Multi-agent security scanning for OpenCode. Scans your codebase, detects vulnerabilities, and produces verified patch files - all inside your OpenCode session.
- Scan codebase - Full repository or scoped area vulnerability scanning with configurable effort levels
- Scan changes - Targeted scanning of branch diffs, pull requests, or individual commits
- Suggest patches - Verified, targeted patch files for confirmed findings, reviewed by independent agents
Every finding is challenged by a verification panel before it reaches the report. Patches are developed in isolated scratch workspaces and independently verified before delivery.
Add the plugin to your opencode.json:
{
"plugin": ["opencode-security@git+https://github.com/ismkdc/opencode-security.git"]
}Then add the agent definitions from opencode.example.json into your opencode.json's "agent" block. Restart OpenCode.
Open a terminal in your project and start OpenCode. Then ask:
"run opencode-security skill"
The skill loads automatically and presents the job menu. Choose a scan type and effort level, and the scan runs asynchronously while you continue working.
Results are written to OPENSEC-<timestamp>/ in your repository:
| File | Description |
|---|---|
OPENSEC-RESULTS.md |
Human-readable report with findings, impact, severity, and recommendations |
OPENSEC-RESULTS.jsonl |
Machine-readable findings for CI integration |
OPENSEC-REVISION-<sha>.json |
Revision stamp recording what was scanned, at what effort, and verification status |
| Level | Description |
|---|---|
low |
Fast triage with single researcher + verification panel |
medium |
Full pipeline: inventory, threat model, research, sweep, panel (default) |
high |
Wider inventory, dual researchers per cell, double sweep |
max |
All of high, plus adversarial red-team phase |
All effort levels use the same three-voter verification panel. Confidence is calibrated consistently across tiers.
- OpenCode 1.14+
- Python 3.9+ on
PATH - Git (required for change scanning and patch generation; codebase scans work without it)
- Scope selection - The plugin sizes your repository and offers targeted or full scan options
- Multi-agent pipeline - Inventory, threat modeling, research, and verification phases run as coordinated subagents
- Independent verification - Every finding is challenged by a panel of verifiers before reporting
- Patch generation - Confirmed findings can be fixed in isolated scratch workspaces with independent review
This is a port of Anthropic's Claude Security plugin for Claude Code, adapted for OpenCode. The core scanning and patching pipeline is complete and functional.
See SECURITY.md for the trust model and vulnerability reporting guidelines.
MIT