Z.ai open-sourced ZCode, its GLM-5.3 coding agent, under Apache-2.0, and the repository gained 5,215 stars in a day: Reveneau

Why it mattersA team weighing ZCode against Claude Code, Cursor or Copilot can now read exactly what the client sends and how it runs, which is unusual for a coding agent tied to a specific model provider.

Beijing Zhipu Huazhang Technology, which trades as Z.ai and publishes the GLM open-weight model family, published the full source of its ZCode coding agent to github.com/zai-org/ZCode on 2026-09-20T12:01Z under an Apache-2.0 licence. The repository had gained 5,215 stars and 1,477 forks by 15:00Z on 2026-09-21, 26 hours and 59 minutes after the first commit at 12:01Z on 2026-09-20, which puts ZCode among the fastest-growing open-source coding agents of the year.

What is in the repository

The README describes ZCode as an AI programming workbench that ships in three shapes: a desktop application built on Electron, a browser interface, and a terminal Agent CLI. All three live in the same monorepo under /apps/zcode-cli/ for the terminal agent and the shared UI, backend services and runtime elsewhere. Remote development is handled through SSH and WSL so a client on one machine can drive an agent running on another. The runtime and Agent CLI source are checked in, not distributed as a compiled binary, so anyone reading the repository can trace what the client sends over the network before ZCode reaches a private codebase.

The published version is v3.14.1, according to the ZCode homepage at zcode.z.ai. That homepage says ZCode "deeply integrates" with the GLM-5.3 and GLM-5.3-Flash models, and calls out multi-modal features like screenshot understanding and image analysis. Z.ai's own commercial plans stay on BigModel.cn at three tiers billed in yuan per month. Open-sourcing the client changes who can inspect and modify it, and leaves the pricing on the hosted side alone.

Why the timing matters

Tokenstead published a reverse-engineering report on 2026-09-18 that alleged the pre-open-source ZCode client packaged whole .git directories into encrypted archives and uploaded them to Alibaba Cloud on every session, and that two apparent opt-out toggles in the settings did not stop the upload. Whether or not the current repository still carries the same behaviour is now a question anyone can answer by reading the source and running the client against a network capture, rather than a question that only a researcher with reverse-engineering time can answer.

Where ZCode sits against the field

Many open-source coding agents already exist: Anthropic ships Claude Code under a source-available licence, Alibaba open-sourced its OpenCodeReview CLI on 2026-09-20, and Reveneau has covered a run of harnesses and clones over the past month. What is new about ZCode is that it is the first coding agent from an open-weight lab, published under a fully OSI-approved licence, that also ships the desktop, web and CLI clients rather than only the CLI. A team can run the whole product on its own hardware pointed at a compatible endpoint, or fork the client and remove features it does not want.

The two open questions worth watching next week are whether Z.ai lands a public statement on the workspace-upload behaviour, and whether independent auditors report on the code in the open repository. The 1,477 forks in a day suggest at least some readers plan to answer the second question themselves.

Source

Z.ai: zai-org/ZCode on GitHub
Vendor site: zcode.z.ai

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.