Maintainer of this skill?
MCP server for OpenCode AI — 70 tools, 10 resources, 5 prompts. Use npx opencode-mcp with Claude Desktop, Claude Code, Cursor, Windsurf, or any MCP client.
# Add to your Claude Code skills
git clone https://github.com/AlaeddineMessadi/opencode-mcpLast scanned: 7/25/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
"severity": "low"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono added timing comparison hardening in basicAuth and bearerAuth",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitest: When Vitest UI server is listening, arbitrary file can be read and executed",
"severity": "critical"
},
{
"file": "README.md",
"line": 24,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://opencode.ai/install | bash\"",
"severity": "low"
}
],
"status": "FAILED",
"scannedAt": "2026-07-25T06:20:18.505Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how opencode-mcp compares with popular alternatives.
opencode-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by AlaeddineMessadi. MCP server for OpenCode AI — 70 tools, 10 resources, 5 prompts. Use npx opencode-mcp with Claude Desktop, Claude Code, Cursor, Windsurf, or any MCP client. It has 156 GitHub stars.
opencode-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/AlaeddineMessadi/opencode-mcp" and add it to your Claude Code skills directory (see the Installation section above).
opencode-mcp is primarily written in TypeScript. It is open-source under AlaeddineMessadi on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh opencode-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Delegate coding work to OpenCode from your MCP client.
opencode-mcp connects Claude, Cursor, VS Code, and other MCP clients to OpenCode's headless API. Ask questions, implement features, monitor background work, respond to questions and permissions, and review changes across projects.
Version 3.0.0 requires Node.js 22 or newer. Upgrading from 2.x? See the migration notes.
Install OpenCode and start its server from your project:
opencode serve --hostname 127.0.0.1 --port 4096
If you use the TUI, start it with opencode --port 4096 and share that server. Set OPENCODE_BASE_URL for another endpoint.
For Claude Code:
claude mcp add opencode -- npx -y opencode-mcp
For clients using an mcpServers configuration:
{
"mcpServers": {
"opencode": {
"command": "npx",
"args": ["-y", "opencode-mcp"]
}
}
}
Restart the client and call opencode_setup. Choose a provider from its configured providers, then use opencode_provider_models to select a model. Set OPENCODE_DEFAULT_PROVIDER and OPENCODE_DEFAULT_MODEL together or pass the selected IDs in each prompt call.
Client-specific configuration includes VS Code, Windsurf, Continue, Zed, and Amazon Q. To test unreleased changes, build from source and configure your client to run node with the absolute path to dist/index.js.
| Need | Tools |
|---|---|
| Setup and orientation | opencode_setup, opencode_context, opencode_provider_models |
| Quick question or follow-up | opencode_ask, opencode_reply |
| Start work and wait | opencode_run |
| Work in the background | opencode_fire, then opencode_check or opencode_wait |
| Recover or control a recorded job | opencode_job_list, opencode_job_get, opencode_job_cancel |
| Resolve required input | opencode_job_input, permission and question tools |
| Review the result | opencode_review_changes, opencode_conversation |
opencode_fire({
directory: "/absolute/path/to/project",
prompt: "Add input validation to POST /api/users and run the relevant tests",
providerID: "<configured-provider>",
modelID: "<available-model>"
})
// Save the returned job and session IDs; use them to monitor or resume observation.
Async results distinguish accepted, running, input_required, completed, failed, cancelled, and unknown. An observation timeout returns current progress; it does not mean the task failed or was cancelled. Follow the returned state and IDs instead of assuming an absent busy status means success.
Modern clients can use the MCP Tasks extension for opencode_run. Clients without that extension use ordinary tools, including opencode_fire and opencode_check. Task status is retrieved by polling; this package does not promise to wake an idle assistant with completion notifications.
Tools retain readable text and provide structured results for clients that consume them. Prompt tools accept optional model variants and OpenCode structured-output formats. See the generated tools reference and examples.
Project-scoped tools accept directory: an absolute path on the OpenCode server. POSIX, Windows drive, and UNC paths are preserved across client operating systems. Relative paths are rejected; OpenCode checks existence and access.
opencode_project_init({path: "/absolute/local/project"}) creates or opens a directory on the MCP host. For remote OpenCode servers, create the project on that server instead. Authentication tools are global. Resources offer both static reads of the default project and explicit project/session templates.
Independent sessions do not isolate filesystem changes. Use separate project directories or Git worktrees when running overlapping coding tasks in parallel.
All settings are optional; an OpenCode server must already be running by default.
| Variable | Purpose |
|---|---|
OPENCODE_BASE_URL |
Server endpoint; defaults to http://127.0.0.1:4096 |
OPENCODE_SERVER_USERNAME, OPENCODE_SERVER_PASSWORD |
Optional server HTTP authentication |
OPENCODE_AUTO_SERVE |
Set to true to opt in to launching a local server |
OPENCODE_DEFAULT_PROVIDER, OPENCODE_DEFAULT_MODEL |
Default prompt provider/model pair |
OPENCODE_TOOL_PROFILE |
full (default) or a smaller essential tool set |
OPENCODE_TASK_STORE |
Override the local directory for persisted job records |
See configuration for storage, permissions, and client setup. Auto-start only supports local loopback HTTP endpoints; custom OpenCode CLI flags require a manually started server.
npm ci
npm test
npm run test:coverage
Tests use local fixtures and do not require a model subscription. For controlled live checks against a local OpenCode server:
npm run build
node scripts/mcp-smoke-test.mjs
Live smoke checks use a disposable project and owned session. Inference is opt-in with an explicitly selected provider and model. See live verification and releases for scope, skipped capabilities, and publishing checks.