{"query":"OpenCode GitHub repository opencode cli env placeholder configuration docs", "stream": false}

{"type":"output_text","text":{"value":"Here's a detailed summary and reference for **OpenCode CLI environment placeholder configuration** (including usage, source files, and security considerations) according to its official docs and community references:\n\n---\n\n## Configuration Overview\n\nOpenCode supports configuration via JSON (or JSONC) files, with the following environment-related features:\n\n### 1. Configuration Location & Precedence\n- OpenCode merges configs from several locations, **with later sources overriding earlier ones for conflicting keys**. The order is:\n  1. **Remote config** (`.well-known/opencode`)\n  2. **Global config** (`~/.config/opencode/opencode.json`)\n  3. **Custom config** (path set via the `OPENCODE_CONFIG` env var)\n  4. **Project config** (`opencode.json` in repo or `.opencode`)\n  5. **Inline config** (`OPENCODE_CONFIG_CONTENT` env var, for runtime overrides)\n  6. **Managed config files** (for system-level/MDM management on macOS)\n\n  > **Note**: Project configs override global defaults, global can override organizational defaults, and managed settings are highest priority【3:0†source】【3:3†source】.\n\n### 2. Environment Variables\n\n#### a. **Setting the Config Directory**\n- `OPENCODE_CONFIG_DIR`: Points to a custom config directory. All expected config files (agents, commands, etc.) are searched here.\n\n#### b. **Inline Config**\n- `OPENCODE_CONFIG_CONTENT`: Use this env var to supply an entire config as a string at runtime (highest precedence except for managed configs)【3:0†source】.\n\n#### c. **API Keys & Providers**\n- API keys for LLM providers (e.g., OpenAI, Anthropic, etc.) are often set using env vars to avoid secrets in plain config files.\n\n  Example in workflow:\n  ```yaml\n  env:\n    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n  ```\n\n#### d. **Shell Selection**\n- OpenCode uses the shell specified in the `SHELL` environment variable for its shell commands, defaulting to `/bin/bash` if not set.\n- You can override this in the JSON config using:\n  ```json\n  {\n    \"bash\": {\n      \"shell\": \"/bin/zsh\"\n    }\n  }\n  ```\n  Or set `SHELL` env before running OpenCode【3:5†source】.\n\n#### e. **MCP Local Server Security**\n- If your project defines `\"mcp\"` in config and uses `\"type\": \"local\"`, it can specify `command` and `environment` keys:\n  ```json\n  {\n    \"mcp\": {\n      \"my-server\": {\n        \"type\": \"local\",\n        \"command\": [\"python3\", \"script.py\"],\n        \"environment\": {\n          \"MY_VAR\": \"value\"\n        }\n      }\n    }\n  }\n  ```\n- **Danger**: Running OpenCode in an untrusted repo can result in arbitrary code execution via the `command` field! Always audit `opencode.json` in open source repos before running【3:9†source】.\n\n### 3. Placeholders for .env/Secrets\n\n- **Workflow (e.g., GitHub Actions)**: Placeholders like `${{ secrets.ANTHROPIC_API_KEY }}` are replaced by the CI environment at runtime (see [GitHub Actions doc](https://docs.github.com/en/actions/security-guides/encrypted-secrets)).\n- In local/server environments, set the environment variable (e.g., `export ANTHROPIC_API_KEY=...`) before running OpenCode or use a `.env` loader such as `direnv`, `dotenv`, etc.\n\n---\n\n## Example: Project GitHub Workflow Setup\n\nA sample workflow for GitHub integration (with secrets as environment placeholders):\n\n```yaml\nname: opencode\non:\n  issue_comment:\n    types: [created]\n  pull_request_review_comment:\n    types: [created]\njobs:\n  opencode:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v6\n      - name: Run OpenCode\n        uses: anomalyco/opencode/github@latest\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        with:\n          model: anthropic/claude-sonnet-4-20250514\n```\nStore your API keys (like `ANTHROPIC_API_KEY`) in the repo or org's GitHub **secrets**【3:6†source】.\n\n---\n\n## References & Docs\n\n- [OpenCode official config reference](https://opencode.ai/docs/config)【3:0†source】\n- [GitHub Actions/CI integration](https://github.com/anomalyco/opencode/blob/dev/.github/workflows/opencode.yml)【3:6†source】\n- [Security warning on local `command` config](https://dev.to/jsantilli/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-4afi)【3:9†source】\n- [GitHub example config repo](https://github.com/joelhooks/opencode-config)【3:8†source】\n- [OpenCode CLI cheat sheet and env vars](https://computingforgeeks.com/opencode-cli-cheat-sheet-commands/)【3:4†source】\n\n---\nLet me know if you want a template, a minimal config, or specific examples for local or cloud environments!","annotations":[{"text":"","start_index":1074,"end_index":1086,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":1086,"end_index":1098,"url_citation":{"title":"Installation and Configuration | opencode-ai/opencode | DeepWiki","url":"https://deepwiki.com/opencode-ai/opencode/1.1-installation-and-configuration"}},{"text":"","start_index":1474,"end_index":1486,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":2082,"end_index":2094,"url_citation":{"title":"opencode command - github.com/opencode-ai/opencode - Go Packages","url":"https://pkg.go.dev/github.com/opencode-ai/opencode"}},{"text":"","start_index":2641,"end_index":2653,"url_citation":{"title":"The repository that runs code: A story about MCP Configuration in OpenCode","url":"https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"}},{"text":"","start_index":3830,"end_index":3842,"url_citation":{"title":"GitHub | OpenCode","url":"https://opencode.ai/docs/github/"}},{"text":"","start_index":3943,"end_index":3955,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":4068,"end_index":4080,"url_citation":{"title":"GitHub | OpenCode","url":"https://opencode.ai/docs/github/"}},{"text":"","start_index":4232,"end_index":4244,"url_citation":{"title":"The repository that runs code: A story about MCP Configuration in OpenCode","url":"https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"}},{"text":"","start_index":4321,"end_index":4333,"url_citation":{"title":"GitHub - joelhooks/opencode-config: Personal OpenCode configuration ...","url":"https://github.com/joelhooks/opencode-config"}},{"text":"","start_index":4441,"end_index":4453,"url_citation":{"title":"OpenCode CLI Cheat Sheet - Commands Reference | ComputingForGeeks","url":"https://computingforgeeks.com/opencode-cli-cheat-sheet/"}}]},"bing_searches":[{"text":"OpenCode GitHub repository opencode cli env placeholder configuration documentation","url":"https://www.bing.com/search?q=OpenCode+GitHub+repository+opencode+cli+env+placeholder+configuration+documentation"}],"annotations":null}

{"type":"output_text","text":{"value":"Here's a detailed summary and reference for **OpenCode CLI environment placeholder configuration** (including usage, source files, and security considerations) according to its official docs and community references:\n\n---\n\n## Configuration Overview\n\nOpenCode supports configuration via JSON (or JSONC) files, with the following environment-related features:\n\n### 1. Configuration Location & Precedence\n- OpenCode merges configs from several locations, **with later sources overriding earlier ones for conflicting keys**. The order is:\n  1. **Remote config** (`.well-known/opencode`)\n  2. **Global config** (`~/.config/opencode/opencode.json`)\n  3. **Custom config** (path set via the `OPENCODE_CONFIG` env var)\n  4. **Project config** (`opencode.json` in repo or `.opencode`)\n  5. **Inline config** (`OPENCODE_CONFIG_CONTENT` env var, for runtime overrides)\n  6. **Managed config files** (for system-level/MDM management on macOS)\n\n  > **Note**: Project configs override global defaults, global can override organizational defaults, and managed settings are highest priority【3:0†source】【3:3†source】.\n\n### 2. Environment Variables\n\n#### a. **Setting the Config Directory**\n- `OPENCODE_CONFIG_DIR`: Points to a custom config directory. All expected config files (agents, commands, etc.) are searched here.\n\n#### b. **Inline Config**\n- `OPENCODE_CONFIG_CONTENT`: Use this env var to supply an entire config as a string at runtime (highest precedence except for managed configs)【3:0†source】.\n\n#### c. **API Keys & Providers**\n- API keys for LLM providers (e.g., OpenAI, Anthropic, etc.) are often set using env vars to avoid secrets in plain config files.\n\n  Example in workflow:\n  ```yaml\n  env:\n    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n  ```\n\n#### d. **Shell Selection**\n- OpenCode uses the shell specified in the `SHELL` environment variable for its shell commands, defaulting to `/bin/bash` if not set.\n- You can override this in the JSON config using:\n  ```json\n  {\n    \"bash\": {\n      \"shell\": \"/bin/zsh\"\n    }\n  }\n  ```\n  Or set `SHELL` env before running OpenCode【3:5†source】.\n\n#### e. **MCP Local Server Security**\n- If your project defines `\"mcp\"` in config and uses `\"type\": \"local\"`, it can specify `command` and `environment` keys:\n  ```json\n  {\n    \"mcp\": {\n      \"my-server\": {\n        \"type\": \"local\",\n        \"command\": [\"python3\", \"script.py\"],\n        \"environment\": {\n          \"MY_VAR\": \"value\"\n        }\n      }\n    }\n  }\n  ```\n- **Danger**: Running OpenCode in an untrusted repo can result in arbitrary code execution via the `command` field! Always audit `opencode.json` in open source repos before running【3:9†source】.\n\n### 3. Placeholders for .env/Secrets\n\n- **Workflow (e.g., GitHub Actions)**: Placeholders like `${{ secrets.ANTHROPIC_API_KEY }}` are replaced by the CI environment at runtime (see [GitHub Actions doc](https://docs.github.com/en/actions/security-guides/encrypted-secrets)).\n- In local/server environments, set the environment variable (e.g., `export ANTHROPIC_API_KEY=...`) before running OpenCode or use a `.env` loader such as `direnv`, `dotenv`, etc.\n\n---\n\n## Example: Project GitHub Workflow Setup\n\nA sample workflow for GitHub integration (with secrets as environment placeholders):\n\n```yaml\nname: opencode\non:\n  issue_comment:\n    types: [created]\n  pull_request_review_comment:\n    types: [created]\njobs:\n  opencode:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v6\n      - name: Run OpenCode\n        uses: anomalyco/opencode/github@latest\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        with:\n          model: anthropic/claude-sonnet-4-20250514\n```\nStore your API keys (like `ANTHROPIC_API_KEY`) in the repo or org's GitHub **secrets**【3:6†source】.\n\n---\n\n## References & Docs\n\n- [OpenCode official config reference](https://opencode.ai/docs/config)【3:0†source】\n- [GitHub Actions/CI integration](https://github.com/anomalyco/opencode/blob/dev/.github/workflows/opencode.yml)【3:6†source】\n- [Security warning on local `command` config](https://dev.to/jsantilli/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-4afi)【3:9†source】\n- [GitHub example config repo](https://github.com/joelhooks/opencode-config)【3:8†source】\n- [OpenCode CLI cheat sheet and env vars](https://computingforgeeks.com/opencode-cli-cheat-sheet-commands/)【3:4†source】\n\n---\nLet me know if you want a template, a minimal config, or specific examples for local or cloud environments!","annotations":[{"text":"","start_index":1074,"end_index":1086,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":1086,"end_index":1098,"url_citation":{"title":"Installation and Configuration | opencode-ai/opencode | DeepWiki","url":"https://deepwiki.com/opencode-ai/opencode/1.1-installation-and-configuration"}},{"text":"","start_index":1474,"end_index":1486,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":2082,"end_index":2094,"url_citation":{"title":"opencode command - github.com/opencode-ai/opencode - Go Packages","url":"https://pkg.go.dev/github.com/opencode-ai/opencode"}},{"text":"","start_index":2641,"end_index":2653,"url_citation":{"title":"The repository that runs code: A story about MCP Configuration in OpenCode","url":"https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"}},{"text":"","start_index":3830,"end_index":3842,"url_citation":{"title":"GitHub | OpenCode","url":"https://opencode.ai/docs/github/"}},{"text":"","start_index":3943,"end_index":3955,"url_citation":{"title":"Config | OpenCode","url":"https://opencode.ai/docs/config/"}},{"text":"","start_index":4068,"end_index":4080,"url_citation":{"title":"GitHub | OpenCode","url":"https://opencode.ai/docs/github/"}},{"text":"","start_index":4232,"end_index":4244,"url_citation":{"title":"The repository that runs code: A story about MCP Configuration in OpenCode","url":"https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"}},{"text":"","start_index":4321,"end_index":4333,"url_citation":{"title":"GitHub - joelhooks/opencode-config: Personal OpenCode configuration ...","url":"https://github.com/joelhooks/opencode-config"}},{"text":"","start_index":4441,"end_index":4453,"url_citation":{"title":"OpenCode CLI Cheat Sheet - Commands Reference | ComputingForGeeks","url":"https://computingforgeeks.com/opencode-cli-cheat-sheet/"}}]},"bing_searches":[{"text":"OpenCode GitHub repository opencode cli env placeholder configuration documentation","url":"https://www.bing.com/search?q=OpenCode+GitHub+repository+opencode+cli+env+placeholder+configuration+documentation"}],"annotations":null}

{
  "type": "output_text",
  "text": {
    "value": "Here's a detailed summary and reference for **OpenCode CLI environment placeholder configuration** (including usage, source files, and security considerations) according to its official docs and community references:\n\n---\n\n## Configuration Overview\n\nOpenCode supports configuration via JSON (or JSONC) files, with the following environment-related features:\n\n### 1. Configuration Location \u0026 Precedence\n- OpenCode merges configs from several locations, **with later sources overriding earlier ones for conflicting keys**. The order is:\n  1. **Remote config** (`.well-known/opencode`)\n  2. **Global config** (`~/.config/opencode/opencode.json`)\n  3. **Custom config** (path set via the `OPENCODE_CONFIG` env var)\n  4. **Project config** (`opencode.json` in repo or `.opencode`)\n  5. **Inline config** (`OPENCODE_CONFIG_CONTENT` env var, for runtime overrides)\n  6. **Managed config files** (for system-level/MDM management on macOS)\n\n  \u003e **Note**: Project configs override global defaults, global can override organizational defaults, and managed settings are highest priority【3:0†source】【3:3†source】.\n\n### 2. Environment Variables\n\n#### a. **Setting the Config Directory**\n- `OPENCODE_CONFIG_DIR`: Points to a custom config directory. All expected config files (agents, commands, etc.) are searched here.\n\n#### b. **Inline Config**\n- `OPENCODE_CONFIG_CONTENT`: Use this env var to supply an entire config as a string at runtime (highest precedence except for managed configs)【3:0†source】.\n\n#### c. **API Keys \u0026 Providers**\n- API keys for LLM providers (e.g., OpenAI, Anthropic, etc.) are often set using env vars to avoid secrets in plain config files.\n\n  Example in workflow:\n  ```yaml\n  env:\n    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n  ```\n\n#### d. **Shell Selection**\n- OpenCode uses the shell specified in the `SHELL` environment variable for its shell commands, defaulting to `/bin/bash` if not set.\n- You can override this in the JSON config using:\n  ```json\n  {\n    \"bash\": {\n      \"shell\": \"/bin/zsh\"\n    }\n  }\n  ```\n  Or set `SHELL` env before running OpenCode【3:5†source】.\n\n#### e. **MCP Local Server Security**\n- If your project defines `\"mcp\"` in config and uses `\"type\": \"local\"`, it can specify `command` and `environment` keys:\n  ```json\n  {\n    \"mcp\": {\n      \"my-server\": {\n        \"type\": \"local\",\n        \"command\": [\"python3\", \"script.py\"],\n        \"environment\": {\n          \"MY_VAR\": \"value\"\n        }\n      }\n    }\n  }\n  ```\n- **Danger**: Running OpenCode in an untrusted repo can result in arbitrary code execution via the `command` field! Always audit `opencode.json` in open source repos before running【3:9†source】.\n\n### 3. Placeholders for .env/Secrets\n\n- **Workflow (e.g., GitHub Actions)**: Placeholders like `${{ secrets.ANTHROPIC_API_KEY }}` are replaced by the CI environment at runtime (see [GitHub Actions doc](https://docs.github.com/en/actions/security-guides/encrypted-secrets)).\n- In local/server environments, set the environment variable (e.g., `export ANTHROPIC_API_KEY=...`) before running OpenCode or use a `.env` loader such as `direnv`, `dotenv`, etc.\n\n---\n\n## Example: Project GitHub Workflow Setup\n\nA sample workflow for GitHub integration (with secrets as environment placeholders):\n\n```yaml\nname: opencode\non:\n  issue_comment:\n    types: [created]\n  pull_request_review_comment:\n    types: [created]\njobs:\n  opencode:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v6\n      - name: Run OpenCode\n        uses: anomalyco/opencode/github@latest\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        with:\n          model: anthropic/claude-sonnet-4-20250514\n```\nStore your API keys (like `ANTHROPIC_API_KEY`) in the repo or org's GitHub **secrets**【3:6†source】.\n\n---\n\n## References \u0026 Docs\n\n- [OpenCode official config reference](https://opencode.ai/docs/config)【3:0†source】\n- [GitHub Actions/CI integration](https://github.com/anomalyco/opencode/blob/dev/.github/workflows/opencode.yml)【3:6†source】\n- [Security warning on local `command` config](https://dev.to/jsantilli/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-4afi)【3:9†source】\n- [GitHub example config repo](https://github.com/joelhooks/opencode-config)【3:8†source】\n- [OpenCode CLI cheat sheet and env vars](https://computingforgeeks.com/opencode-cli-cheat-sheet-commands/)【3:4†source】\n\n---\nLet me know if you want a template, a minimal config, or specific examples for local or cloud environments!",
    "annotations": [
      {
        "text": "",
        "start_index": 1074,
        "end_index": 1086,
        "url_citation": {
          "title": "Config | OpenCode",
          "url": "https://opencode.ai/docs/config/"
        }
      },
      {
        "text": "",
        "start_index": 1086,
        "end_index": 1098,
        "url_citation": {
          "title": "Installation and Configuration | opencode-ai/opencode | DeepWiki",
          "url": "https://deepwiki.com/opencode-ai/opencode/1.1-installation-and-configuration"
        }
      },
      {
        "text": "",
        "start_index": 1474,
        "end_index": 1486,
        "url_citation": {
          "title": "Config | OpenCode",
          "url": "https://opencode.ai/docs/config/"
        }
      },
      {
        "text": "",
        "start_index": 2082,
        "end_index": 2094,
        "url_citation": {
          "title": "opencode command - github.com/opencode-ai/opencode - Go Packages",
          "url": "https://pkg.go.dev/github.com/opencode-ai/opencode"
        }
      },
      {
        "text": "",
        "start_index": 2641,
        "end_index": 2653,
        "url_citation": {
          "title": "The repository that runs code: A story about MCP Configuration in OpenCode",
          "url": "https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"
        }
      },
      {
        "text": "",
        "start_index": 3830,
        "end_index": 3842,
        "url_citation": {
          "title": "GitHub | OpenCode",
          "url": "https://opencode.ai/docs/github/"
        }
      },
      {
        "text": "",
        "start_index": 3943,
        "end_index": 3955,
        "url_citation": {
          "title": "Config | OpenCode",
          "url": "https://opencode.ai/docs/config/"
        }
      },
      {
        "text": "",
        "start_index": 4068,
        "end_index": 4080,
        "url_citation": {
          "title": "GitHub | OpenCode",
          "url": "https://opencode.ai/docs/github/"
        }
      },
      {
        "text": "",
        "start_index": 4232,
        "end_index": 4244,
        "url_citation": {
          "title": "The repository that runs code: A story about MCP Configuration in OpenCode",
          "url": "https://dev.to/pachilo/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-ljp"
        }
      },
      {
        "text": "",
        "start_index": 4321,
        "end_index": 4333,
        "url_citation": {
          "title": "GitHub - joelhooks/opencode-config: Personal OpenCode configuration ...",
          "url": "https://github.com/joelhooks/opencode-config"
        }
      },
      {
        "text": "",
        "start_index": 4441,
        "end_index": 4453,
        "url_citation": {
          "title": "OpenCode CLI Cheat Sheet - Commands Reference | ComputingForGeeks",
          "url": "https://computingforgeeks.com/opencode-cli-cheat-sheet/"
        }
      }
    ]
  },
  "bing_searches": [
    {
      "text": "OpenCode GitHub repository opencode cli env placeholder configuration documentation",
      "url": "https://www.bing.com/search?q=OpenCode+GitHub+repository+opencode+cli+env+placeholder+configuration+documentation"
    }
  ],
  "annotations": null
}


Here's a detailed summary and reference for **OpenCode CLI environment placeholder configuration** (including usage, source files, and security considerations) according to its official docs and community references:

---

## Configuration Overview

OpenCode supports configuration via JSON (or JSONC) files, with the following environment-related features:

### 1. Configuration Location & Precedence
- OpenCode merges configs from several locations, **with later sources overriding earlier ones for conflicting keys**. The order is:
  1. **Remote config** (`.well-known/opencode`)
  2. **Global config** (`~/.config/opencode/opencode.json`)
  3. **Custom config** (path set via the `OPENCODE_CONFIG` env var)
  4. **Project config** (`opencode.json` in repo or `.opencode`)
  5. **Inline config** (`OPENCODE_CONFIG_CONTENT` env var, for runtime overrides)
  6. **Managed config files** (for system-level/MDM management on macOS)

  > **Note**: Project configs override global defaults, global can override organizational defaults, and managed settings are highest priority【3:0†source】【3:3†source】.

### 2. Environment Variables

#### a. **Setting the Config Directory**
- `OPENCODE_CONFIG_DIR`: Points to a custom config directory. All expected config files (agents, commands, etc.) are searched here.

#### b. **Inline Config**
- `OPENCODE_CONFIG_CONTENT`: Use this env var to supply an entire config as a string at runtime (highest precedence except for managed configs)【3:0†source】.

#### c. **API Keys & Providers**
- API keys for LLM providers (e.g., OpenAI, Anthropic, etc.) are often set using env vars to avoid secrets in plain config files.

  Example in workflow:
  ```yaml
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  ```

#### d. **Shell Selection**
- OpenCode uses the shell specified in the `SHELL` environment variable for its shell commands, defaulting to `/bin/bash` if not set.
- You can override this in the JSON config using:
  ```json
  {
    "bash": {
      "shell": "/bin/zsh"
    }
  }
  ```
  Or set `SHELL` env before running OpenCode【3:5†source】.

#### e. **MCP Local Server Security**
- If your project defines `"mcp"` in config and uses `"type": "local"`, it can specify `command` and `environment` keys:
  ```json
  {
    "mcp": {
      "my-server": {
        "type": "local",
        "command": ["python3", "script.py"],
        "environment": {
          "MY_VAR": "value"
        }
      }
    }
  }
  ```
- **Danger**: Running OpenCode in an untrusted repo can result in arbitrary code execution via the `command` field! Always audit `opencode.json` in open source repos before running【3:9†source】.

### 3. Placeholders for .env/Secrets

- **Workflow (e.g., GitHub Actions)**: Placeholders like `${{ secrets.ANTHROPIC_API_KEY }}` are replaced by the CI environment at runtime (see [GitHub Actions doc](https://docs.github.com/en/actions/security-guides/encrypted-secrets)).
- In local/server environments, set the environment variable (e.g., `export ANTHROPIC_API_KEY=...`) before running OpenCode or use a `.env` loader such as `direnv`, `dotenv`, etc.

---

## Example: Project GitHub Workflow Setup

A sample workflow for GitHub integration (with secrets as environment placeholders):

```yaml
name: opencode
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
jobs:
  opencode:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Run OpenCode
        uses: anomalyco/opencode/github@latest
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        with:
          model: anthropic/claude-sonnet-4-20250514
```
Store your API keys (like `ANTHROPIC_API_KEY`) in the repo or org's GitHub **secrets**【3:6†source】.

---

## References & Docs

- [OpenCode official config reference](https://opencode.ai/docs/config)【3:0†source】
- [GitHub Actions/CI integration](https://github.com/anomalyco/opencode/blob/dev/.github/workflows/opencode.yml)【3:6†source】
- [Security warning on local `command` config](https://dev.to/jsantilli/the-repository-that-runs-code-a-story-about-mcp-configuration-in-opencode-4afi)【3:9†source】
- [GitHub example config repo](https://github.com/joelhooks/opencode-config)【3:8†source】
- [OpenCode CLI cheat sheet and env vars](https://computingforgeeks.com/opencode-cli-cheat-sheet-commands/)【3:4†source】

---
Let me know if you want a template, a minimal config, or specific examples for local or cloud environments!

Config | OpenCode

Installation and Configuration | opencode-ai/opencode | DeepWiki

Config | OpenCode

opencode command - github.com/opencode-ai/opencode - Go Packages

The repository that runs code: A story about MCP Configuration in OpenCode

GitHub | OpenCode

Config | OpenCode

GitHub | OpenCode

GitHub - joelhooks/opencode-config: Personal OpenCode configuration ...

OpenCode CLI Cheat Sheet - Commands Reference | ComputingForGeeks

OpenCode GitHub repository opencode cli env placeholder configuration documentation

Config | OpenCode

Config | OpenCode

GitHub | OpenCode

Config | OpenCode

GitHub | OpenCode