# OpenCode

> The open coding agent. With OpenRouter behind it, I can test any model on real work and switch in one command.

- Verdict: My default
- Vendor: Anomaly (formerly SST)
- Layer: [Build and test](https://cloudlesslabs.com/stack/layers/dev/index.md). Job: Coding agent for testing and switching models
- Last reviewed: 22 October 2026, by Nicolas Dao (Cloudless Labs, Sydney)
- Web page: https://cloudlesslabs.com/stack/opencode/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md

OpenCode is an open-source coding agent, in the terminal, on the desktop or headless, built by the team that came out of SST. It does what Claude Code does: reads the repository, plans, edits, runs the tests, uses MCP servers and skills, and follows the rules in AGENTS.md. The difference is that it doesn't belong to a model vendor. It works with more than 75 providers, and the model is a setting.

That's why I love it. Pair it with [OpenRouter](https://cloudlesslabs.com/stack/openrouter/index.md) and every model on the market is one `/models` away, on one key and one bill. When a client asks whether a cheaper model can do the job, I don't guess and I don't read benchmarks: I give the same task in the same repository to Claude, to OpenAI's models and to the best open models, and compare what comes back. Switching costs one command, so nothing locks me into a single provider. The [Anthropic API entry](https://cloudlesslabs.com/stack/anthropic-api/index.md) shows what those comparisons are worth in money.

It's also a serious agent in its own right. A Build agent and a read-only Plan agent you switch with Tab, subagents, custom agents with their own model each, MCP, custom commands and plugins, and a server with an SDK so you can script it. It can answer `/opencode` in a GitHub issue or pull request, and it runs local models through Ollama when the code can't leave the machine. It's MIT-licensed, has more than 200,000 stars on GitHub, and ships constantly.

The honest part: it moves fast, and that shows. Version 2 broke plugins and config, and its local server has had two serious security flaws in a year, both fixed. Keep it updated and lock down its permissions. And it isn't where I'd use Claude every day: Anthropic only allows its subscriptions in Claude Code, so Claude in OpenCode costs API prices. Claude Code stays my daily driver; OpenCode is where I test, compare and keep my options open.

## Use it when

- Testing which model is good enough for a job before you commit a client system to it: the same agent, the same repo, the same task, a different model.
- Avoiding lock-in to one model vendor: 75+ providers, including OpenRouter, local models (Ollama, LM Studio) and your existing ChatGPT or Copilot subscription.
- Cheap agentic coding on open models (DeepSeek, Kimi, GLM, Qwen) for work that doesn't need a frontier model.
- A coding agent you can run headless, script through its server and SDK, or trigger from a GitHub issue or pull request comment.

## Don't use it when

- You want Claude on a flat-rate subscription: Anthropic only allows Pro and Max plans in Claude Code. In OpenCode, Claude is billed per token through an API key.
- Your daily driver is one model and you want the agent tuned for it: Claude Code is tuned for Claude, and Codex for OpenAI's models.

## Pricing

Free and open source (MIT). You pay the model provider at its own price: OpenRouter, an OpenAI or Anthropic API key, or a ChatGPT or GitHub Copilot subscription. Optional: OpenCode Zen sells models at cost (plus a 4.6% + $0.31 card fee per top-up), and OpenCode Go is $10 or $40 a month for open models.

## In my words: what hurts

- Fast churn: releases several times a week, and v2 (September 2026) broke v1 plugins, renamed config keys and dropped language-server support.

## Gotchas, with fixes

- **Gotcha:** Out of the box, the agent may edit files and run shell commands without asking.
  **Fix:** Set edit and shell permissions to ask in the project's opencode.json, and commit it.
- **Gotcha:** Its local server has had two remote-code-execution flaws (CVE-2026-22812, and an origin bypass fixed in 1.18.22): a malicious web page could drive it.
  **Fix:** Stay on the latest version, keep the server bound to 127.0.0.1, and set OPENCODE_SERVER_PASSWORD when you run serve or web.
- **Gotcha:** Pay-per-token models plus an agent in a loop can burn money overnight.
  **Fix:** Give each OpenRouter key a credit limit that resets daily or weekly, one key per developer or experiment.
- **Gotcha:** /share publishes the session at a public link, and some free models may train on your code.
  **Fix:** Commit "share": "disabled" for client repositories, and set OPENCODE_DISABLE_FREE_MODELS=1.

## Instead, consider

- [Claude Code](https://cloudlesslabs.com/stack/claude-code/index.md): Your daily driver: Claude, on a subscription, in the agent built for it.
- [OpenAI Codex](https://cloudlesslabs.com/stack/openai-codex/index.md): OpenAI's models, on a ChatGPT plan, in OpenAI's own agent.
- [OpenRouter](https://cloudlesslabs.com/stack/openrouter/index.md): Behind OpenCode: one key, every model, so switching is one command.

## Worked examples

- [Which model, at what price](https://cloudlesslabs.com/stack/guides/which-model/index.md): Claude, GPT or an open model? Which is the cheapest model that's good enough, tier by tier?

## Where it fits

- [Building with AI agents](https://cloudlesslabs.com/stack/use-cases/ai-dev/index.md): pick 3. With OpenRouter behind it, tries any model on the same task, so no single vendor locks you in.

## Sources

- [OpenCode documentation](https://opencode.ai/docs/)
- [OpenCode: providers (OpenRouter, local models, subscriptions)](https://opencode.ai/docs/providers/)
- [OpenCode: permissions](https://opencode.ai/docs/permissions/)
- [OpenCode: server](https://opencode.ai/docs/server/)
- [OpenCode on GitHub](https://github.com/anomalyco/opencode)
- [Datadog Security Labs: OpenCode upgrade remote code execution](https://securitylabs.datadoghq.com/articles/opencode-upgrade-remote-code-execution/)

## Related

- [Build and test](https://cloudlesslabs.com/stack/layers/dev/index.md): every tool in this layer, with its verdict
- [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)