zcode-starterkit

Bootstrap package for the ZCode Agent — installs a curated baseline of skills, commands, agents, hooks, and MCP tools as ZCode plugins.

npx zcode-starterkit

Then inside any project: /init to materialize the .zcode/ overlay.

v-claw providers

The installer registers two providers without setting a global default model:

• vc-cheap — lower-cost OpenCode models: glm-5.2, hy3-preview, kimi-k2.7-code, deepseek-v4-pro, qwen3.7-max, mimo-v2.5-pro, minimax-m3.
• vc-codex — Responses/Codex models: gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, codex-auto-review.

The review agent uses vc-codex/codex-auto-review. After installing, add the two API keys:

zcode-starterkit setup-vclaw

The command masks interactive input, verifies provider fingerprints before sending credentials, validates both model catalogs, backs up ~/.zcode/v2/config.json, and preserves unrelated config. For non-interactive setup, set VCLAW_API_KEY and VCLAW_CODEX_API_KEY. Use --skip-vclaw-verify only when the v-claw service is temporarily unavailable.

Uninstall removes fingerprint-matching vc-cheap/vc-codex providers, the managed review pin when that managed provider is gone, starterkit MCP entries, and the dedicated setup-vclaw backup directory. Same-ID user providers and their review model selection are preserved.

What you get

Four plugins installed globally under ~/.zcode:

| Plugin | Contents | |---|---| | core | 120+ curated skills + 30 commands + project templates | | agents-config | 9 specialist agent definitions (build, plan, explore, scout, review, etc.) | | mcp-tools | 18 MCP tools (code search, memory, sessions, srcwalk navigation, skill MCP) | | hooks | 7 runtime hooks (guard, prompt router, intent→skill mapping, memory capture) |

Skills (120+)

Covers the full development lifecycle: plan → build → verify → ship.

| Domain | Key skills | |---|---| | Planning | planning-and-task-breakdown, prd, prd-task, spec-driven-development | | Building | incremental-implementation, frontend-design, react-best-practices, api-and-interface-design | | Verifying | debugging-and-error-recovery, code-review-and-quality, verification-gates, testing-anti-patterns | | Shipping | shipping-and-launch, vercel-deploy-claimable, ci-cd-and-automation, gh-fix-ci | | UI/UX | ui-ux-pro-max, mockup-to-code, web-design-guidelines, accessibility-audit, anti-ai-slop | | Research | deep-research, opensrc, source-code-research, agent-reach | | Security | security-and-hardening, skillspector, security-threat-model, defense-in-depth | | Platform | cloudflare, supabase, swift-concurrency, swiftui-expert-skill, v0, v1-run | | Advanced | desktop-commander, pencil, code-cleanup, deep-module-design, development-lifecycle |

Tier 1 Agentic Integrations (v1.6.0)

Three new integrations that extend ZCode with agentic capabilities:

| Skill | What it does | Setup | |---|---|---| | agent-reach | 15-platform web research router (Twitter, Reddit, YouTube, GitHub, etc.) | pipx install from GitHub | | skillspector | NVIDIA security scanner for skills — 68+ vulnerability patterns, 17 categories | uvx auto-bootstrap | | desktop-commander | Terminal, filesystem & process control via MCP — 26 tools | npx auto-bootstrap |

Commands (30)

All commands are routable via the prompt auto-router — just describe what you want: /research, /plan, /create, /ship, /verify, /fix, /review-codebase, /design, /explore, /pr, /audit, /status, /health, /handoff, /curate, /init, and more.

Agents (9)

Plugin-defined agents with specialized system prompts and permissions:

| Agent | Role | |---|---| | build | Primary developer — full codebase access | | plan | Architecture & decomposition | | explore | Read-only codebase search | | scout | External research (docs, packages, patterns) | | review | Read-only code review & security audit (vc-codex/codex-auto-review) | | general | Small, well-defined implementation tasks | | runner | Shell/git/filesystem operations | | painter | Image generation & editing | | vision | Visual analysis (UI/UX, accessibility, design) |

How it works

Prompt routing (automatic)

Every user prompt goes through the prompt-leverage hook:

1. Execution framing — adds a 5-step checklist before acting
2. Auto-router — detects intent and injects the matching command runbook
3. Intent→Skill mapping — for free-form prompts, loads the right skills automatically
4. Prompt library — "act as ..." patterns trigger wiki search for playbooks

No configuration needed — it just works.

Hooks (runtime)

| Hook | Trigger | What it does | |---|---|---| | guard | Before bash commands | Blocks dangerous operations (rm -rf, sudo, db:reset) | | rtk | Before bash commands | Rewrites commands for token efficiency | | prompt-leverage | Every user prompt | Execution framing + auto-routing + intent mapping | | memory-inject | Every user prompt | Injects relevant past observations from memory DB | | memory-capture | After tool use | Records tool usage as observations | | session-summary | Stop | Persists session state across turns |

Quick reference

# Install globally
npx zcode-starterkit

# Sandbox test (doesn't touch real ~/.zcode)
npx zcode-starterkit --sandbox --skip-codebase-memory --skip-webclaw

# Inside a project — materialize the .zcode/ overlay
/init

# Disable optional integrations
npx zcode-starterkit --skip-codebase-memory --skip-webclaw

# Configure v-claw keys
zcode-starterkit setup-vclaw

# Uninstall
npx zcode-starterkit uninstall

For developers

Rebuild MCP tools

cd baseline/mcp-tools
npm install && npm run build

Cut a release

# 1. Bump version in both files:
#    package.json (version)
#    src/constants.mjs (PLUGIN_VERSION)
# 2. Commit + push
# 3. Tag + push tag
git tag v1.6.0
git push origin v1.6.0

The release GitHub Action runs tests (Linux + Windows), rebuilds MCP tools, and publishes to NPM. The tag must match package.json version.

Design docs

See docs/superpowers/specs/2026-06-24-zcode-starterkit-design.md for architecture details.

See AGENTS.md for the shipped global rules and the full Intent→Skill mapping table.