I
io.github.jayden99236/consult-opencode
opencode-ai
Delegate a self-contained task to opencode's free-tier models as a one-shot subagent.
No known CVEs
MIT license
Actively maintained
Last commit 24d ago
Works with most clients
Transport: stdio, http
5 tools · ~231 tok
Grade A · 0.1% of 200K ctx
MCPpedia last refreshed this data
io.github.jayden99236/consult-opencode is an MCP server that delegate a self-contained task to opencode's free-tier models as a one-shot subagent. Its tool list has not been published yet over stdio and http, requires no API key, and scores 90/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients - only the file and path differ.
CD
Supported in Claude Desktopstdio, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"consult-opencode": {
"args": [
"/absolute/path/to/consult-opencode/mcp-server.mjs"
],
"command": "node"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-jayden99236-consult-opencode)
Read me
What io.github.jayden99236/consult-opencode does
Delegate a self-contained task to opencode's free-tier models as a one-shot subagent.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y 'opencode-ai' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories - click any category to see the underlying evidence.
Score breakdown
90/100across 5 weighted dimensions
0255075100
30
15
20
15
10
−10
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev2 fixed
CVE-2026-22813critical · fixed
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
### Summary A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on `http://localhost:4096`. From there, it is possible to run arbitrary commands on the local system using the `/pty/` endpoints provided by the OpenCode API. ### Code execution via OpenCode API - The OpenCode API has `/pty/` endpoints that allow spawning arbitrary processes on the local machine. - When you run `opencode` in your terminal, OpenCode automatically star
CVE-2026-22812high · fixedCVSS 8.8
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
*Previously reported via email to support@sst.dev on 2025-11-17 per the security policy in [opencode-sdk-js/SECURITY.md](https://github.com/sst/opencode-sdk-js/blob/main/SECURITY.md). No response received.* ### Summary OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary shell commands with the user's privileges. ### Details When OpenCode starts, it spawns an HTTP server (default port 4096+) with no
Inventory
Tools (5)
Click any tool to inspect its schema.
~231 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.jayden99236/consult-opencode safe to use?
- io.github.jayden99236/consult-opencode has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
- How do I install io.github.jayden99236/consult-opencode?
- io.github.jayden99236/consult-opencode supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can io.github.jayden99236/consult-opencode do?
- io.github.jayden99236/consult-opencode provides 5 tools: PATH, Demo, Why, Requirements, Options. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with io.github.jayden99236/consult-opencode?
- io.github.jayden99236/consult-opencode is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
- Is io.github.jayden99236/consult-opencode actively maintained?
- io.github.jayden99236/consult-opencode is actively maintained - last commit was 24 days ago.
Related
Similar servers
Others in other
I
io.github.vshulcz/deja-vu95deja-vu: local memory over the session histories of thirty-five coding agents.
1.1k 6
Reolink CLI95Official command-line tool for Reolink IP cameras, doorbells and NVRs — LAN only, no cloud. Snapshots, PTZ, RTSP/RTMP stream URLs, two-way audio (talkback/TTS), motion and AI detection, event monitoring, VOD download. JSON output and a built-in MCP server. Works with Home Assistant, Frigate and go2rtc.
105 6
Headroom95Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
74.1k 3
P
Pubmed MCP Server94Search PubMed/Europe PMC, fetch articles and full text (PMC/EPMC/Unpaywall), citations, MeSH terms.
152 9
MCP Security Weekly
Get CVE alerts and security updates for io.github.jayden99236/consult-opencode and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.