opencode-security/opencode.example.json at main · ismkdc/opencode-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
// Merge this into your opencode.json (or opencode.jsonc) to register
// the opencode-security plugin's 7 agents. The prompt paths are
// relative to the plugin root inside node_modules.
// Install with: "opencode-security@git+https://github.com/ismkdc/opencode-security.git"
{
  "agent": {
    "opencode-security": {
      "description": "Multi-agent security scanning for OpenCode: scan codebase, scan changes, suggest patches.",
      "mode": "primary",
      "prompt": "{file:.opencode/prompts/opencode-security.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "write": "allow",
        "edit": "allow",
        "bash": "allow",
        "task": "allow",
        "question": "allow",
        "todowrite": "allow"
      }
    },
    "scan-inventory": {
      "description": "Read-only cartographer that partitions a repository into components for security review.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/scan-inventory.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "bash": "allow",
        "write": "deny",
        "edit": "deny",
        "question": "deny"
      }
    },
    "scan-researcher": {
      "description": "Read-only vulnerability researcher that finds real vulnerabilities in one component.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/scan-researcher.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "bash": "allow",
        "write": "deny",
        "edit": "deny",
        "task": "allow",
        "question": "deny"
      }
    },
    "scan-verifier": {
      "description": "Read-only verifier that tries to disprove one candidate finding.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/scan-verifier.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "bash": "allow",
        "write": "deny",
        "edit": "deny",
        "task": "allow",
        "question": "deny"
      }
    },
    "patch-generator": {
      "description": "Implements one security fix in a scratch workspace.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/patch-generator.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "write": "allow",
        "edit": "allow",
        "bash": "allow",
        "task": "allow",
        "question": "deny"
      }
    },
    "patch-verifier": {
      "description": "Reviews one implemented fix: verifies targeting, safety, and behavior preservation.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/patch-verifier.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "bash": "allow",
        "write": "deny",
        "edit": "deny",
        "task": "allow",
        "question": "deny"
      }
    },
    "explore": {
      "description": "Read-only code explorer for mapping codebases.",
      "mode": "subagent",
      "hidden": true,
      "prompt": "{file:.opencode/prompts/explore.md}",
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "bash": "allow",
        "write": "deny",
        "edit": "deny",
        "question": "deny"
      }
    }
  }
}