Among open-source coding agents, OpenCode sits near the very top by GitHub stars. It isn’t tied to one model vendor: you get its own harness plus whichever model you choose. Around October 2026 the team shipped a major rewrite, OpenCode 2.0, with a resident local service, Code Mode, a rebuilt plugin system and an embeddable SDK. The feature list looks great, but the migration notes and the security discussion deserve just as much attention. (Details checked on October 15, 2026.)
What OpenCode 2.0 is
OpenCode is an open-source coding agent. The repo is anomalyco/opencode, with about 214,000 stars at the time of writing, under the MIT license. The website is opencode.ai, and the 2.0 announcement is at anoma.ly/notes/opencode-2-0. GitHub already has v2.0.x tags (v2.0.29, for example); follow the official docs for the upgrade path.
Compared with 1.x, these are the changes you’ll notice most:
- The Service: a background service now runs automatically on your machine. The TUI, the web UI, the desktop app and your scripts all talk to that one process instead of each spinning up their own.
- Code Mode:
@opencode/codemodeturns MCP servers and OpenAPI specs into callable script functions. The model writes a short script that chains several tools in a single round trip, instead of calling them one at a time. In 2.0, MCP goes through Code Mode by default, so in theory you can attach lots of servers without blowing up the context window. - Background tasks: background sub-agents and async shells. When something is taking a while, a hotkey sends it to the background so you can keep chatting.
- Plugins: the team says it built a large share of 2.0 (80-plus features, per the announcement) as internal plugins, which forces the Plugin API to eat its own dog food. TUI plugins are now stable and support hot reload.
- SDK and client:
@opencode/sdkcan be used as a library, and@opencode/clientconnects to the local service so you can write scheduled jobs and custom scripts.
The official upgrade advice: get onto the latest 1.x first, then run opencode upgrade --major. For the desktop app, just download the new installer.
Know what breaks before you migrate
The migration guide is blunt. The intentional breaking changes fall into three groups:
- 1.0 plugins don’t run on 2.0; they need to be ported to the new API.
- The server API and client contract were rewritten from scratch, so existing integrations have to change.
- Terminal config moves from layered
tui.jsonfiles to a globalcli.json(part of it migrates automatically on first launch).
Most other config (agents, MCP, skills, the .opencode/ folder and so on) is meant to keep loading as before, and you can even ask OpenCode in plain English to rewrite it into native 2.0 form. Details are in Migrate from V1.
If your company relies on /etc/opencode, managed preferences or other high-priority policies, verify the precedence yourself: what overrides what, and whether your policies still win over project-level config.
About the security regression discussion
Right after 2.0 landed, a Hacker News thread raised a security regression in config loading precedence (titled roughly Major security regression merged into OpenCode V2; see thread 50075319). The concern was that enterprise policies could be overridden by lower-priority or external config, undermining the whole idea of central control.
Later in that discussion, commenters said the change had been reverted or fixed through a pull request (reported as #55267), and the original poster said that at least the team was listening. That doesn’t mean 2.0 has no security debt left. It means you should check the latest changelog and PRs before upgrading, not just the feature list, and if you depend on system-level policies to lock down models and permissions, test in an isolated environment before rolling it out to everyone.
What I like
- A huge user base and ecosystem, with relatively complete docs, plugins and migration guides.
- One local service shared by many clients suits people who run things in the terminal, watch in the browser and call from scripts.
- Code Mode is a genuine fix for the “too many MCP servers, tool descriptions ate my context” problem.
- MIT-licensed, self-hostable, and you can wrap it into your own harness.
- Background sub-agents and async shells match how today’s models like to orchestrate work.
What’s missing
- The migration is real work: plugins must be rewritten and API integrations must change. This is not a painless one-click upgrade.
- The surface area keeps growing (service, plugins, SDK, desktop app), and some people feel it’s turning into an IDE rather than a lightweight harness. That’s a matter of taste, but it shows up as a steeper learning curve.
- Configuration is complex (mixed V1 and V2 fields, policies, providers), so troubleshooting takes patience.
- On issues like security and policy precedence, enterprise users have to do their own acceptance testing. “Popular open-source project” doesn’t mean its defaults fit your security posture.
Related reading
- Magpie: Switch Models for Claude Code and Codex from Your Menu Bar
- Coucou: An AI Coding Agent Companion That Lives in Your Mac’s Notch
Who it’s for
- Existing OpenCode 1.x users willing to spend half a day validating before upgrading.
- Teams that want one local service serving the TUI, the web UI and scripts.
- Anyone who wants Code Mode to turn a pile of MCP servers into a programmable tool surface.
If you only use Claude Code or Cursor occasionally, there’s no need to switch. If you want a vendor-neutral open-source harness, 2.0 is worth it, but read the migration guide before you start cutting.
Links
- Repo: https://github.com/anomalyco/opencode
- 2.0 announcement: https://anoma.ly/notes/opencode-2-0/
- Migration guide: https://opencode.ai/v2/docs/migrate-v1
- Website: https://opencode.ai
