ismkdc/opencode-security

{"i":1,"repo":"ismkdc/opencode-security","stars":5,"lang":"Python","ok":true,"char_count":1650,"text":"opencode-security is a plugin for OpenCode that scans your code for security problems. It looks through your codebase, finds potential vulnerabilities, and can even produce patch files to fix them, all without leaving your OpenCode session.\n\nThe plugin offers two main scan types. You can scan your entire codebase or focus on a specific area, or you can scan just the changes in a branch, pull request, or individual commit. Scan effort comes in four levels: low, medium, high, and max. Low is a quick check with a single researcher plus verification. Medium, the default, runs a full pipeline including inventory, threat modeling, research, and a verification sweep. High widens the scope and uses two researchers per area. Max adds an adversarial red-team phase on top of everything in high. Every effort level uses the same three-voter verification panel, so confidence stays consistent.\n\nA key feature is that every finding gets challenged by an independent verification panel before it appears in your report. When patches are needed, they are developed in isolated scratch workspaces and independently reviewed before delivery. This two-step checking aims to reduce false positives and catch mistakes.\n\nSetting it up involves adding the plugin to your opencode.json configuration file and copying some agent definitions from the provided example file. You need OpenCode version 1.14 or newer, Python 3.9 or later on your system path, and Git if you want to use change scanning or patch generation. Codebase scans work without Git.\n\nTo run a scan, you start OpenCode in your project and ask it to run the opencode-security skill. A menu appears where you pick a scan type and effort level. The scan runs asynchronously, meaning you can keep working while it proceeds. Results land in a timestamped folder in your repository. You get a human-readable report in Markdown, a machine-readable JSONL file for CI integration, and a revision stamp recording what was scanned and at what effort level. This project is a port of Anthropic's Claude Security plugin, adapted for OpenCode. The core pipeline is complete and functional.","error":null}