Skip to content

README.md

Latest commit

 

History

History
77 lines (49 loc) · 2.94 KB

README.md

File metadata and controls

77 lines (49 loc) · 2.94 KB
Raw

opencode-security

Multi-agent security scanning for OpenCode. Scans your codebase, detects vulnerabilities, and produces verified patch files - all inside your OpenCode session.

Features

  • Scan codebase - Full repository or scoped area vulnerability scanning with configurable effort levels
  • Scan changes - Targeted scanning of branch diffs, pull requests, or individual commits
  • Suggest patches - Verified, targeted patch files for confirmed findings, reviewed by independent agents

Every finding is challenged by a verification panel before it reaches the report. Patches are developed in isolated scratch workspaces and independently verified before delivery.

Installation

Add the plugin to your opencode.json:

{
  "plugin": ["opencode-security@git+https://github.com/ismkdc/opencode-security.git"]
}

Then add the agent definitions from opencode.example.json into your opencode.json's "agent" block. Restart OpenCode.

Quick Start

Open a terminal in your project and start OpenCode. Then ask:

"run opencode-security skill"

The skill loads automatically and presents the job menu. Choose a scan type and effort level, and the scan runs asynchronously while you continue working.

Scan Output

Results are written to OPENSEC-<timestamp>/ in your repository:

File Description
OPENSEC-RESULTS.md Human-readable report with findings, impact, severity, and recommendations
OPENSEC-RESULTS.jsonl Machine-readable findings for CI integration
OPENSEC-REVISION-<sha>.json Revision stamp recording what was scanned, at what effort, and verification status

Effort Levels

Level Description
low Fast triage with single researcher + verification panel
medium Full pipeline: inventory, threat model, research, sweep, panel (default)
high Wider inventory, dual researchers per cell, double sweep
max All of high, plus adversarial red-team phase

All effort levels use the same three-voter verification panel. Confidence is calibrated consistently across tiers.

Requirements

  • OpenCode 1.14+
  • Python 3.9+ on PATH
  • Git (required for change scanning and patch generation; codebase scans work without it)

How It Works

  1. Scope selection - The plugin sizes your repository and offers targeted or full scan options
  2. Multi-agent pipeline - Inventory, threat modeling, research, and verification phases run as coordinated subagents
  3. Independent verification - Every finding is challenged by a panel of verifiers before reporting
  4. Patch generation - Confirmed findings can be fixed in isolated scratch workspaces with independent review

Project Status

This is a port of Anthropic's Claude Security plugin for Claude Code, adapted for OpenCode. The core scanning and patching pipeline is complete and functional.

Security

See SECURITY.md for the trust model and vulnerability reporting guidelines.

License

MIT