Intelligence
Join the waitlist
AEV-2026-0049

ZCode CLI reportedly executes a different, already registered MCP tool when the intended tool is absent from the session's own current catalog

GitHub issue zai-org/feedback#551 reports that ZCode CLI 0.16.5 logged a successful connection for an MCP server, serena, with toolCount 23, while six subsequent model requests over roughly four and a half minutes carried a tool inventory with none of that server's own tools, and that a call to one of the missing tools executed instead as a different, already connected server's tool, three times in one hour across two sessions, with no explicit unknown tool failure raised. No maintainer response, no duplicate report and no independently obtained raw log evidence exist as of this record.

Candidate: below the publication gate, not a published vulnerabilityObservedStatus: candidateEvent: 6 September 2026Execution AuthorityAgent IdentityAudit and Evidence

Affected

Organisation
Z.ai
Product
ZCode CLI
Component
mid session MCP server connection, session tool catalog and tool dispatch
Versions
ZCode CLI 0.16.5, reported against GLM-5.3-Flash through an Anthropic compatible endpoint
Configurations
Windows 11 Pro, builtin zai-coding-plan provider; MCP servers configured: serena (reported stdio, 15 to 18 second startup), v8-pulsar, rlm, computer-use, node_repl, image_search

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Call an initial instructions tool belonging to serena, an MCP server the same session had already logged a successful connection for
Agent
The ZCode CLI agent running GLM-5.3-Flash through the builtin zai-coding-plan provider
Delegating actor
unknown
Action
On the reporter's own account, the agent narrated an intent to call mcp__serena__initial_instructions; the call recorded as having executed was mcp__v8-pulsar__list_sessions in one session and mcp__computer-use__list_apps in a second session, three such executions across both within one hour
Target resource
Enumeration tools belonging to v8-pulsar and computer-use, servers already connected in the same session
Environment
ZCode CLI 0.16.5, Windows 11 Pro (reported)
Credentials used
unknown
Privileges available
unknown
Authority presented
Session level registration of v8-pulsar's and computer-use's own tools, already connected servers in the same session
Authority required
Authority over the exact tool identity named in the call, mcp__serena__initial_instructions, resolved against the session's own current tool catalog
Applicable policy
unknown
Approval mechanism
unknown
Required approver
unknown
Independent approval
unknown
Action binding
unknown; the issue does not attach the raw host log or model I/O files that would show whether the substitution originated in model output, a provider adapter, tool index normalization, alias mapping or dispatcher fallback
Sequence context
Three reported wrong tool executions across two sessions within one hour on 6 September 2026, each following the same shape: a successful mid session server connection, a subsequent tool inventory omitting that server's tools, and a call to one of the missing tools executing as a different, already registered server's tool

Impact

Consequence
None demonstrated in the reported instances: every substituted call named in the issue, list_sessions and list_apps, is a read only enumeration tool
Reach
single, confined to the reporting session and the reporter's own account
Reversibility
reversible in the reported instances, since the substituted calls were read only
Detectability
Silent in the reported instances: no explicit unknown tool or equivalent failure surfaced, and the substitution was noticed only because the reporter compared the agent's own narrated intent against the recorded executed call
Propagation
none reported
Recovery
The reporter states that starting a new session produces a tool catalog containing serena's own tools and the originally intended tool then working normally; no in session recovery is reported

Evidence

Primary sources

Supporting sources

Reproduction status
Reporter filed GitHub issue against ZCode CLI, a closed source product; not independently reproduced by Moona Intelligence. This record's own contribution is a direct fetch and read of the issue on 7 September 2026, a search of the same repository for duplicate reports, and a check of Z.ai's own public GitHub organization confirming ZCode CLI's source is not published there, not a replay of the reported sequence against the actual product.
Evidence state
Observed

Known unknowns

  • Which layer of ZCode CLI's own pipeline, model output, provider adapter, tool index normalization, alias mapping or dispatcher, actually produced the reported substitution, since the raw host log file and model I/O session log files the issue itself names were not attached to the public report and were not independently obtained.
  • Whether any maintainer has acknowledged, reproduced or begun to address the report; the issue carried no reply as of this record's own verification.
  • Whether the reported mechanism reproduces with a provider or model other than GLM-5.3-Flash through the reported endpoint, or in any product other than ZCode CLI.
  • Whether a mutating or destructive tool has ever been reached this way; every wrong tool execution the issue itself names is a read only enumeration call.
  • Whether the substitution the issue describes maps consistently, such as always resolving to the most recently connected server, or the first server alphabetically, or varies by session in a way the issue's own account does not resolve.

Limitations

  • This record relies on a direct fetch and read of one GitHub issue on 7 September 2026, filed by a single reporter, rather than an independent reproduction of the reported sequence against ZCode CLI itself.
  • ZCode CLI's own source is not published in Z.ai's public GitHub organization, confirmed directly in this session, so the specific claim at the center of the report could not be checked against the product's own implementation.
  • The host log file zcode-2026-09-06.jsonl and the model I/O session log files model-io-sess_*.jsonl the issue itself references were not attached to the public report and remain unavailable to this record.

Claim provenance

  • independent-reporting
    Fetched directly on 7 September 2026. Confirmed title, author, opened date, open state, priority P2 label, no maintainer reply, no linked fix, the reported environment, the reported mcp.server.connected event and toolCount for serena, the reported 127 tool inventory omitting serena's own tools across six requests, the narrated intent and the recorded executed call in both reported sessions, and the reporter's own statement that a fresh session resolves the catalog correctly. This record's own basis is independent reporting rather than verified, since the issue's own referenced raw log files were not independently read.
    The Catalog Never Had It. A Different Server's Tool Ran.
  • verified
    Fetched directly on 7 September 2026. Confirmed no duplicate report of the same mechanism exists in the same repository as of this record's own verification.
    The Catalog Never Had It. A Different Server's Tool Ran.
  • verified
    Fetched directly on 7 September 2026. Confirmed ZCode CLI's own source is not published among Z.ai's visible public repositories, which this record relies on to state that the reported mechanism could not be independently reproduced against the product's own implementation in this session.
    The Catalog Never Had It. A Different Server's Tool Ran.