Developers
Installation
Install released local CLI, MCP and editor tools.
Overview
Use the released Zof CLI, MCP server, GitHub Action and VS Code extension for local change verification and portable evidence.
These tools run local static analysis. Public hosted SDK installation and method references are not available here; contact Zof for API integration support for your deployment.
Who should read this
- Developers reviewing local changes and teams evaluating the released open-source tools.
Prerequisites
- Node.js 22 or 24 and npm for the CLI and MCP server.
- Linux or macOS with Python 3.10 or newer for file operations. Windows file operations fail closed.
- Git for revision analysis; VS Code 1.139 or newer for the editor extension.
When to use this workflow
- Inspect supported JavaScript, TypeScript or Python changes with local static checks.
- Create portable evidence that distinguishes completed checks from missing or unrun tests.
Step-by-step procedure
Choose a released tool
Open its official package or repository below and review the supported platform and release notes. The local tools do not provide a hosted API client.
Try the synthetic CLI example
In a new empty project directory, run the pinned installation and example below. The fixture is supplied with the public CLI package.
Read the result and its limits
A passing result covers the reported static checks only. Inspect findings and incomplete execution before deciding how to use the evidence. Unit tests do not run during static verification.
Released tools
- CLI: @zof-ai/cli@0.1.2
- Local static verification, change impact, evidence and policy commands. Local commands do not require a Zof account.
- MCP: @zof-ai/mcp-server@0.1.2
- Six read-only tools over stdio, restricted to the workspace selected at startup. A remote HTTP transport is not implemented.
- VS Code: zof-ai.zof-verification
- Local verification, diagnostics, impact and evidence in a trusted workspace. Install the existing Marketplace extension or its versioned GitHub VSIX.
- GitHub Action: Zof-AI/zof-github-action@v0.1.2
- Offline static checks and JSON, Markdown, SARIF and portable evidence reports. It does not install or execute checked-out application code.
Best practices
- Pin released versions and review their changelogs before upgrades.
- Keep the selected workspace narrow. Local filesystem and Git metadata restrictions are documented in each repository.
- The CLI test command executes trusted configured commands only with explicit --allow-exec. It is not a sandbox; static verification does not execute application code.
Local CLI example
npm install --ignore-scripts --save-exact @zof-ai/cli@0.1.2 npx --no-install zof --help npx --no-install zof verify --root node_modules/@zof-ai/cli/examples/clean --changed math.ts --json
Was this page helpful?
