Developers are divided between migrating to third-party harnesses like Pi for their customizability and control, versus staying with native tools like Claude Code due to concerns about stability, security, and vendor restrictions. The strongest disagreement centers on whether the flexibility of open-source harnesses outweighs the operational risks of manual configuration and potential Terms of Service violations.
493 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4anomalyco
opencode
TypeScript2025–2026
anomalyco / opencode
opencode
The open source coding agent.
129Distinct people
156Mentions
1Explicit recommenders
226.4KGitHub stars
What to know before exploring
What it is
The open source coding agent.
GitHub
Where it is used
- browser-use / browsercode (project tracking OpenCode upstream) — The browser-use/browsercode repo explicitly declares anomalyco/opencode as its upstream and documents a sync runbook; it records repeated merges and SHA ranges showing regular mechanical pulls from anomalyco/opencode into the browsercode fork. Source
What people are saying
> The recent Kimi-K2 supposedly works great. My own experience is that it is below sonnet and opus 4.0 on capability - but better than gemini 2.5 pro on tool calling. It's…
nikcub used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
Critical Commenters criticize the project for a lack of developer responsiveness to issues and cite specific security regressions in version 2. Another comment mentions legal requests associated with the repository.
A warning from this week’s discussion. Read the supporting reply
Also in these discussions
- earendil-works/pi · linked in 8 of the same discussions
- opencode-ai/opencode · linked in 4 of the same discussions
- charmbracelet/crush · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Critical
Commenters criticize the project for a lack of developer responsiveness to issues and cite specific security regressions in version 2. Another comment mentions legal requests associated with the repository.
Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · 3 discussions summarized
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 7:02:50 PM UTC.
The conversation debates the viability of LLMs in coding, contrasting arguments that they boost productivity with concerns about non-deterministic reliability and skill atrophy. Critics question the universal success claims of top programmers using AI, while others highlight the inherent unpredictability of LLM outputs as a fundamental flaw.
243 readable replies · Supporting reply 1 · Supporting reply 2Read the discussion on HN. A full-thread summary is not available yet.
Showing the three threads with the most distinct people linking this repo, from 6 threads this week.
Mentions over time
HN mentions by month156 dated mentions
Observed mentions: 2025-05-14 19:57:58 UTC to 2026-10-25 06:50:10 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| May 2025 | 2025-05-01 00:00:00 UTC | 2025-06-01 00:00:00 UTC | 1 | 1 | 0 |
| Jun 2025 | 2025-06-01 00:00:00 UTC | 2025-07-01 00:00:00 UTC | 3 | 3 | 0 |
| Jul 2025 | 2025-07-01 00:00:00 UTC | 2025-08-01 00:00:00 UTC | 15 | 2 | 13 |
| Aug 2025 | 2025-08-01 00:00:00 UTC | 2025-09-01 00:00:00 UTC | 8 | 0 | 8 |
| Sep 2025 | 2025-09-01 00:00:00 UTC | 2025-10-01 00:00:00 UTC | 1 | 0 | 1 |
| Oct 2025 | 2025-10-01 00:00:00 UTC | 2025-11-01 00:00:00 UTC | 2 | 1 | 1 |
| Nov 2025 | 2025-11-01 00:00:00 UTC | 2025-12-01 00:00:00 UTC | 6 | 0 | 6 |
| Dec 2025 | 2025-12-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| Jan 2026 | 2026-01-01 00:00:00 UTC | 2026-02-01 00:00:00 UTC | 21 | 3 | 18 |
| Feb 2026 | 2026-02-01 00:00:00 UTC | 2026-03-01 00:00:00 UTC | 6 | 2 | 4 |
| Mar 2026 | 2026-03-01 00:00:00 UTC | 2026-04-01 00:00:00 UTC | 25 | 3 | 22 |
| Apr 2026 | 2026-04-01 00:00:00 UTC | 2026-05-01 00:00:00 UTC | 4 | 0 | 4 |
| May 2026 | 2026-05-01 00:00:00 UTC | 2026-06-01 00:00:00 UTC | 5 | 1 | 4 |
| Jun 2026 | 2026-06-01 00:00:00 UTC | 2026-07-01 00:00:00 UTC | 4 | 0 | 4 |
| Jul 2026 | 2026-07-01 00:00:00 UTC | 2026-08-01 00:00:00 UTC | 11 | 1 | 10 |
| Aug 2026 | 2026-08-01 00:00:00 UTC | 2026-09-01 00:00:00 UTC | 13 | 3 | 10 |
| Sep 2026 | 2026-09-01 00:00:00 UTC | 2026-10-01 00:00:00 UTC | 3 | 1 | 2 |
| Oct 2026 | 2026-10-01 00:00:00 UTC | 2026-11-01 00:00:00 UTC | 26 | 1 | 25 |
What Hacker News says
26 sourcesVEverdverm·Oct 25, 2026
harness have a say in security too, sandboxes are one part of posture, but not the only one
You can decide for yourself: https://github.com/earendil-works/pi/issues/10895
Anthropic, OpenAi, and OpenCode all support this feature, we have non-developers to support and MDM is widely used.
For comparison, this excellent reply from Aiden on the OpenCode team: https://github.com/anomalyco/opencode/pull/54921#issuecommen...
In Five Qwen3.8-27B models match Fable 5 Using GVS5H Harness"secure implementation" is vague, for example, here is an OpenCode issue (links to related PRs/follow ups) that I worked with their team through to improve security.
Our hunch is that the Ai told them this was ok to do, but it broke invariants users relied on. Perhaps it was not "hackable" in the sense I think you are getting at, but it did open a very big security hole through choices and design. The critical thinking was lacking (imo).
https://github.com/anomalyco/opencode/pull/51337
The bots make mistakes all the time, even through multiple rounds of reviews. Thus I have zero faith that they will produce secure code reliably 100% of the time. More Ai does not magically fix this, they go down the wrong path and double down, or work around incorrect assumptions.
This is a good talk by a member of the Linux security team: https://www.yout
Read the rest
ube.com/watch?v=NnV_cWeoo5Q
Also worth noting that OpenCode Console was hacked days after the configuration regression and two PRs to change it back. Notable because it shows a pattern.
https://news.ycombinator.com/item?id=50133401
I submitted one of those originally and do think that incident is relevant. Not related, but it does qualify as a red flag generally for the company and their attention to their system designs with respect to security.
Our read on the situation is too much eyes and brain free coding, that they assumed the ai redesign of the configuration system was sound. It took a couple of PRs and explanations for them to bring the system to a better place, such that MDM config was respected at the highest priority.
I do give the OpenCode team a lot of credit, at least Aiden, for the handling of this case.
https://github.com/anomalyco/opencode/pull/51337#issuecommen...
I'm now trying to get the Pi harness to support MDM, but it is not going well... see this and please consider sharing your perspectives or support there
https://github.com/earendil-works/
Read the rest
the ux is kind of crazy.
you login to their website, and you are presented with a list of providers where you can click and add your provider api key.
how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.
from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.
someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.
https://github.com/anomalyco/opencode/issues/10416#issuecomm...
In OpenCode Hacked: User credentials leakedI told you so: https://news.ycombinator.com/item?id=49243119
Me, 68 days ago:
> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.
> https://github.com/anomalyco/opencode/issues/10416
In OpenCode Hacked: User credentials leakedFrom "What about data and privacy?" in FAQ it sounds like they don't host models themselves. e.g. it says:
DeepSeek: ZDR agreement is renewed monthly. The current agreement is valid through October 31, 2026.
https://opencode.ai/go
They also follow official DeepSeek API peak/off peak hour pricing and link to their docs:
DeepSeek V4.1 Flash / V4 Pro: Peak hours are 01:00-04:00 and 06:00-10:00 UTC, Monday through Friday; all other hours, including weekends, are Off-Peak. Learn more.
https://opencode.ai/v2/docs/console/go/#usage-limits
edit: they used to explicitly name the providers, at least in the past DeepSeek V4 was served with official API https://github.com/anomalyco/opencode/issues/24649#issuecomm...
In DeepSeek-v4.1-Flash-1017I have faith in we the people, not the oligarchy.
Why are the researchers at the same level in China not freaking out? They have concerns and regulations, but they are not losing their minds about it? What is their perspective?
Here are a couple of videos from regular folks on the other side
- https://www.youtube.com/watch?v=NnV_cWeoo5Q (linux security)
- https://www.youtube.com/watch?v=x3J2w7-9XC8 (chem/bio)
There is work to be done, but it's not so close or so bad you need to let them give you anxiety. 10% is an arbitrary number with no foundation or walkthrough to how it happens. That boy wants his 15m of fame.
If you would like to help my effort improving things, please read and/or comment on this Pi issue. I'm trying to get all the harnesses to have better security posture against loss of control.
https://github.com/earendil-works/pi
Read the rest
/issues/10895
Here is my successful persuasion with OpenCode (spans a few issues/pull requests) https://github.com/anomalyco/opencode/pull/51337
What we should not be doing is letting the big labs dictate the what and how for a technology that is (1) built on all human knowledge (2) impacts us all every day. We should all have a say in this and that will require chilling out, starting from provable facts, and having a rational debate.
For Codex there is no need to decompile because unlike Claude Code, Codex is open source [1] and written in Rust.
There are lot of other amazing open source agent harnesses like OpenCode [2] and Pi [3].
[1] https://github.com/openai/codex
[2] https://github.com/anomalyco/opencode
[3] https://github.com/earendil-works/pi
In Ask HN: Has anyone decompiled Claude Code yet?I recently worked through a security regression with the OpenCode team
https://github.com/anomalyco/opencode/pull/51337
The Pi dev who's handling my request there is just not getting it.
https://github.com/earendil-works/pi/issues/10895
In "We're not going to make rules that say you can't use tools for X"Thanks for the great recommendation. In the meantime, if anyone wants to contribute to GUI plugin support for OpenCode, here is a PR under review: https://github.com/anomalyco/opencode/pull/55246
In OpenCode 2.01. Running background code on my machine is something that gets an immediate removal from me.
2. opencode 2.0 does not exists. I mean it: there is no release[1] and per their own instructions, `npm i -g @opencode/cli@latest` does not install opencode 2.0.
3. `Error: @opencode/cli's postinstall script was not run.` Not even running postinstall.js can fix that, neither on linux nor macos. And even if it works, in a couple of days or on the next upgrade it will fail again.
[1] https://github.com/anomalyco/opencode/releases
In OpenCode 2.0They might have fixed it in the meantime though
Edit: indeed https://github.com/anomalyco/opencode/commit/d099d2cb2a0869d... / https://github.com/anomalyco/opencode/pull/55586
In OpenCode 2.0I've been using OpenCode V2 since it first appeared on the website, and I can only repeat the positive views on usability, the client/server model and self-awareness/ability to edit it's config and write plugins.
I'd like to mention two other impressive things about OpenCode.
First, their issue tracker on GitHub works really well. They have the OpenCode GitHub App connected, and for any bug report it reads the issue, tests on the mentioned version and latest dev branch, and comments the findings along with a reproduction script. For TUI Bugs it even records a video. And all that in less than two minutes, usually.
https://github.com/anomalyco/opencode/issues?q=is%3Aissue+st...
Another thing they are working on is opentunnel, where you can tunnel services to https on <random>.opentunnel.xyz and its subdomains. What's notable is that the sub
Read the rest
domain is persistent and unique to you, and a wildcard ssl cert is actually generated on your machine, so the platform cannot see the traffic. Their primary use case seems to be making the OpenCode Server usable from anywhere, but it can do much more with their cli:
https://opentunnel.xyz/
I too have been able to get several issues addressed and pull requests merged (not mine, others had noticed first).
I had one this week that, while took some effort to explain the why, was handled better than I expected. (https://github.com/anomalyco/opencode/pull/54921)
Being the most popular open harness, they get inundated with slop and are doing their best (imo).
In OpenCode 2.0I think it's due to they are doing a funny business to parse the progress, that's pretty much vibed and no one care. Like instead of using curl's progress, they re-invented a progress tracking with the tracing interface (--trace-ascii), byte by byte :(
https://github.com/anomalyco/opencode/issues/22998
https://github.com/anomalyco/opencode/issues/53702
In OpenCode 2.0Showing the 15 most recent of 26 sources. Enable JavaScript to search and browse every indexed mention.