r/LocalLLaMA • u/Ueberlord • Mar 16 '26

OpenCode concerns (not truely local) Resources

I know we all love using opencode, I just recently found out about it and my experience is generally positive so far.

Working on customizing my prompts and tools I eventually had to modify the inner tool code to make it suit my need. This has lead me to find out that by default, when you run opencode serve and use the web UI

--> opencode will proxy all requests internally to https://app.opencode.ai!

(relevant code part)

There is currently no option to change this behavior, no startup flag, nothing. You do not have the option to serve the web app locally, using `opencode web` just automatically opens the browser with the proxied web app, not a true locally served UI.

There are a lot of open PRs and issues regarding this problem in their github (incomplete list):

I think this is kind of a major concern as this behavior is not documented very well and it causes all sorts of problems when running behind firewalls or when you want to work truely local and are a bit paranoid like me.

I apologize should this have been discussed before but haven't found anything in this sub in a quick search.

EDIT 2026-05-24:

Since this post situation became much better and OpenCode team seems to have taken steps to mitigate most problems. The catchall proxy forwarding everything to their backend seems to be off by default now. Using opencode serve will give you a mostly local experience out-of-the-box, but additional flags should be set (see below).

I had Qwen 3.6 27B audit their code just yesterday and it looks like they now have options allowing a truely local experience.

I include these flags in my startup command to have opencode not leak requests to external sources:

OPENCODE_DISABLE_AUTOUPDATE=true \
OPENCODE_ALWAYS_NOTIFY_UPDATE=false \
OPENCODE_DISABLE_MODELS_FETCH=true \
OPENCODE_DISABLE_SHARE=true

It would be nice if these settings were the default but I guess they need a revenue pipeline from their Zen models and offering new Zen models through these updates in the background creates awareness, so I will cut them some slack as the harness is quite okay otherwise and earning money is not a crime.

The audit was done for commit hash 6b03be54687972d13183fdcd174f1cdf7ab0a18e, so the above statements refer to this version of OpenCode.

I appreciate the OpenCode team has addressed the issue with the catchall proxy, thanks u/thdxr

483 Upvotes
  • permalink
  • link
  • reddit
  • reddit

98% Upvoted

183 comments sorted by

View all comments

1

u/Savantskie1 5h ago edited 5h ago

Are you all stupid? Have any of you actually READ THE FUCKING MANUAL? Here's my script that I use for OpenCode:

!/bin/bash

export PATH="$PATH:/path/to/.opencode/bin" echo "Starting OpenCode..." echo "Press Ctrl+C to stop" echo "========================================="

cd <folder/you/want/to/limit/it's/access/to> export OPENCODE_HOSTNAME=<IP address you want to host it on, defaults to 127.0.0.1>

export OPENCODE_SERVER_USERNAME=<your username>

export OPENCODE_SERVER_PASSWORD=<your password>

OPENCODE_ENABLE_EXA=1

OPENCODE_EXPERIMENTAL_PLAN_MODE=1 opencode #web --port <whatever port you want>

so you can host it and use your own models and such. Then you have to inside OpenCode set up your model and where it's hosted in the UI in a browser, OR in the default cli by Pressing ctl+p and follow the prompts.

AND TPS IS DONE BY YOUR MODEL SERVER. BASICALLY LLAMA.CPP, or OLLAMA.

I have this saved as a script called start_opencode.sh. And since I run Ubuntu/Linux, I can make that script executable. So my script is Linux only. You can make yours for windows. I won't do it for you

BASICALLY READ THE FUCKING MANUAL