Skip to main content

zambo: the verifiable work layer for AI, on your command line

AER-1, the agent execution receipt standard: zambo.dev/aer-1 | Add Zambo to your AI: zambo.dev/add

The problem: AI models talk. Getting things done, checking a live price, auditing a site, running research, pulling data, means wiring up APIs, keys, and glue code for every single task.

The fix: one command. Describe the job, get it done, get a receipt.

pip install zambo
zambo "what's the price of BTC right now?"
BTC $81,235.00 USD ...

receipt 89ccbddc-0b3b-4dbd-b424-4ee75119ef80
audit: https://zambo.dev/run/89ccbddc-0b3b-4dbd-b424-4ee75119ef80
verify: zambo verify 89ccbddc-0b3b-4dbd-b424-4ee75119ef80

No account. No API key. No config. Free tier included; limits vary by tool.

Quickstart

# One-command: describe any goal
zambo "audit example.com for AI discoverability"

# Call a specific tool directly
zambo call live_price '{"symbol":"BTC"}'
zambo call ghost_audit_site '{"url":"https://example.com"}'

# Search the 153-tool catalog
zambo search 'generate QR code'

# List exposed tools
zambo list

# Verify any receipt
zambo verify 89ccbddc-0b3b-4dbd-b424-4ee75119ef80

# Teach your agents about Zambo (writes to AGENTS.md / CLAUDE.md / .muserules)
zambo init

Or use it from Python:

import zambo

out = zambo.call_tool("live_price", {"symbol": "BTC"})
print(out["text"], out["receipt"]["id"])

v = zambo.verify_receipt(out["receipt"]["id"])
print(v["verified"], v["sha256"])

What Zambo is

Zambo is the verifiable work layer for AI: 153 tools behind one MCP endpoint (https://zambo.dev/mcp), over plain JSON-RPC. Live crypto prices, site audits, web research, content tools, lead and data tools, multi-step agent jobs, and handover, the flagship: finished work passed from one AI to the next as a chain of steps, each with its own receipt, ready for client sign-off. This package is a thin Python client for that endpoint (stdlib + requests only).

Don't know which tool fits? Skip the catalog: zambo "<goal>" routes through zambo_universal, which picks the right tools for the job. Pass --session <id> to keep a trail across calls.

Receipts: proof the saved result was not changed

Every call returns a verifiable receipt: a UUID, a timestamp, and a sha256 of the saved result, in the AER-1 format (IETF Internet-Draft draft-zambo-aer1-26). Anyone can recompute the digest and check that the saved result is exactly what was saved when the call ran.

Honest scope: a receipt proves the saved result was not changed. It does not prove the answer was right. It fixes the record; judging the work stays with you.

Check any receipt in your browser or on the command line:

zambo verify <receipt-uuid>     # confirms zambo.dev serves the receipt,
                               # and shows sha256, source, timestamp, audit URL

Receipt pages are real web pages with Open Graph tags and canonical URLs, shareable, linkable, citable.

Try the Receipt Test: run a free call, get a receipt, verify it yourself.

Free tier, honestly

  • Free: 20 calls + 1 wrap-up free every day; picking up in another AI is always free. No account, no API key, no card.
  • Paid: the $0.99 Day Pass (24h) at zambo.dev/day-pass: humans pay by card or PayPal, agents pay with USDC on Base via x402. The Zambo Pass is $29/mo or $290/yr ($19/mo for $ZAMBO holders). Never required for a first call.

No fake limits, no "contact sales to see a price."

Commands

Command What it does
zambo "<goal>" [--session <id>] Do the thing. Routes via zambo_universal.
zambo call <tool> '<json>' Call one tool directly.
zambo search '<query>' Search the 153-tool catalog.
zambo list List exposed tools with one-line descriptions.
zambo verify <receipt-uuid> Verify a receipt on zambo.dev.
zambo init [--root <dir>] [--file <name>] [--force] Write the Zambo section into your project's agent instruction file.

Requirements & troubleshooting

  • Python 3.8 or newer. Only dependency: requests.
  • The upstream endpoint occasionally resets connections; the client retries transient transport failures automatically (up to 4 attempts). A received JSON-RPC error is never retried; it's shown to you as-is.
  • Timeouts: 60s per attempt.

License

MIT: see LICENSE (included in the package). Built by Zambo (Brennan Zambo, solo founder).

Metadata

Release files for zambo 1.0.8

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for zambo 1.0.8
File Size Uploaded Provenance Actions
zambo-1.0.8.tar.gz 12.1 kB Without provenance Details for zambo-1.0.8.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for zambo 1.0.8
File Interpreter ABI Platform Actions
zambo-1.0.8-py3-none-any.whl Python 3 none any Details for zambo-1.0.8-py3-none-any.whl

Total release size: 23.6 kB

Release files / zambo-1.0.8.tar.gz

Download URL zambo-1.0.8.tar.gz
Size 12.1 kB
Tags Source
SHA-256 checksum
How to use checksums
4c616bcbac7a8179c3d9c7066b307094b294119d658811649d2548acd1522636
BLAKE2b-256 checksum
How to use checksums
41c9c51e97465362b0e5e87ec68d0c082b78bc88a8cbf30cb394805eec849d35
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via rambo-pypi-grab/0.1.0

Release files / zambo-1.0.8-py3-none-any.whl

Download URL zambo-1.0.8-py3-none-any.whl
Size 11.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
c75ddb8c48d19a97649f4e61511a0dd12173acd46cd9a081071899e61f970a09
BLAKE2b-256 checksum
How to use checksums
837db31285c2a5de4210d3c5d210a1f517f0449f7cffc40a8f2db8435e75ca7c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via rambo-pypi-grab/0.1.0

Security for zambo 1.0.8

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page