opencode.jsonc

{
  // OpenCode shared team config — committed to git.
  // Secrets are NEVER stored here: every {env:VAR} placeholder is resolved
  // from the developer's local environment (loaded from .env via `bun run opencode`,
  // direnv, or a manually-sourced shell). See .env.example for required vars.
  //
  // Syntax notes (OpenCode-specific, different from Claude Code's .mcp.json):
  //   - Env var expansion uses {env:VAR_NAME}  (NOT ${VAR})
  //   - MCP root key is "mcp"                  (NOT "mcpServers")
  //   - MCP env field is "environment"         (NOT "env")
  //   - Missing env vars resolve to empty string (no hard failure) — see CLAUDE.md
  //     Critical Reminder about stopping immediately when MCP credentials fail.
  "$schema": "https://opencode.ai/config.json",

  // Plugins:
  //   - @warp-dot-dev/opencode-warp: Warp terminal integration — surfaces
  //     OpenCode agent activity as native Warp notifications. Auto-installed
  //     when OpenCode runs inside Warp.
  //     Docs: https://docs.warp.dev/agent-platform/cli-agents/opencode/
  //   - opencode-subagent-statusline: Cosmetic UX — shows the active subagent
  //     in the OpenCode status line so you can see which agent is running at
  //     a glance. Pure polish, no behavioral side effects.
  "plugin": ["@warp-dot-dev/opencode-warp", "opencode-subagent-statusline"],

  "mcp": {
    "context7": {
      "type": "local",
      "command": ["npx", "-y", "@upstash/context7-mcp"],
      "enabled": true
    },
    "tavily": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-remote",
        "https://mcp.tavily.com/mcp/?tavilyApiKey={env:TAVILY_API_KEY}"
      ],
      "enabled": true
    },
    "playwright": {
      "type": "local",
      "command": [
        "bunx",
        "@playwright/mcp@latest",
        "--caps",
        "vision,pdf,testing,tracing,tabs",
        "--timeout-action",
        "10000",
        "--timeout-navigation",
        "30000",
        "--viewport-size",
        "1920x1080"
      ],
      "enabled": true
    },
    "staging-dbhub": {
      "type": "local",
      "command": ["bunx", "-y", "@bytebase/dbhub@latest", "--config", "dbhub.toml"],
      "enabled": true
    },
    "staging-openapi": {
      "type": "local",
      "command": ["bunx", "-y", "@ivotoby/openapi-mcp-server", "--tools", "dynamic"],
      "enabled": true,
      "environment": {
        "API_BASE_URL": "{env:API_BASE_URL}",
        "OPENAPI_SPEC_PATH": "{env:OPENAPI_SPEC_PATH}"
      }
    },
    "local-openapi": {
      "type": "local",
      "command": ["bunx", "-y", "@ivotoby/openapi-mcp-server", "--tools", "dynamic"],
      "enabled": true,
      "environment": {
        "API_BASE_URL": "http://localhost:3000/api/v1",
        "OPENAPI_SPEC_PATH": "{env:OPENAPI_SPEC_PATH}"
      }
    },
    "postman": {
      "type": "remote",
      "url": "https://mcp.postman.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:POSTMAN_API_KEY}"
      }
    }
  },

  // Permissions — mirrors .claude/settings.json 1:1.
  // Rule precedence: last matching pattern wins, so deny entries are placed
  // AFTER the broad allows they override (e.g. `git *` allow, then
  // `git push --force *` deny — the deny wins for force-pushes).
  "permission": {
    "edit": "allow",
    "webfetch": "allow",
    "websearch": "allow",
    "bash": {
      "*": "ask",

      "bun *": "allow",
      "bunx *": "allow",
      "npm *": "allow",
      "npx *": "allow",
      "pnpm *": "allow",
      "yarn *": "allow",
      "node *": "allow",

      "git *": "allow",
      "gh *": "allow",

      "ls *": "allow",
      "cat *": "allow",
      "echo *": "allow",
      "tree *": "allow",
      "test *": "allow",
      "mkdir *": "allow",
      "touch *": "allow",
      "cp *": "allow",
      "mv *": "allow",
      "find *": "allow",
      "grep *": "allow",
      "rg *": "allow",
      "sed *": "allow",
      "awk *": "allow",
      "head *": "allow",
      "tail *": "allow",
      "wc *": "allow",
      "diff *": "allow",
      "jq *": "allow",
      "curl *": "allow",

      "playwright *": "allow",
      "allure *": "allow",
      "acli *": "allow",

      "rm -rf *": "deny",
      "wget *": "deny",
      "sudo rm *": "deny",
      "sudo *": "deny",
      "git push --force *": "deny",
      "git push -f *": "deny",
      "git reset --hard *": "deny",
      "git clean -fd *": "deny",
      "git branch -D *": "deny",
      "chmod 777 *": "deny",
      "truncate *": "deny",
      "shred *": "deny",
      "dd if=*": "deny",
      "mkfs*": "deny"
    }
  }
}