A coding agent built around choice and local control
Zero enters a crowded field with a clear pitch: the terminal agent belongs to the developer, not a model vendor. It can inspect a repository, edit files, run commands, fetch public web pages, call MCP tools, and preserve sessions locally. The user selects the provider, model, and permission mode. Supported routes include major hosted APIs, compatible endpoints, and local servers such as Ollama and LM Studio.
That choice is more than a long provider menu. Zero's agent loop translates a common set of messages and tools into provider-specific calls, while the TUI can switch models during a session. Local history is searchable, resumable, forkable, and rewindable. The project says it sends no telemetry, though prompts and tool requests necessarily go to whichever model or external tool provider the user configures. Choosing local inference is the path for code that must not leave the machine.
The MIT license and Go codebase make the ownership claim credible. There is no hosted Zero account required for the core application. API charges, subscription terms, and model availability remain external dependencies.
The workflow is deeper than chat and edit
The interactive interface provides plan and specification modes, image input, model and provider pickers, permission controls, context inspection, session management, themes, and tool rendering. zero exec offers the same agent machinery without the TUI, with meaningful exit codes and text, JSON, or stream-JSON input and output. A CI job can run an isolated task in a Git worktree instead of letting an experiment touch the main checkout.
Extensions are unusually broad. Project and personal instruction files shape behavior. Markdown skills can be loaded when relevant. MCP servers add outside tools, while Zero can expose its own tools as an MCP server. Plugins bundle tools, hooks, prompts, and skills; specialist agents can take bounded subtasks. Before and after hooks can block or audit tool calls. This is enough to build a tailored engineering assistant rather than merely change its color scheme.
Breadth has a cost. Every MCP server, hook, plugin command, and project instruction becomes part of the trust and debugging surface. Some plugin management still happens through files and CLI commands rather than a polished interface. A checked-out repository cannot grant itself extra sandbox write roots, which is a good defense, but teams still need to review shared .zero configuration before enabling custom tools.
Installation is easy until platform isolation matters
For most users, npm install -g @gitlawb/zero and the setup wizard are a quick start. The npm package selects a platform build from optional dependencies and can fall back to a matching GitHub release. Linux and macOS are covered on x64 and arm64; Windows receives an x64 build, including under emulation on ARM. Install scripts and source builds are also documented.
Building from source asks for a very recent Go toolchain and extra helper binaries on Linux. Native Linux sandboxing requires Bubblewrap. macOS uses the system sandbox. Windows has its own restricted-token and helper setup. These differences matter because the safety claim is only as strong as the platform backend that actually executes commands. Run zero doctor, inspect zero sandbox policy, and perform refusal tests against files outside a disposable workspace before trusting the default.
A current Windows issue shows why. On version 0.6.0, sandbox setup and diagnostics can succeed while every shell command fails because the stored permission plan disagrees with a runtime path. The issue includes a traced cause and fix direction, and related sandbox work is active, but the behavior is a practical blocker for affected users. File editing working does not compensate for a coding agent that cannot run tests.
Permissions are thoughtful, not magical
Zero allows workspace reads by default and limits writes to the workspace unless another directory is granted. Shell commands, network access, destructive operations, and elevated actions are permission-gated. Unsafe autonomous modes require explicit opt-in. Project configuration cannot silently widen additional write roots, and version 0.7.0 added credential-store read denial, Windows write-jail fixes, and secret-redaction hardening.
Those release notes are reassuring because the project treats safety defects as first-class work. They also show that the boundary is still being hardened. An open August security report found reachable issues in the Go standard library and image decoder used by the project. Go toolchain fixes landed on the main branch quickly, while the report remained open during review. Users running a tool that reads code, stores API credentials, and executes commands should follow patch releases closely.
Failure recovery is another maturity test. Issue #913 reports that a provider error in the middle of a turn loses work-in-progress context, causing the next turn to reread files rather than resume. That is annoying in supervised use and potentially expensive in automated runs. CI users should bound turns, preserve working changes outside conversational state, and treat provider errors as retriable job failures.
Exceptional momentum, limited history
The repository was created on May 28, 2026, pushed on August 16, and released version 0.7.0 on August 10. Seven minor releases arrived between July 2 and August 10. GitHub showed 89 open issues and pull requests combined, not 89 confirmed bugs. Current threads have detailed review, tests, follow-up fixes, and frequent maintainer participation across provider state, sandboxing, the TUI, credentials, and memory.
Documentation is a standout. Beyond the large README, there are guides to installation, architecture, extensions, OAuth boundaries, stream JSON, specialists, packaging, updates, benchmarks, and security reporting. The project is far better explained than many tools with ten times its age.
Zero is a strong trial for developers who want one local terminal surface across many models and automation styles. It is not yet the conservative choice. Keep permissions interactive, start with an expendable repository, pin releases for CI, and verify the sandbox on the exact operating system. If the project maintains its current discipline while the interfaces settle, it could become a serious independent agent platform. Today, its best role is a powerful supervised tool.