Agent Zero (Docker Linux-desktop agent)

Checked: 2026-11-14.

This note is about the open-source project at github.com/agent0ai/agent-zero and agent-zero.ai. It is the agent that runs a Linux desktop inside Docker. It is not an academic "agent zero" paper.

Docs below were read from the main branch unless a release or API URL is named. GitHub says main was pushed at 2026-11-13T11:24:28Z, after the latest release tag. Quotes are from the pages opened on this date. Numbers that were not on an opened page are marked UNVERIFIED.

1. Identity, license, release, stars

The README headline is "Give your agent a full Linux computer." The desktop guide says the Canvas starts "an XFCE desktop." That matches the Docker-desktop product, not a chat-only library.

License. The file LICENSE on main begins "MIT License" and copyrights "2025 Agent Zero, s.r.o". The README ends with "Agent Zero is available under the MIT License." The GitHub API for the same repo returns license.key other and license.spdx_id NOASSERTION. The license text that was opened is MIT. GitHub's detector did not assign an SPDX id.

Release vs. the docs quoted here. v2.15 notes (opened via the releases API) describe a large release: core tools moved into plugins, one memory tool, per-action tool permissions, channel security for Telegram and WhatsApp, Codex onboarding defaults, and "catalog thumbnails for all 47 bundled plugins." The install pages opened on main already point at A0 Launcher v1.9. Treat v2.15 as the latest tagged release and the main docs as newer than that tag.

2. Install on Windows and macOS

A container runtime is required. The installation guide says: "Launcher helps set up Docker, which runs Agent Zero's Linux workspace." The whole framework "runs within a Docker container."

The docs say Windows and macOS. They do not use the words "Windows 11" as a separate path. Windows downloads are x64 and ARM64. macOS downloads are Apple Silicon and Intel.

Recommended: A0 Launcher v1.9

The installation guide and README both say to start on a desktop with A0 Launcher v1.9:

• Windows x64: https://github.com/agent0ai/a0-launcher/releases/download/v1.9/a0-launcher-1.9-windows-x64.exe
• Windows ARM64: https://github.com/agent0ai/a0-launcher/releases/download/v1.9/a0-launcher-1.9-windows-arm64.exe
• macOS Apple Silicon: https://github.com/agent0ai/a0-launcher/releases/download/v1.9/a0-launcher-1.9-macos-arm64.dmg
• macOS Intel: https://github.com/agent0ai/a0-launcher/releases/download/v1.9/a0-launcher-1.9-macos-x64.dmg

Steps from the installation guide: open Launcher, follow any Docker setup prompt, choose Download Agent Zero or Run Agent Zero, keep latest and the persistent workspace selected, click Create, wait for Running, click Open UI. "Optional Host access can stay off."

The launcher guide says if Docker is not reachable, a setup dialog offers Continue (start or refresh local runtime setup), Refresh (after you start Docker yourself), or Add remote Instance (use Launcher with no local Docker).

One-line installer (A0 Install)

From the README and installation guide.

macOS / Linux:

curl -fsSL https://bash.agent-zero.ai | bash

Windows PowerShell:

irm https://ps.agent-zero.ai | iex

Scripted, no menus (installation guide):

curl -fsSL https://bash.agent-zero.ai | bash -s -- --quick-start --name agent-zero --port 5080

& ([scriptblock]::Create((irm https://ps.agent-zero.ai))) -QuickStart -Name agent-zero -Port 5080

The a0-install README (opened) says what those scripts do when Docker is missing:

• macOS: open Docker Desktop if it is already installed. If Docker is missing, the script can set up Colima with an a0 profile and its own Colima, Lima, and Docker CLI binaries. Homebrew is not required.
• Windows client editions: reuse Docker Desktop if the daemon is reachable, reuse Docker Engine in an existing WSL2 distro, or guide an interactive setup of WSL2, Ubuntu, and Docker Engine. "Windows may request UAC approval and may require a restart." If it uses WSL Docker, it starts a WSL keepalive so Windows does not idle-stop the distro. Windows Server is called out as not supporting Docker Desktop.
• It also knows Docker-compatible endpoints including Colima, OrbStack, Rancher Desktop, and Podman.

Default Web UI port in that installer is the first free port starting at 5080. Data default is ~/agent-zero/<instance>/usr, mounted at /a0/usr.

Direct Docker command

README and installation guide, when Docker is already running:

docker run -d -p 127.0.0.1:5080:80 -v a0_usr:/a0/usr agent0ai/agent-zero

Then open http://localhost:5080 on the Docker host. The guide says this binds to that computer only. The named volume a0_usr keeps settings, chats, memory, projects, and custom plugins.

The a0-install README also shows a different one-liner for "a single instance on port 80":

docker run -p 80:80 agent0ai/agent-zero

That command is not detached, is not limited to 127.0.0.1, and does not name a data volume. The Agent Zero README's 5080 command is the one the current install guide tells desktop users to use.

Manual Docker Desktop path (called advanced)

The installation guide says most people should use Quick Start. The manual section still says:

• Windows: download Docker Desktop (Intel/AMD is the main button), run the installer with default settings, launch Docker Desktop.
• macOS: download Apple Silicon or Intel, drag Docker to Applications, launch it, then in Docker menu → Settings → Advanced enable "Allow the default Docker socket to be used (requires password)."

RAM and disk

The desktop installation guide that was opened does not state a RAM or disk size for Windows or macOS.

The only requirements table opened is in docs/setup/vps-deployment.md. That page says it was last updated December 21 2025, is for Docker-capable Linux servers, and is "contributed by @hurtdidit":

It also asks for Docker Engine 24.0+. Do not treat that table as a Windows 11 or Mac laptop spec. A separate Windows/macOS RAM or disk number was not found in the install pages opened. UNVERIFIED for a desktop minimum.

A different hardware note, only for the optional Apple local server oMLX: "oMLX requires Apple Silicon and macOS 15+. On 16 GB machines, start with small quantized MLX models." That is about the model server, not the Agent Zero container.

Docker image download size: UNVERIFIED (not stated on the pages opened).

3. Built-in computer

Documented in the desktop guide, browser guide, usage guide, and README:

• Linux desktop: XFCE session in the right-side Canvas. Click the Desktop icon. First start after an update can be slow. You can watch and take over with your own mouse and keyboard.
• File manager: the desktop guide says to open the graphical file manager for Workdir, Projects, Skills, Agents, or Downloads. It does not name the file-manager package on that page.
• Terminal: "open a terminal when a visual terminal session is useful." The agent also has code execution in a terminal (usage guide: it may choose "code execution").
• LibreOffice: Writer, Calc, and Impress inside the Desktop. Default formats called out: ODT, ODS, ODP. Ask for DOCX, XLSX, or PPTX "only when you need Microsoft Office compatibility."
• Markdown editor: Canvas editor for Markdown, with live cowork. The Desktop New menu can create Markdown, Writer, Spreadsheet, and Presentation files.
• Browser: a separate Canvas surface, not "launch a browser inside the Desktop." The browser guide says the Docker browser is the default, is already included in normal Docker installs, and can open pages, click, type, upload, and screenshot. Annotate mode lets a person click an element and send a comment into the chat. Troubleshooting says Docker installs already include the browser and names Chromium as the missing-browser message in local development (patchright install chromium).
• Blender: the README's "Try These First" prompt says "Use the Linux Desktop to open Blender." The desktop guide does not list Blender as an included app. Whether the image ships Blender was not confirmed on a package list opened from main. Treat Blender as an example prompt, not a verified preinstalled app.

The usage guide also documents a file browser (upload, download, folders, rename, delete) and voice plugins (_kokoro_tts, _whisper_stt) that run in the container when enabled. Browser fallback speech uses the browser. "No voice path requires OpenAI APIs."

4. Memory, skills, plugins, subordinate agents, messaging

Memory

The memory guide: Agent Zero can remember facts, solutions, preferences, and imported knowledge. The dashboard filters areas main, fragments, solutions, and skills. People can search, edit, and delete entries. Project memory is separate from global memory. The installation guide says the embedding model "helps find relevant memory and knowledge. The default runs locally on the CPU." Changing it "requires rebuilding the memory index."

v2.15 notes say the old memory_load, memory_save, memory_delete, and memory_forget tools became one memory tool with an action argument.

Skills

The skills guide: skills are focused instructions loaded when a task needs them, or pinned from the chat + → Skills so they stay in the prompt protocol. The usage guide says to keep the pinned list short. README: skills can be loaded on demand or pinned.

Plugins

The usage guide: open Plugins, or Browse / Install for the Plugin Hub. Hub entries include providers, tools, panels, and automations. Read a plugin's description and permissions before installing. v2.15 notes say that release added thumbnails for 47 bundled plugins. A live count of the plugin directory was not re-tallied here.

MCP is documented separately: the active profile's MCP policy decides which discovered tools may run.

Subordinate agents

README "Multi-Agent Cooperation": "Agent Zero can delegate parts of a task to other agents. Each works with its own instructions and conversation, then reports back." The usage guide: inside one instance, "the main agent can create subordinate agents" for research, code review, and comparison. Separate instances can also talk over A2A (a different feature; see the A2A setup guide).

Agent profiles (developer, researcher, and custom roles) are the role layer. The Agent Editor sets instructions, a model preset, and tool/MCP/skill policy. A bundled Tiny Local profile is named for small local models that narrate instead of calling tools.

Messaging

All three exist as plugins on main. Onboarding calls Telegram, Email, and WhatsApp optional cards after model setup.

• Telegram (plugins/_telegram_integration/README.md): one or more bots, polling or webhook, per-user chats, files, groups. Settings are global-only. An empty allow-list means "open to all." Settings changes from Telegram require a separate administrator list; an empty administrator list grants nobody settings access. v2.15 says accepted senders can no longer use /permissions to lift their own tool restrictions, and old project-scoped Telegram configs pause the bot until reviewed.
• WhatsApp (plugins/_whatsapp_integration/README.md): "a Baileys-based Node.js bridge," QR pairing via WhatsApp → Linked devices. Documented defaults include enabled false, mode self-chat, allowed_numbers [] (all), admin_numbers [] (none). The README warns that a personal number with an open allow-list lets other people message the agent, and that the agent can handle messages other people send to that number. Node.js v18+ is listed as a requirement; dependencies auto-install on first bridge start if missing.
• Email (plugins/_email_integration/README.md): IMAP, Exchange inbox polling, and SMTP replies. Attachments go to usr/email/attachments. It filters the claimed From address and says sender authenticity depends on the mail provider. An enabled-by-default flag was not in the section opened.

Schedules

The usage guide Tasks section: scheduled, planned, or ad-hoc tasks, optionally bound to a project so they inherit that project's instructions, secrets, files, and memory. Examples given include morning or weekly reports and monitoring a source. The scheduler plugin README says the scheduler tool can list, run, update, delete, and create those tasks, and that the Tasks UI lives in that plugin.

Phone access to the Web UI itself is a tunnel: Settings → External Services → Flare Tunnel, after UI authentication is set. The usage guide says anyone with the tunnel URL can try to open the instance.

5. Models the current docs list

Two roles at first run: a Main model for the conversation and a Utility model for summaries, chat names, and memory. They can share a provider. An embedding model is separate; the install guide says the default embedding runs locally on the CPU.

Onboarding paths (docs/guides/onboarding.md)

• Cloud (API key): "OpenRouter, OpenAI, Anthropic, Google, Venice, or another hosted provider."
• AI account (sign-in, not a pasted key): "Codex/ChatGPT, GitHub Copilot, Google Cloud Gemini, or xAI Grok."
• Local: "Ollama, LM Studio, oMLX, llama.cpp, vLLM, or another model server."

Missing providers: a Plugin Hub link filtered to providers. The OpenCode Go guide is the worked example.

Chat providers in conf/model_providers.yaml on main

Opened in full. Human-readable names:

Agent Zero API, Anthropic, Cerebras, CometAPI, DeepSeek, GitHub Copilot, Google (LiteLLM provider gemini), Groq, HuggingFace, LM Studio, llama.cpp, Mistral AI, Moonshot AI, Nebius Token Factory, NVIDIA NIM, Ollama, oMLX, Ollama Cloud, OpenAI, OpenAI Azure, AWS Bedrock, OpenRouter, Sambanova, Venice.ai, vLLM, xAI, Z.AI, Z.AI Coding, and Other OpenAI compatible.

Embedding providers in that same file: HuggingFace, Google, LM Studio, llama.cpp, Mistral AI, NVIDIA NIM, Ollama, oMLX, OpenAI, OpenAI Azure, AWS Bedrock, OpenRouter, Agent Zero API, Venice.ai, vLLM, and Other OpenAI compatible.

Default local base URLs in that file use host.docker.internal (Ollama port 11434, LM Studio port 1234, llama.cpp port 8080, oMLX and vLLM port 8000). The install guide says not to use localhost or 127.0.0.1 for a server on the host, because those addresses point at the container. If the local server listens only on 127.0.0.1, Docker still cannot reach it; the server must listen on a Docker-reachable address such as 0.0.0.0, limited to trusted clients.

Official site install page, Ollama quick path: install Ollama, ollama pull MODEL_NAME, provider Ollama, base URL http://host.docker.internal:11434. LM Studio: enable its local API server and replace a localhost host with the Docker-reachable address.

Codex OAuth

docs/guides/codex.md was opened. It is ChatGPT account sign-in for Codex. "You do not need to paste an OpenAI API key or install the Codex CLI." The user turns on ChatGPT's device-code sign-in, connects Codex/ChatGPT, copies a device code, and authorizes on auth.openai.com. OpenAI's page calls the access "Codex CLI."

Onboarding suggestions when the account has them: Main gpt-6.1-terra, Utility gpt-6-luna. The guide says these are suggestions, other models from the account list are allowed, and "the available names may change over time." v2.15 notes say the same defaults and "Codex client version bumped to 0.166.0."

Usage limits are "that account's." No numeric Codex quota was copied because none was on the page.

6. Safety

Stays in the container unless you opt out

README: "It runs in a sandbox, but you can step in, and connect it to local files on your own computer when needed."

README safety list, quoted in substance:

• Keep it running inside Docker or another isolated environment.
• Do not mount your entire home directory unless you understand the risk.
• Give Launcher or A0 CLI permission to edit files and run commands only when you trust the connected Instance.
• Store credentials in project secrets or settings, not in prompts or public files.
• Review actions that touch accounts, money, production systems, or private data.
• Keep backups.

Installation guide: "Agent Zero can work in its Linux workspace without access to the rest of your computer." Host access is optional and "can stay off."

Launcher guide: "Host access lets an open Instance use files, terminal commands, a supported browser, or Computer Use on the computer running Launcher. It starts off and is optional for your first chat." The folder control "selects where file operations and commands start; it does not restrict commands to that folder."

The recommended docker run publishes 127.0.0.1:5080 only. The install site says to enable authentication before exposing the instance to the internet, and "never expose the instance to the internet without Web UI authentication enabled." The recommended local command does not set AUTH_LOGIN or AUTH_PASSWORD.

a0-install: if you pass --auth-login and omit a password, the password "defaults to 12345678."

Time Travel (README) snapshots /a0/usr so you can roll back workspace files. It "is not a replacement for Git or backups."

Approval before actions

What the opened docs show:

• While a run is going, the person can Pause, Stop, queue a follow-up, or Nudge. That is steering, not a yes/no gate on each command.
• Agent profiles can set each tool, and individual actions such as text-editor read vs write, to On, Default, or Off. The agent-profiles guide says: "Tool permissions control those tool calls; they are not a filesystem sandbox. Allowing terminal execution can still let the agent read or write files even if the text editor's write action is off."
• The same guide's JSON example uses "default": "allow" for tools and "mcp_default": "block" for MCP. That block is a format sample, not a labeled factory file. The shipped default of the Allow switch was not opened in a bundled profile's plugins/_tool_access/config.json. UNVERIFIED whether a fresh profile allows terminal and browser tools without an extra click.
• The usage guide says you usually do not name tools: "Say what you want done and Agent Zero will choose." No sentence in the usage, desktop, or README safety sections says the agent stops and asks before each command inside the container.
• v2.15 adds per-action allow/deny in the Agent Editor, and says input_remote cannot bypass a blocked remote terminal. That is policy, not a popup.
• Host-browser remote debugging does show a Chrome Allow remote debugging? prompt the first time, and only for the host browser path.
• Provider-hosted MCP approval inside the model loop is denied in code (agent.py on main): "Agent Zero denied it because provider-hosted MCP approval requires explicit user approval." That is a deny, not a user prompt.

AGENTS.md in the repo has an "Ask Before Executing" list (pip install, git commits). That file is instructions for coding agents working on the Agent Zero repository. It was seen in search and is not the product's user approval dialog. It is not treated as the end-user safety default.

7. What a non-technical person would find hard

• A container is still in the path. The launcher is a real Windows .exe and macOS .dmg, but the Linux workspace does not run until Docker, or a substitute the installer sets up, is working. On Windows that can mean UAC, WSL2, Ubuntu, and a restart. On Mac the script may install Colima, or the manual Docker Desktop path asks for a socket checkbox and a password.
• The app is a browser page. Launcher opens a Web UI. The address depends on the port. The current guide uses 5080. The a0-install README still shows port 80. "Port is already in use" is a README troubleshooting item.
• First run does not chat until a model is connected. The first message waits. The person must pick cloud key, account sign-in, or a local server, then both a Main and a Utility model.
• Local models are easy to point at the wrong machine. localhost inside Agent Zero means the container. The docs require host.docker.internal or a bridge address, and a server that is not bound only to 127.0.0.1.
• Two places files can live. Workspace storage is the container's /a0/usr. Host access is a separate, off-by-default bridge onto the real computer, and its folder is a starting point, not a cage.
• Codex sign-in is a device code plus a ChatGPT security toggle, not "log in with Google."
• WhatsApp and Telegram are extra setup (bot token, or a QR code and a Node bridge), not part of the first Create click.
• No desktop RAM number is written next to the Windows or Mac steps. A person cannot tell from those pages whether an 8 GB laptop is enough. UNVERIFIED.

8. Facts for the scorecard

Weights from the project spec: capability ceiling 30%, Windows/Mac install friction 25%, safe-by-default 20%, model flexibility 15%, phone/schedule continuity 10%. This section records facts. It does not assign the points.

Capability ceiling

Strong on the things the spec cares about, inside one product:

• Real browser in Docker (click, forms, screenshots, annotations) plus an optional host browser.
• Files, Markdown cowork, and LibreOffice Writer, Calc, and Impress.
• Terminal and a full XFCE desktop the person can watch.
• Memory with a dashboard and project scope.
• Skills, plugins, MCP, and subordinate agents.
• Scheduled, planned, and ad-hoc tasks in the same UI.

Limits that are documented: host access and host browser are optional escapes from the container; Blender is only an example prompt; long-term memory "is not a solved problem" and needs human cleanup; small local models may talk instead of using tools (Tiny Local profile exists for that case).

Windows and Mac install friction

Higher than a single native installer that needs no container.

• There is a GUI launcher (v1.9) for Windows x64/ARM64 and macOS Apple Silicon/Intel, and a one-line script for each.
• Docker, or Colima on Mac, or WSL2 Docker on Windows, is still required for the local workspace. The launcher can point at a remote instance instead.
• First chat still needs an API key, an account sign-in, or a local model server.
• Port and "Docker is not running" are documented troubleshooting cases.
• No Windows 11 or macOS RAM/disk floor was found in the desktop steps. The only RAM table is a December 2025 Linux VPS page (2 GB minimum, 4+ GB recommended, 20 GB / 50+ GB disk).

Safe-by-default

The documented default workspace is the container. Host access starts off. The recommended Docker port is bound to 127.0.0.1. Internet sharing is documented as unsafe until Web UI authentication is on.

It is not a "click Allow on every shell command" product in the docs that were opened. Pause and Stop exist. Tool policies can block actions, but the factory position of "allow tools by default" was not read from a bundled config (UNVERIFIED). The profile guide warns that a blocked editor write does not stop a terminal from writing files. WhatsApp ships with enabled: false, but an empty number list means all senders once it is on. Telegram's empty allow-list means open to all once a bot is configured. Installer auth, if a username is set and no password is passed, defaults to 12345678.

Model flexibility

Broad on the current provider file and onboarding guide: OpenAI, Anthropic, Google/Gemini, OpenRouter, Ollama, LM Studio, llama.cpp, vLLM, oMLX, plus many other hosted names (Groq, Cerebras, DeepSeek, Mistral, xAI, Venice, NVIDIA NIM, Azure, Bedrock, Z.AI, and others) and Other OpenAI compatible for a custom base URL. Codex/ChatGPT, GitHub Copilot, Google Cloud Gemini, and xAI Grok are account sign-in paths. Extra providers can be added from the Plugin Hub.

Local use still has the Docker networking catch (host.docker.internal, not localhost).

Phone and schedule continuity

Same software can add both, after the desktop install:

• Schedule: Tasks in the Web UI (scheduled, planned, ad-hoc), including project-scoped tasks. Not a separate app.
• Phone: Telegram and WhatsApp plugins, plus email. WhatsApp is off until QR pairing. Telegram needs a bot. A Flare tunnel can open the Web UI from another device after authentication.
• Continuity is real, but it is a second setup, not the first ten minutes. WhatsApp's Baileys bridge and "message your own number" mode are documented; a ban or ToS rate was not on the plugin page (UNVERIFIED).

Sources

Opened 2026-11-14.

• https://api.github.com/repos/agent0ai/agent-zero — stars 19,853, forks 3,876, open issues 161, created 2024-06-10, homepage, license detector NOASSERTION, pushed_at 2026-11-13T11:24:28Z
• https://api.github.com/repos/agent0ai/agent-zero/releases/latest — tag v2.15, published 2026-11-01T23:52:00Z, release notes including 47 bundled plugins, Codex defaults, Telegram/WhatsApp admin rules
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/LICENSE — MIT License, copyright 2025 Agent Zero, s.r.o
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/README.md — identity, launcher v1.9, install commands, desktop, browser, Codex, safety
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/setup/installation.md — launcher, A0 Install, Docker command, Docker Desktop steps, macOS socket note, oMLX 16 GB note, local embedding default
• https://www.agent-zero.ai/p/docs/installation/ — same install story on the official site, including Ollama URL and "never expose … without Web UI authentication"
• https://raw.githubusercontent.com/agent0ai/a0-install/main/README.md — Windows WSL/UAC behavior, macOS Colima fallback, port 80 alternate command, default auth password 12345678
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/launcher.md — runtime dialog, host access off by default, folder is not a command jail
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/desktop.md — XFCE, file manager, terminal, LibreOffice
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/browser.md — Docker browser default, Chromium in Docker installs, annotate, host browser
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/onboarding.md — Cloud, account, and local provider groups
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/codex.md — ChatGPT device-code Codex sign-in; suggested models gpt-6.1-terra and gpt-6-luna
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/conf/model_providers.yaml — full chat and embedding provider list and default local base URLs
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/memory.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/skills.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/agent-profiles.md — On/Default/Off tools; JSON example is not treated as the factory file
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/guides/usage.md — pause/stop, tasks, plugins, subordinates, tunnels, voice
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/plugins/_scheduler/README.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/plugins/_telegram_integration/README.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/plugins/_whatsapp_integration/README.md
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/plugins/_email_integration/README.md
• https://api.github.com/repos/agent0ai/agent-zero/contents/plugins?ref=main — confirms _telegram_integration, _whatsapp_integration, _email_integration, _scheduler, _memory, _skills, _desktop, _browser on main
• https://raw.githubusercontent.com/agent0ai/agent-zero/main/docs/setup/vps-deployment.md — Linux VPS RAM/disk table, page date December 21 2025
• https://github.com/agent0ai/agent-zero/blob/main/agent.py — MCP approval requests are denied pending explicit user approval (file fetched during search)

Not used as current facts: the older knowledge page that said providers were current "as of v0.9.8", GitHub discussion posts about EC2 sizing, and search snippets that claimed "100+ community plugins" (that phrase is not in the README that was opened).