ZCode is the desktop coding agent made by Z.ai, the lab formerly known as Zhipu AI. It launched on 1 July 2026 as the official app for GLM-5.2, moved to GLM-5.3 after that model shipped on 14 August 2026, and became open source on 20 September 2026, two days after a developer showed it was uploading entire repositories, Git history included. This page was rewritten on 18 October 2026 to reflect all three changes.
If you only need the short version: the app is free, the models cost from about 12.60 to 168 dollars a month depending on tier and discount, it is a credible cheap alternative to Cursor and Claude Code for personal projects, and it is a poor choice for code you are not allowed to send to a third party.
What ZCode is
ZCode is an agentic development environment: a desktop app where an AI agent reads your project, plans, edits files, runs commands in a built-in terminal and checks its own work. Z.ai describes it as the official harness for its GLM models, meaning the app is tuned for how GLM-5.3 handles tools and long tasks.
The features that matter in practice:
- Goals. You set an objective with
/goal, and at the end of each round ZCode checks whether the goal is met and starts another round if not. You can pause, resume, replace or clear the goal. - Permission modes. Ask before changes, edit automatically, plan mode, and full access. Full access is what makes long autonomous runs possible, and also what makes mistakes expensive.
- Subagents, MCP, skills and hooks. A developer guide dated 10 October lists built-in general-purpose and Explore subagents plus user-defined ones; an earlier review from 6 October said custom subagents were missing, so this area is moving fast.
- Remote control. You can mirror a session to your phone, or trigger ZCode from WeChat, Feishu or Telegram.
- Images. GLM-5.3-Flash handles screenshots and image input.
- A
zcodeCLI that runs the same agent from the terminal. Note that--promptruns in yolo mode unless you pass--mode.
It runs on macOS (Apple Silicon and Intel), Windows (x64 and ARM64) and Linux in beta (x64 and ARM64, as .deb, .rpm or AppImage).
Models and how you connect them
The app is free; the intelligence is not. You connect one of:
- a GLM Coding Plan subscription (the main route),
- a Z.ai account for the global service, or a BigModel account for the Chinese mainland service,
- your own API key, an enterprise channel, or a self-hosted model service.
The model menu lists GLM-5.3 for larger coding tasks, GLM-5.3-Flash and GLM-5-Turbo. GLM-5.3 uses the same base model as GLM-5.2 with new post-training, and its weights were published on Hugging Face at the end of August, which is why ZCode can also point at self-hosted deployments.
GLM Coding Plan pricing
| Tier | Weekly credits | List price reported (Oct 2026) | With the 30% discount seen in early October |
|---|---|---|---|
| Lite | 10,000 | 18 dollars a month | 12.60 dollars a month |
| Pro | about 60,000 (6x Lite) | 80 dollars a month | 56 dollars a month |
| Max | about 140,000 (14x Lite) | 168 dollars a month | 117.60 dollars a month |
Two details change the real cost. Calls made at off-peak hours and weekends cost half as many credits, so batch jobs scheduled for the evening go further. And new users get a 5-day trial with daily token quotas for GLM-5.3 and GLM-5-Turbo. The Chinese BigModel channel prices the same tiers in yuan. These figures come from two independent reviews dated 6 and 10 October 2026 and from Z.ai's own BigModel page, which warns that prices and benefits may change. Our first version of this page, written at launch, quoted lower figures that are no longer valid.
How it compares to Cursor and Claude Code
| ZCode | Cursor | Claude Code | |
|---|---|---|---|
| App | Free, Apache 2.0 since Sept 2026 | Paid editor (free tier) | CLI and IDE extensions |
| Default models | GLM-5.3 family | Multiple vendors | Claude models |
| Entry price for agent use | about 12.60 to 18 dollars a month | see our Cursor alternatives | see our Cursor vs Claude Code |
| Where code is processed | Z.ai (Singapore entity; BigModel for mainland China) | Cursor and model vendors | Anthropic |
| Best for | Cheap high-volume agent work on personal or open-source code | Editor-first workflows | Terminal-first, long agentic tasks |
Z.ai published no head-to-head benchmarks at launch, so treat this as a comparison of price, access and data handling rather than a ranking of output quality. The GLM Coding Plan also works inside Claude Code through Z.ai's Anthropic-compatible endpoint, which lets you keep Claude Code's interface while paying GLM prices. For the wider field, see our best AI coding assistants 2026 and free AI coding assistants roundups.
The September 2026 repo upload issue
On 18 September 2026, a developer published a traffic analysis showing that ZCode created a full snapshot of the workspace before every prompt and on task completion, including the complete .git directory, the Git LFS cache and ZCode's own global configuration. The archive was encrypted with AES-256, with the key wrapped by Z.ai's RSA public key, and uploaded to Alibaba Cloud object storage with a callback to Z.ai. In the measured run, 313 MB left the machine from a 345 MB workspace, 86.6% of it Git history.
The feature exists to power checkpoints and rollback, but the scope (all of your history, not just the files being edited) and the lack of a clear opt-in caused the uproar. Z.ai apologised and, on 20 September, published ZCode's source under Apache 2.0, which at least lets anyone audit what the app sends. We found no public changelog entry confirming that the upload was narrowed, and a developer guide dated 10 October still describes workspace snapshots that include the .git history. Until Z.ai documents otherwise, assume your whole repository, including old commits that may contain secrets, leaves your machine.
Z.ai's privacy policy names a Singapore company as controller and says data is generally processed in Singapore; the BigModel channel is the mainland China service with separate terms. The policy predates ZCode and does not address it specifically.
What to do:
- Do not open client, employer or regulated code in ZCode unless your policy explicitly allows sending it to Z.ai.
- Rotate any secret that was ever committed to a repository you opened in ZCode, even if it was later deleted from the working tree.
- If you want GLM models with tighter control, use the plan through Claude Code or another agent, or run the open weights yourself. Our guides to local LLM privacy and the best local LLMs for coding cover what that takes. The same questions apply to every cloud agent, as our look at whether Cursor is safe shows. The full GLM-5.3 weights need a multi-GPU server. If you simply want a coding model whose prompts never reach Z.ai, a smaller open coding model of around 14B parameters runs on a DigitalOcean GPU Droplet with an NVIDIA RTX 4000 Ada: 20 GB of VRAM, from about $0.76 per GPU-hour on DigitalOcean's price list (checked on 24/10/2026), on a server you control (affiliate link).
The bottom line
ZCode is now a genuinely interesting tool: open source, cross-platform, built around a strong open-weights model family, and priced well below the main Western agents. For side projects, open-source work and experiments, it is worth trying through the 5-day trial. For anything confidential, the September upload episode is reason enough to wait for Z.ai to document exactly what leaves your machine, or to use GLM through a client you control.
