GILD verdict
Choose OpenCode when your team needs one open-source agent across several model providers and a platform owner will set its permissions and pin its version before rollout.
- The workflow
- An engineering team mixing Anthropic, OpenAI, Google, and open or local models, with agents run from terminals, editors, and its own scripts against a local OpenCode server.5711
- The decisive evidence
- DocumentedOpenCode connects 75+ providers through Models.dev, local models, and GitHub Copilot or ChatGPT Plus and Pro sign-in. Anthropic prohibits using Claude Pro or Max in it, and OpenCode removed its bundled plugins for that in 1.3.0.17
- DocumentedOpenCode 2, released October 12, 2026, runs one background server that the terminal, web, and desktop clients share, with an OpenAPI endpoint and a client package for scripts.511
- DocumentedEvery OpenCode 2 agent starts from a policy that allows every action except .env reads, and paths outside the project proceed without a prompt. In OpenCode 2 the background server always requires a password and binds 127.0.0.1; on 1.x the web server is unsecured unless OPENCODE_SERVER_PASSWORD is set.1012
- DocumentedIn January 2026 OpenCode published CVE-2026-22812, an unauthenticated server that ran commands, and CVE-2026-22813, a web UI flaw. It later disclosed a cross-site upgrade flaw in September and, on October 17, a breach affecting 1.4% of Console users.19202122
- GILD analysisOpenCode beats Claude Code and Codex for a team that will not tie its agent to one model vendor. It loses to both for a team that wants safe defaults without writing policy. Enterprise central config is the control that makes the multi-vendor case governable.
- The tradeoff
- You get model freedom and a scriptable server at no license cost. In return you write the permission policy and isolate agents yourself, on a release line that moved from version 1 to 2 in October 2026.3610
- What would change the call
- The call changes if your engineers will use Claude almost exclusively on Claude subscriptions, which OpenCode may not use. It also changes if you cannot staff a policy owner. An agent with a sandbox on by default carries more of the risk for you in that case.7
OpenCode
AI Coding Agent by Anomaly
+27 PositiveFit and limits
Who it fits
- Engineers use models from more than one vendor, or open and local models, and you want one agent and one set of rules across them.
- You want to drive the agent from your own scripts or pipelines. opencode serve exposes an OpenAPI endpoint, and OpenCode 2 ships a client package that finds the local server.
- You can route all traffic through an internal AI gateway. Enterprise central config ties sign-in to your SSO and can disable every other provider.
- You want the source open for audit under the MIT license, in a repository with about 222,600 GitHub stars on Oct 28, 2026.
Where it falls short
- Defaults trust the agent. OpenCode 2 allows every action except .env reads, and OpenCode 1 allowed most actions too, so a deny-first policy is your job.
- There is no built-in sandbox. Isolation means a container, a virtual machine, or a tool such as bubblewrap that you run around it.
- Security response has lagged. The advisory for the unauthenticated server notes a first report by email in November 2025 that drew no response, and a September 2026 advisory covered a cross-site upgrade path.
- Claude Pro and Max plans are off the table, because Anthropic prohibits their use in OpenCode, so Claude means API, Bedrock, or Vertex billing.
Implementation reality
Pick the version and pin it
OpenCode 1 and OpenCode 2 share the opencode command and cannot be installed side by side under it, and Homebrew's default formula and the Arch package now install version 2. Choose one, pin it in your install path, and test upgrades before they reach engineers.
Lock providers and data paths
Enterprise central config can restrict traffic to your internal AI gateway and disable other providers. Without it, set small_model to an approved model so title generation stays on your provider, and disable share pages as OpenCode recommends. Decide whether any Go or free model, each with its own retention terms, is allowed.
Write a deny-first permission policy
Rules resolve to allow, ask, or deny per tool and pattern, with the last match winning. Start from ask or deny for edit, bash, and external directories, then allow known-safe commands. Keep --auto mode for isolated environments, since it approves every request that is not explicitly denied.
Secure the server
Every client talks to an HTTP server. On OpenCode 2 set a fixed password with OPENCODE_PASSWORD, or OPENCODE_SERVER_PASSWORD on 1.x, before binding beyond 127.0.0.1, avoid mDNS discovery on shared networks, and keep OpenCode at or above the patched releases named in its advisories.
What to verify before you buy
- Which version you deploy, and how you will stop package managers from moving engineers from version 1 to 2.
- That central config or small_model keeps every request, titles included, on your approved provider.
- That your permission policy denies edits and commands outside the project and that no one runs --auto on a machine with production credentials.
- That no engineer stores provider keys in OpenCode Console unless you accept that exposure.
What to measure in your pilot
- How far Enterprise central config reaches the desktop app, the web client, and the GitHub integration as well as the terminal.
- How often OpenCode 2 point releases change permission or config behavior that a pinned policy depends on.
- What OpenCode stores for Console accounts after the October 2026 breach, and how keys saved there are protected.
Sources
- Official documentation
- 22
- OpenCode
- OpenCode: Download
- OpenCode docs: Intro (OpenCode 1)
- OpenCode 2 docs: Intro
- Anomaly: OpenCode 2.0 (Oct 12, 2026)
- OpenCode changelog
- OpenCode docs: Providers
- OpenCode docs: Config
- OpenCode docs: Permissions (OpenCode 1)
- OpenCode 2 docs: Permissions
- OpenCode docs: Server
- OpenCode docs: Web
- OpenCode docs: GitHub
- OpenCode Enterprise
- OpenCode docs: Enterprise
- OpenCode Go
- OpenCode Zen
- OpenCode on GitHub (anomalyco/opencode)
- OpenCode security advisory GHSA-vxw4-wv6m-9hhh, CVE-2026-22812 (Jan 12, 2026)
- OpenCode security advisory GHSA-c83v-7274-4vgp, CVE-2026-22813 (Jan 12, 2026)
- OpenCode security advisory GHSA-632h-h47v-g4x4 (Sep 24, 2026)
- OpenCode on X: security breach notice (Oct 17, 2026)