# FAQ

Common questions about zn-gate, the optional cloud and what is free.

Source: https://usezn.com/docs/faq/

## Do I need an account or an API key?

No. Everything that runs on your machine works without one, with no usage limits. An API key is only used by the optional cloud second opinion, and only together with `ZN_CLOUD=1`.

## Does anything leave my machine?

Not by default. Tool output, tool arguments and MCP tool descriptions are never sent, in any configuration. Prompts are sent only if you set both `ZN_CLOUD=1` and `ZN_API_KEY`, and secrets are redacted locally first. See [What leaves your machine](https://usezn.com/docs/what-leaves-your-machine/).

## Which agents are supported?

Any MCP client. The [quickstart](https://usezn.com/docs/quickstart/) has commands for Claude Code, Codex CLI, Cursor and OpenCode, and `zn-gate init` can rewrite the configs of Claude Desktop, Claude Code, Cursor, Codex CLI and OpenCode. For agents you build yourself, there is a [Python and Node.js SDK](https://usezn.com/docs/zn-gate/sdk/).

## Does zn-gate slow my agent down?

Typically by well under a millisecond. Measured on 2026-10-11 (2-vCPU Intel Xeon, Node 24, zn-gate 1.4.1): `check_tool_result`, including secret redaction, took 0.30 ms p50 and 0.81 ms p99 for a 4 KB tool output, and 3.8 ms p50 for 64 KB. Reproduce with `bench/bench_by_size.js` in the [repository](https://github.com/usezn/zn).

## Will it block legitimate content?

Sometimes. On whole source files the local rules currently produce false positives on ordinary code comments. Use shadow mode (`init --shadow` or `shield --shadow`) to log detections without blocking while you evaluate it, and use `check_tool_result` for web and third-party content rather than your own repository files.

## Does it see my agent's built-in tools?

Not today. A native file read or shell command in your agent does not pass through an MCP server, so zn-gate does not see it unless the output is sent through `check_tool_result`. Hooks for built-in tools are part of the [Scrubber preview](https://usezn.com/docs/zn-gate/scrubber/).

## Are there detection rates?

Not for zn-gate yet. The self-test (51 vectors) is a smoke test, not a detection or false-positive rate. We will publish results on a held-out test set, with method and data, before quoting a number. The cloud model, Galvanize 2, has held-out results with method in its [launch post](https://usezn.com/blog/introducing-galvanize-2/). The [Galvanize docs page](https://usezn.com/docs/galvanize/) has those results and, for the previous model, Galvanize-60M, its dated first-party benchmark with its public dataset.

## What do you charge for?

Only what cannot run on your machine: Galvanize 2, an open model, in the optional cloud check and, for teams, centralized controls. zn-gate itself is MIT. See [pricing](https://usezn.com/pricing/).

## How do I remove it?

`npx -y zn-gate init --revert` restores your configs from the backup. For a standalone server, remove the `zn-gate` entry from your agent config.

## How do I report a vulnerability?

Email `security@usezn.com`. Policy, scope and safe harbor: [security](https://usezn.com/security/).