zambo: the verifiable work layer for AI, on your command line
The problem: AI models talk. Getting things done, checking a live price, auditing a site, running research, pulling data, means wiring up APIs, keys, and glue code for every single task.
The fix: one command. Describe the job, get it done, get a receipt.
pip install zambo
zambo "what's the price of BTC right now?"
BTC $81,235.00 USD ...
receipt 89ccbddc-0b3b-4dbd-b424-4ee75119ef80
audit: https://zambo.dev/run/89ccbddc-0b3b-4dbd-b424-4ee75119ef80
verify: zambo verify 89ccbddc-0b3b-4dbd-b424-4ee75119ef80
No account. No API key. No config. Free tier included; limits vary by tool.
Quickstart
# One-command: describe any goal
zambo "audit example.com for AI discoverability"
# Call a specific tool directly
zambo call live_price '{"symbol":"BTC"}'
zambo call ghost_audit_site '{"url":"https://example.com"}'
# Search the 153-tool catalog
zambo search 'generate QR code'
# List exposed tools
zambo list
# Verify any receipt
zambo verify 89ccbddc-0b3b-4dbd-b424-4ee75119ef80
# Teach your agents about Zambo (writes to AGENTS.md / CLAUDE.md / .muserules)
zambo init
Or use it from Python:
import zambo
out = zambo.call_tool("live_price", {"symbol": "BTC"})
print(out["text"], out["receipt"]["id"])
v = zambo.verify_receipt(out["receipt"]["id"])
print(v["verified"], v["sha256"])
What Zambo is
Zambo is the verifiable work layer for AI: 153 tools behind one MCP endpoint (https://zambo.dev/mcp), over plain JSON-RPC. Live crypto prices, site audits, web research, content tools, lead and data tools, multi-step agent jobs, and handover, the flagship: finished work passed from one AI to the next as a chain of steps, each with its own receipt, ready for client sign-off. This package is a thin Python client for that endpoint (stdlib + requests only).
Don't know which tool fits? Skip the catalog: zambo "<goal>" routes through zambo_universal, which picks the right tools for the job. Pass --session <id> to keep a trail across calls.
Receipts: proof the saved result was not changed
Every call returns a verifiable receipt: a UUID, a timestamp, and a sha256 of the saved result, in the AER-1 format (IETF Internet-Draft draft-zambo-aer1-26). Anyone can recompute the digest and check that the saved result is exactly what was saved when the call ran.
Honest scope: a receipt proves the saved result was not changed. It does not prove the answer was right. It fixes the record; judging the work stays with you.
Check any receipt in your browser or on the command line:
zambo verify <receipt-uuid> # confirms zambo.dev serves the receipt,
# and shows sha256, source, timestamp, audit URL
Receipt pages are real web pages with Open Graph tags and canonical URLs, shareable, linkable, citable.
Try the Receipt Test: run a free call, get a receipt, verify it yourself.
Free tier, honestly
- Free: 20 free calls per day. No account, no API key, no card.
- Paid: the $0.99 Day Pass (24h) at zambo.dev/day-pass: humans pay by card or PayPal, agents pay with USDC on Base via x402. The Zambo Pass is $29/mo or $290/yr ($19/mo for $ZAMBO holders). Never required for a first call.
No fake limits, no "contact sales to see a price."
Commands
| Command | What it does |
|---|---|
zambo "<goal>" [--session <id>] |
Do the thing. Routes via zambo_universal. |
zambo call <tool> '<json>' |
Call one tool directly. |
zambo search '<query>' |
Search the 153-tool catalog. |
zambo list |
List exposed tools with one-line descriptions. |
zambo verify <receipt-uuid> |
Verify a receipt on zambo.dev. |
zambo init [--root <dir>] [--file <name>] [--force] |
Write the Zambo section into your project's agent instruction file. |
Requirements & troubleshooting
- Python 3.8 or newer. Only dependency:
requests. - The upstream endpoint occasionally resets connections; the client retries transient transport failures automatically (up to 4 attempts). A received JSON-RPC error is never retried; it's shown to you as-is.
- Timeouts: 60s per attempt.
License
MIT: see LICENSE (included in the package). Built by Zambo (Brennan Zambo, solo founder).
Metadata
Release files for zambo 1.0.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| zambo-1.0.5.tar.gz | 11.7 kB | Without provenance | Details for zambo-1.0.5.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| zambo-1.0.5-py3-none-any.whl | Python 3 | none | any | Details for zambo-1.0.5-py3-none-any.whl |
Total release size: 23.1 kB
Release files / zambo-1.0.5.tar.gz
| Download URL | zambo-1.0.5.tar.gz |
|---|---|
| Size | 11.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b08f1e7cb5b269dff4ffd35d6682e22863329b3c0d984b15137091e79783aefc
|
|
BLAKE2b-256 checksum How to use checksums |
f6fd41417eeda4679dd7308fcbc7d20a17fddb1345196995b3d1495c888685aa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
rambo-pypi-grab/0.1.0
|
Release files / zambo-1.0.5-py3-none-any.whl
| Download URL | zambo-1.0.5-py3-none-any.whl |
|---|---|
| Size | 11.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6e1d9873ca7478b4f216686a0d9fb38f0256b977f7ba1eebd7920efb23d0eac7
|
|
BLAKE2b-256 checksum How to use checksums |
0f7e05d5a6be71c8afbb8aa45842e63a69f03d3cc12068afb72741a4d29f4bc7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
rambo-pypi-grab/0.1.0
|
Security for zambo 1.0.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.