anomalyco/opencodecli-tool

Audited from a 0k-token evidence dossier; 2 files read, 11 probes answered.

OpenCode is a terminal-first AI coding agent — CLI/TUI core with build and plan agent modes, plus desktop, web, and console surfaces bolted on around it ^[24]. It has scaled fast: 188k stars, daily commits, and roughly monthly-plus release cadence ^[25].

The tension is between how the project ships and how it's reviewed: velocity and install polish are excellent, but the code the dossier could actually read stopped at a test fixture — every real core file exceeded the read budget ^[30] — and the parts that were measured (CVEs, review rate) look thinner than the star count suggests.

The main knocks:

• The dependency tree carries unresolved critical and high-severity CVEs. The lockfile scan turns up 2 critical and 46 high-severity CVEs ^[17], and the community profile's file list shows no SECURITY.md ^[25] — nothing in the dossier suggests these are engaged or triaged.
• PRs merge with almost no review. Only 5% of sampled merged PRs had at least one review despite a 45% external-author merge share ^[25], which means a large share of outside contributions land without a second set of eyes — a real risk on a codebase already carrying secrets findings [static digest].
• The evidence base for internal code quality is thin. The most complex, highest-churn files — provider/transform.ts and provider/provider.ts — were both cut for size ^[30], so the maturity read leans on hotspot metrics and test-reality signal rather than the code itself.
• Issue and PR timing metrics look automation-driven, not human. First response is 100% bot on the issue sample and median PR merge time is 0 days ^[25], so the near-zero triage latency likely reflects bots rather than maintainer attention, and the dossier can't distinguish the two.

What holds up:

• Install is genuinely frictionless across every platform. README covers npm/bun/pnpm/yarn, brew, scoop, choco, pacman, nix, and mise, plus explicit install-directory override precedence ^[24], and a beta desktop app ships alongside the CLI with its own package-manager installers.
• The test infrastructure is unusually rigorous for a project this size. The one complete file the dossier could read in full is a deterministic e2e fixture harness for timeline stability, and a companion benchmark spec measures cold/hot session-switch latency with CDP throttling ^[28]; the graph-central utility effect.ts is referenced by 337 test files ^[16].
• The dependency footprint stays lean despite the product's scope. Only 6 direct dependencies sit behind a committed lockfile ^[11], and CI runs 26 workflows including a deploy pipeline that pins third-party actions by commit SHA ^[26] — disciplined supply-chain hygiene even where the CVE scan is not.
• Adoption and shipping cadence are hard to argue with. 188k stars, a commit yesterday, and 100 releases in the last 24 months with 100% release-note coverage ^[25] point to a maintained, actively used project rather than a stalled one.

A fast-moving, widely adopted AI coding agent whose install polish outpaces its visible supply-chain and review discipline.

Compare against other terminal-first AI coding agents on install breadth, CVE hygiene, and PR review rate before adopting at scale.