# Agent Zero (slim)

> Agent Zero is an open-source agent framework that runs in a Docker container with a Linux desktop, a browser, a task scheduler and memory. Its owner reaches it through a web interface, Telegram, WhatsApp or email.

- Full: https://www.anchorterminal.com/tools/agent-zero.md (~8,600 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/tools/agent-zero.json · canonical https://www.anchorterminal.com/tools/agent-zero
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**C · 54.2/100 · rank #709 of 986 · #19 in Agent harnesses · not agent-ready · confidence medium**


Assessment: Self-hosted under the MIT licence, with nine releases in the 90 days to 12 October 2026 and breaking changes listed in the release notes. The agent runs shell commands in its container with no approval step, the web interface has no login by default, and five CVEs from the past year have no published GitHub advisory.

## Facts

- Kind: Agent harness · vendor: Agent Zero, s.r.o. · category: Agent harnesses · legal entity: Agent Zero, s.r.o. · provenance 53/100
- Packages: oci `agent0ai/agent-zero`
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: One Docker container on the owner's machine or server, built on Kali Linux, with a web interface on port 80, an XFCE desktop and a browser. The A0 CLI connector can extend it to host files, shell and browser
- Acts without asking: Shell commands, file edits and deletions, browser and desktop actions, MCP tool calls, scheduled tasks and replies on Telegram, WhatsApp and email all run without an approval step
- Controls: Tool Access allows or blocks each tool by project or agent profile and defaults to allow. Infection Check audits tool calls with a second model and ships disabled. Pause, stop and intervene controls in the interface. Time Travel snapshots can revert `/a0/usr` workspaces
- Proactive work: Scheduled (cron), planned (dated) and ad-hoc tasks, created in the interface or by the agent's `scheduler` tool, optionally bound to a project
- Channels: Web interface, Telegram bots (polling or webhook), WhatsApp through a Baileys bridge paired by QR code, and email by IMAP or Exchange polling with SMTP replies. The external API, MCP server, A2A and ACP serve other programs
- Who can message it: Per-channel allow-lists. An empty list accepts every sender. WhatsApp is disabled by default and no Telegram bot or mailbox is configured by default
- Accounts and credentials: A mailbox login for the email channel, a Telegram bot token, a linked WhatsApp session, and OAuth sign-in to ChatGPT (Codex), GitHub Copilot, Google Cloud Gemini or xAI for model access. No calendar or contacts connection is built in. Keys, passwords and secrets are stored in `.env`, `secrets.env`, `config.json` and `auth.json` files under `/a0/usr`, masked in prompts and the interface
- Memory: FAISS vector store with areas for main memories, fragments, solutions and skills. Automatic memorising and recall are on by default, and memory is isolated for each project by default. Chats are saved under `/a0/usr/chats`
- Deleting memory: The dashboard deletes one entry or many, and the agent has `memory_delete` and `memory_forget` tools. Backups and Time Travel snapshots made earlier can still hold a copy
- Model providers: 29 chat providers in the shipped list, among them Anthropic, OpenAI, Google, OpenRouter, Bedrock, Azure, Ollama, LM Studio, llama.cpp and vLLM, through LiteLLM. The provider chosen sees the conversation content
- Other outbound traffic: Update check to api.agent-zero.ai, on by default. Web search, browsing, MCP servers and tunnels (Cloudflare, Tailscale, Microsoft, Serveo) when the owner uses them
- MCP client: Command-based (stdio) and URL-based servers with headers, set as JSON in Settings, with a 120-second tool timeout by default and a scanner for new servers
- Cost: Free under MIT. Model usage is billed by the chosen provider, or nothing with a local model. The README says it runs on a $6 VPS
- Advisories: CVE-2026-4307 and CVE-2026-4308 (17 March 2026), CVE-2026-47119 (27 May 2026), CVE-2026-51852 and CVE-2026-51853 (30 September 2026), plus two flaws fixed in v2.12 on 9 September 2026. No GitHub advisory published
- Releases: v2.13 on 23 September 2026. Nine releases between 17 July and 23 September 2026

- Scores: Reliability 57, Performance pending, Schema & documentation 64, Agent ergonomics 62, Security & auth 54, Payments & pricing 60, Task success pending, Maintenance & community 75, Transparency & trust 55 · negative events -6 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as software the owner runs. · Schema & documentation, Harness reading of the lines, as the Goose calibration dossier does. · Agent ergonomics, Harness reading, scored on what a person or program driving it must supply. · Security & auth, Harness reading of the framework checklist, the one the Goose calibration dossier uses. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v2.13 was published on 23 September 2026, 19 days before this check (30). · Transparency & trust, MIT, copyright Agent Zero, s.r.o. (30).
- Sources: 33, open questions: 12, both in the full twin
- Capabilities: agent.harness, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/agent-zero.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/agent-zero.svg` or a link to https://www.anchorterminal.com/tools/agent-zero from a page on agent-zero.ai or one of its subdomains, or the README of github.com/agent0ai/agent-zero, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set a UI login and password in Settings before publishing the port or opening a tunnel. The default has none
2. Fill `allowed_users`, `allowed_numbers` or `sender_whitelist` before enabling a channel. An empty list accepts every sender
3. Enable the Infection Check plugin when the agent reads mail, web pages or MCP results. It ships disabled
4. Run v2.12 or later. It fixes a Telegram webhook authentication bypass and a WhatsApp media path traversal
5. Call `POST /api_message` with the `X-API-KEY` header. The token changes when the UI login or password changes

## Connect

```bash
docker run -p 80:80 -v a0_usr:/a0/usr agent0ai/agent-zero   # or: curl -fsSL https://bash.agent-zero.ai | bash
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Kilo Code CLI | BB | 75.4 | agent.harness, agent.mcp-client | https://www.anchorterminal.com/tools/kilo-code-cli.min.md |
| goose | BB | 73.9 | agent.harness, agent.mcp-client | https://www.anchorterminal.com/tools/goose.min.md |
| OpenAI Codex | BB | 73 | agent.harness, agent.mcp-client | https://www.anchorterminal.com/tools/openai-codex.min.md |
| Qwen Code | BB | 72.4 | agent.harness, agent.mcp-client | https://www.anchorterminal.com/tools/qwen-code.min.md |
| OpenHands | BB | 70.8 | agent.harness, agent.mcp-client | https://www.anchorterminal.com/tools/openhands.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)