MCP Server for Z.AI - A Model Context Protocol server that provides AI capabilities
Nothing to run from here
Leanfare is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
trust score
16
tools declared
local
runs on your machine
631
downloads
What it does
Makes your Claude plan last longer: hands reading and drafting to cheaper or free models.
Quickstart
Install it the way its author documents:
1. Download leanfare-darwin-arm64.mcpb and open it in Claude Desktop or another client that installs MCP bundles (.mcpb)
2. Its sha256 is 7f0171d1cc3e59fd4b916e4894283dab9f7fa72130c7fd639b072fe0e2704e13
The full guide: https://github.com/pouriaetab/leanfare/releases/download/v0.15.3/leanfare-darwin-arm64.mcpb
Publishernot claimed
POAll 2 servers
pouriaetab2 servers
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Leanfare as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Install it the way its author documents:
1. Download leanfare-darwin-arm64.mcpb and open it in Claude Desktop or another client that installs MCP bundles (.mcpb)
2. Its sha256 is 7f0171d1cc3e59fd4b916e4894283dab9f7fa72130c7fd639b072fe0e2704e13
The full guide: https://github.com/pouriaetab/leanfare/releases/download/v0.15.3/leanfare-darwin-arm64.mcpb
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
Before a task with several parts (a feature, a fix across files, a refactor, research across many files, reverse engineering a project), ask Leanfare how to split it. It answers with a short table: each part, its kind, where it runs (you, or Leanfare on a local, free or pay per use model), the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| task | string | yes | The whole task, as the user gave it, with what you already know about it. |
| files | array | no | The files or folders the task is about: full paths, ~/ paths, or paths relative to folder. Only their names and sizes are used here. |
| folder | string | no | The folder relative paths start from. By default, the folder the MCP client started Leanfare in (in Claude Code, the project). |
| split | string | no | auto (the default): a model the user ticked splits it. rules: Leanfare splits it by rules, with no model call. |
| private | boolean | no | true keeps the whole plan on the user's computer: the split and every Leanfare part go only to models there (Ollama), and a part none of them can take stays with you. Use it for anything sensitive or |
| your_model | string | no | The model you run on, as your own instructions name it (for example claude-opus-5-5). Leanfare names it for the work that stays with you, and the report shows it as the prompt's main model. |
| level | integer | no | The Leanfare level for this chat or session, as the level tool or Leanfare's prompt line gave it. Leave it out when none was given. |
| run | boolean | no | false: only split the task; Leanfare runs nothing. By default Leanfare starts its parts at once. |
Start the parts of a plan that Leanfare runs (local, free and pay per use models), in the background: at once where they can, each as soon as the parts it needs are done, with their answers handed on. Returns at once; read the progress and the answers with plan_status. Parts on local or free…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | The plan's id, from plan. |
| paid | string | no | yes: the user agreed to the paid parts. Default no. |
Stop the parts of a plan that Leanfare is running (plan_run). What was done stays; a part stopped half way may have been charged.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | The plan's id, from plan. |
Where each part of a plan stands (waiting, running, done, failed, yours, after yours, waiting for a yes) and the answers of the parts Leanfare finished. Each answer is also saved in the project, in .leanfare/plans/<id>/ (a folder git ignores), where you and the user can read it. wait: up to that…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | The plan's id, from plan. |
| wait | integer | no | Seconds to wait for the running parts to end before answering. |
| peek | boolean | no | true: only look, without taking the answers (Leanfare's plan card uses it). |
| folder | string | no | The project folder to save the answers in. By default, the folder the MCP client started Leanfare in. |
Review every answer Leanfare brings back (delegate, or a plan's part from plan_status) before you use it, then say how good it was: good, partly or wrong. Grade a delegate answer with handoff (the number in its receipt); a plan's part with id and part. If it is partly or wrong, fix it before you…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| verdict | string | yes | good: you used it as it was. partly: you had to fix or redo some of it. wrong: you could not use it. |
| id | string | no | The plan's id, from plan. |
| part | integer | no | The part's number in the plan. |
| model | string | no | For a delegate answer: the model id its receipt named, such as deepseek/deepseek-v4-flash. |
| kind | string | no | For a delegate answer: the kind you gave it. |
| handoff | integer | no | For a delegate answer: the hand off's number, from its receipt. Enough on its own. |
| fix | string | no | With partly or wrong. myself: you fixed it yourself before answering. leanfare: Leanfare asks again one tier up, with why, by another model, and returns the new answer. |
| why | string | no | With fix leanfare: what was wrong or missing, in a line or two. It goes to the model asked again, and is not kept. |
| whole | boolean | no | true: grade the final result of the prompt you are on, your own work and Leanfare's parts together (once, at the end of a prompt that handed work off). Only the verdict is needed with it. |
Ask a question through Leanfare and get the answer with its cost. By default Leanfare's Auto picks the cheapest model the user ticked that rates well for the task; name a model to use that one. The cost counts toward the user's budget.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| prompt | string | yes | The question or task, with everything the model needs to answer it. |
| model | string | no | auto (the default), auto-save, auto-balanced, auto-best, or a model id from the models tool, such as google/gemini-3.8-flash. |
| system | string | no | Instructions for the model (a system prompt). |
| max_tokens | integer | no | The longest answer to allow, in tokens. |
Hand a piece of work to a cheaper model through Leanfare, to save your own context and usage. Best for work that reads a lot and answers briefly: search or summarize big files, logs or many documents, review a file, draft a section. Name the files in files: Leanfare reads them itself, so their…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| task | string | no | What to do, written for a model that has not seen this conversation: the goal, what to look for, and the form of answer you want (for example: a list of file:line, one line each). |
| id | string | no | The id an earlier delegate answered with while it was still working: give only this to get that answer. |
| files | array | no | Text files for Leanfare to read and hand over with the task: full paths, ~/ paths, or paths relative to folder. At most 50 files, 2 MB each, 4 MB in all. Files that hold secrets (.env files, private k |
| folder | string | no | The folder relative paths start from. By default, the folder the MCP client started Leanfare in (in Claude Code, the project). |
| kind | string | no | read: find, pull out or summarize from the files. write: draft text or code. reason: work something out (a bug's cause, a plan, a proof). Leave it out to let Leanfare guess. |
| effort | string | no | How good the model must be: low takes the cheapest rated within 80 points of the best model the user ticked, medium within 40, high within 15. Also the thinking effort for models that think. Default m |
| check | string | no | auto (the default) has a stronger model check every high effort answer, 1 in 4 medium ones and 1 in 10 low ones. |
| speed | string | no | At the same quality: "cheapest" (however long it takes), "balanced" (time and cost weighed alike), "fastest" (whatever it costs), or a number of seconds to answer within, like "30". Default: the user' |
| private | boolean | no | true keeps this task on the user's computer: only models there (Ollama) take it, and its check too. Use it for anything sensitive or personal, or when the user asks. |
| max_tokens | integer | no | The longest answer to allow, in tokens (default 8,192). |
| your_model | string | no | The model you run on, as your own instructions name it (for example claude-opus-5-5). Leanfare names it for the work that stays with you, and the report shows it as the prompt's main model. |
| level | integer | no | The Leanfare level for this chat or session, as the level tool or Leanfare's prompt line gave it. Leave it out when none was given. |
What the user spent on AI through Leanfare today and this month, the budget left, what Auto saved against their usual model, the top models, the work Leanfare did for apps this month (plan and delegate): the share kept out of their plans, its cost and the grades; and each platform Leanfare may…
No parameter schema on file.
What Leanfare did for the user's apps over a span of time: the tokens its models read so the apps did not (kept out of their plans), the apps' own use where it is known (Claude Code's, from its own files), the cost, the quality (the apps' grades and the blind checks), tokens over time, the work by…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| range | string | no | The span: the last hour, 6 hours, today, the last 7 or 30 days, or the last year. Default 7d. |
| app | string | no | Only the prompts of this app, as Leanfare names it (Claude Code, Claude, Codex). |
| prompt | string | no | One prompt's id from a report, like PRM-41: that prompt and each of its parts (PRM-41.1, PRM-41.2). range and app are then left out. |
The models the user ticked in Leanfare and can use now, with their prices in US dollars per 1M tokens and their quality rating (Arena).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| provider | string | no | Only this provider, for example openai, anthropic, google, openrouter. |
Estimate what a prompt would cost and how long it would take before sending it: the model Auto would pick, why, and at the same quality the cheapest and the fastest choice. Nothing is sent to a model.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| prompt | string | yes | The prompt to price. |
| model | string | no | auto (the default) or a model id. |
| speed | string | no | For auto: "cheapest", "fastest", or a number of seconds to answer within, like "30". Default: the user's choice in Leanfare. |
Measure how well delegate answers on the user's models before relying on it: 10 questions with known answers about files Leanfare makes up, each asked at low, medium and high effort (30 answers, a few minutes; it costs what those answers cost, $0 on free plans). start begins it and returns at…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | string | no | status (the default), start or stop. |
The models on this computer (Ollama): where Ollama keeps them (the drive and its free space; downloads go there too), one suggested for each kind of work (reading, drafting, working things out) with its size in GB, and a test of a model the user has. Arena rates few small models, so the test asks…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | string | no | suggest (the default), test, status or download. |
| model | string | no | For test: a model the user has, like qwen3:8b. For download: one of the suggested models. |
| yes | string | no | For download, only where your app cannot show Leanfare's question: yes once the user agreed to the download in the chat. An app that can show it gets the question from Leanfare itself. |
How much to hand to Leanfare first, from 1 to 5: 1 Off (only when the user asks), 2 Light (big reads and tasks with several parts), 3 More (also reads over about 10 KB you will not change, project wide searches, summaries, reviews and first drafts), 4 Most (plan every prompt that is more than a…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| set | integer | no | The level to set: 1 Off, 2 Light, 3 More, 4 Most, 5 All it can. |
| scope | string | no | With set: chat (this chat only, the default), app (this app from now on) or default (every app and new chat). |
The model calls Leanfare is running right now, and those that ended in the last minute, as numbers only: the model, what it is for (a hand off, its check, a plan's part, an app through Leanfare's address), how long it has run, and its tokens so far by kind (new input, cached, thinking, written),…
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Leanfare or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 93 / 100
Release 0.15.3 · scanned 6 Nov 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings16 threat · 1 capability
Capabilityhigh
Coveragesource
Verificationrepo
Surface digest832b58e87d58440a72f6c67b4766cc6977cdb701fc3cd33abfb6b2311162e8bb
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (14 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| plan_run | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| plan_stop | state-write | state-write: declares readOnlyHint: false |
| plan_status | state-write | state-write: declares readOnlyHint: false |
| ask | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| delegate | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| spend | no tags | |
| report | no tags | |
| models | no tags | |
| estimate | no tags | |
| trial | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| local_model | untrusted-inputexternal-sink | untrusted-input: keyword "download"; external-sink: declares readOnlyHint: false, openWorldHint: true |
| level | state-write | state-write: declares readOnlyHint: false |
| helper | state-write | state-write: declares readOnlyHint: false |
| live | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest832b58e87d58440a
Scanned2026-11-06
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
It installs from its repository rather than from a versioned package, so the command cannot be pinned to a release. The history below is for reading; the current release on file is 0.15.3.
0.15.3
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Leanfare can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.