# zcode with an X-API-Key header: PASS (CLI engine; the desktop window was not run)

Run date: 2026-10-12 (UTC). Endpoint: `https://api.sbx.agent-next.com/mcp/v1`. Client: ZCode 3.14.5 official Linux `.deb`, engine 0.16.9 (`resources/glm/zcode.cjs`), unpacked with `dpkg -x` and run as `node zcode.cjs -p ... --json` inside a fresh sandbox only. The key was read in-process and never printed or logged.
Setup text: the live [For agents page](https://sbx.agent-next.com/docs/agents/#client-zcode), zcode section: the JSON merged into `$HOME/.zcode/cli/config.json`, then its verify command.
Not covered: the desktop window and its Settings > MCP Servers form (they need a display and a signed-in account). Outside the app, `zcode.cjs` also needs `provider/zcode-builtin.json` next to it (copy it from `resources/config/provider/`); the app does that itself.

## Flow

| step | result |
| --- | --- |
| install (162 MB download, unpack, `--version`) | 19.5 s |
| config from the page | PASS |
| verify command (`tools/list`) | PASS: nine tool names |
| session A: create, `echo ok; exit 3`, write and read `/tmp/hello.txt`, `ls -l /tmp`, `python3 -m http.server 8000` in the background, preview URL, no kill | PASS: exit code 3 and `ok`; file content `hi`; an external fetch of the preview URL returned HTTP 200; an independent MCP read returned `hi`; PID 1 is `tini`, 0 zombies |
| session B: `sandbox_kill` twice | PASS: `killed: true`, then `already_gone: true`; the preview URL then returned 502 |

## Residue (zero)

- The key's sandbox list was 0 at the end.
- After deleting the `agent-next-sandbox` entry from `config.json`, a scan of the home directory, `/tmp` and `/dev/shm` for the key found nothing except the test harness's own key file, which went away when the sandbox was destroyed.