OpenCode

Coding agent (CLI) · Anomaly (formerly SST) · 5/7 verified · Last checked 2026-10-16

Per-tool allow, ask and deny rules with glob patterns on commands, paths and URLs. Defaults are permissive: most tools run without asking. No built-in sandbox is documented.

Overall: C (1.60 avg, 5/7 controls verified)

Lock this down first

Set "*": "ask" in the permission config and add deny rules for destructive bash commands.

Scorecard

Criterion	Rating	Notes
Permission granularity	3/3	Rules per tool, matched against commands, file paths or URLs. Last matching rule wins.
Human approval gates	1/3	ask rules prompt before running, but the defaults are permissive: most permissions default to allow, and --auto approves anything not explicitly denied.
Sandboxing	Unverified	Not confirmed in the docs we checked.
Secrets handling	1/3	API keys added with /connect live in ~/.local/share/opencode/auth.json. .env files are denied to the read tool by default.
Audit logs	Unverified	Not confirmed in the docs we checked.
Kill switch / interrupt	2/3	Escape is bound to session_interrupt by default.
Network egress control	1/3	webfetch rules can allow or ask per URL pattern. Shell commands are not network-restricted.

Unverified: Sandboxing, Audit logs. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.