getting out** · Yes — Transcripts are plain local JSONL and can be exported to a portable session file or a JSON timeline dump; nothing is held server-side and no credits exist to expire. > `/session export` writes the transcript to a portable `.zotsession` file. `/session import` pulls one back in as a first-class resumable session. > — https://www.zot.sh/docs/sessions · Sessions page, Session actions list _Not established: Certifications_ ## Platform record (as of 2026-08-30) Reported by the code-hosting platform, not by the vendor. | Fact | Value | | --- | --- | | Licence | MIT | | Stars | 328 | | Forks | 34 | | Last push | 2026-08-27 | ## Provenance 1 of 22 sources behind the facts above are independent of the vendor. ## Coverage elsewhere None recorded. Every fact above comes from the vendor and is not independently corroborated yet. ## What changed - 2026-09-28 — Capabilities · Commercial terms · Free tier · Price - 2026-09-03 — Capabilities · Commercial terms · Free tier - 2026-08-31 — Capabilities · Commercial terms · Free tier - 2026-08-23 — Alternatives · One-liner · Summary ## Correcting this record Anything marked "Not established" is a question we have not answered — it is not a No. If you represent zot, or anything here is wrong or out of date, you can supply it with a source: the operations this site accepts from an agent are listed at https://theagentsindex.com/.well-known/agents.json — that catalogue needs no key to read, and each entry states its own auth. Supplying evidence is free. Nothing that can be bought here changes what a field says, whether a gap is closed, or how this record is scored.