OpenCode: The Open-Source Coding Agent for Any Model (GitHub, Scanned)

OpenCode is a coding agent with a polished terminal interface: it reads your project, edits files, runs commands and loops on the results, much like Claude Code or Codex, but with no ties to one model vendor. It connects to Anthropic, OpenAI, Google, GitHub Copilot, OpenRouter and local models, and ships two agents you switch between with Tab: build, which has full access, and plan, which cannot edit files and asks before running any command. A desktop app for macOS, Windows and Linux is in beta.

It is the most-starred repository on this list, with more than 200,000 stars and over a thousand contributors in under a year and a half, and releases most days. The code is MIT-licensed TypeScript run on Bun, maintained by the company Anomaly. The company's business is OpenCode Zen, an optional pay-as-you-go gateway of tested models, some of them free; the agent works the same with your own keys.

• Repository: github.com/anomalyco/opencode
• Licence: MIT (MIT License)
• Language: TypeScript. Stars: 210.3K. Forks: 27.8K. Last push: Sep 27, 2026.
• Scan: safe, Sep 26, 2026, commit b471c2b

Who it is for

Developers who want a Claude Code style agent without committing to one vendor's models, people with several subscriptions or API keys who want one tool for all of them, and anyone who wants to read or change the agent they run.

Getting started

1. Install with the script on macOS or Linux (or brew install anomalyco/tap/opencode; scoop or choco on Windows)

curl -fsSL https://opencode.ai/install | bash

2. Or with npm (bun, pnpm and yarn work too)

npm i -g opencode-ai@latest

3. Start it in a project, add a provider, then press Tab to switch between the build and plan agents

cd your-project && opencode

The README labels the curl | bash line YOLO itself. The script, install in the repository, is 460 lines: it downloads the release from GitHub and adds its folder to your PATH through your shell config unless you pass --no-modify-path. The package managers are the quieter route.

Safety scan

We cloned anomalyco/opencode at commit b471c2b on Sep 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• One secret candidate, a Google API key string in packages/http-recorder/test/record-replay.test.ts. It is sample data in a test for the HTTP recorder that must scrub keys from saved sessions, next to an equally fake sk- key. No self-decoding code and no committed binaries; the bare IPs are 1.1.1.1 URLs in the web-fetch tool's tests.
• The pattern hits are the install script's own usage text, the desktop app's WSL support running the official installer inside WSL, and two container Dockerfiles installing Bun and Rust. The one that stands out is patches/install-korean-ime-fix.sh: it clones a contributor's fork (claudianus/opencode) from GitHub, builds it, and replaces your opencode binary with the result, to fix Korean input. It does what it says and runs only if you run it, but it installs code outside the main project's review.
• The root package.json has a postinstall that fixes node-pty's build and a husky prepare hook; both run for contributors working in the monorepo, not for users installing the published package.
• Dependencies could not be checked. The project uses Bun, whose bun.lock the scanner does not read, so there is no advisory count to report, and that is an absence of data, not a clean result.
• 27 workflows. Three were flagged for pull_request_target: two check out the base branch rather than the pull request, and review.yml actually runs on /review comments from owners and members. All 20 third-party actions are pinned to a commit. Security policy, licence and contributing guide present; no Dependabot or CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 686.6K, JSON 258.8K, Markdown 233.3K, CSS 43.2K, YAML 2,995, HTML 1,248.

Questions

Is OpenCode free?

Yes. OpenCode is MIT-licensed and free, and it works with keys or subscriptions you already have, or with local models. OpenCode Zen, the team's optional pay-as-you-go model gateway, bills per token and includes some free models. You never need it: bring-your-own-key works the same, and your only cost is the model you choose.

How does OpenCode compare with Claude Code?

They work the same way: a terminal agent that reads, edits and runs commands in your repository. Claude Code is closed source and uses Anthropic's models. OpenCode is open source and model-agnostic, so you can switch between Claude, GPT, Gemini and local models in one session, and it adds a desktop app and a read-only plan agent.

Does OpenCode upload my sessions?

Your code goes to the model provider you choose, as with any agent. Sessions stay local unless you run /share, which uploads the full conversation to OpenCode's servers and creates a public link. Sharing is manual by default, and setting "share": "disabled" in opencode.json turns it off, including for a whole team when committed to the repository.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.