anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

feat: Add Permission Control for MCP Tools #1803

New Issue
Closed
opened 2026-02-16 17:32:41 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 17:32:41 -05:00
Owner
Copy Link
Copy Source

Originally created by @thuanpham582002 on GitHub (Sep 23, 2025).

Originally assigned to: @rekram1-node on GitHub.

Summary: MCP tools currently bypass OpenCode's permission system while built-in tools require approval.
Add permission control for MCP tools.

Problem

Currently, MCP (Model Context Protocol) tools completely bypass OpenCode's permission system:
Built-in tools (have permission checks):

await Permission.ask({
  type: "bash",
  pattern: patterns,
  sessionID: ctx.sessionID,
   ... approval flow
})

MCP tools (bypass permission system):

In packages/opencode/src/session/prompt.ts

for (const [key, item] of Object.entries(await MCP.tools())) {
  item.execute = async (args, opts) => {
     NO Permission.ask() here!
    await Plugin.trigger("tool.execute.before", ...)
    const result = await execute(args, opts)
    await Plugin.trigger("tool.execute.after", ...)
    return { output }
  }
}

Security Concerns

• No user control: MCP tools can execute without approval
• Inconsistent security: Built-in tools require approval, MCP tools don't
• Potential abuse: Malicious MCP servers could perform harmful actionsl

Originally created by @thuanpham582002 on GitHub (Sep 23, 2025). Originally assigned to: @rekram1-node on GitHub. **Summary**: MCP tools currently bypass OpenCode's permission system while built-in tools require approval. Add permission control for MCP tools. ## Problem Currently, MCP (Model Context Protocol) tools completely bypass OpenCode's permission system: **Built-in tools** (have permission checks): ```typescript await Permission.ask({ type: "bash", pattern: patterns, sessionID: ctx.sessionID, ... approval flow }) ``` **MCP tools** (bypass permission system): In packages/opencode/src/session/prompt.ts ``` typescript for (const [key, item] of Object.entries(await MCP.tools())) { item.execute = async (args, opts) => { NO Permission.ask() here! await Plugin.trigger("tool.execute.before", ...) const result = await execute(args, opts) await Plugin.trigger("tool.execute.after", ...) return { output } } } ``` ## Security Concerns • No user control: MCP tools can execute without approval • Inconsistent security: Built-in tools require approval, MCP tools don't • Potential abuse: Malicious MCP servers could perform harmful actionsl
yindo closed this issue 2026-02-16 17:32:41 -05:00
yindo commented 2026-02-16 17:32:41 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 23, 2025):

totally agree

@rekram1-node commented on GitHub (Sep 23, 2025): totally agree
yindo commented 2026-02-16 17:32:41 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 23, 2025):

this will be done as part of: #1961

@rekram1-node commented on GitHub (Sep 23, 2025): this will be done as part of: #1961
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1803
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?