anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]: {cmd:} config placeholder for credential helpers #8841

New Issue
Open
opened 2026-02-16 18:10:59 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:10:59 -05:00
Owner
Copy Link
Copy Source

Originally created by @taulfsime on GitHub (Feb 8, 2026).

Originally assigned to: @thdxr on GitHub.

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Config placeholder for credential helpers

Problem Im soving

Currently, config files support {env:VAR} and {file:path} placeholders for injecting values. However, there's no way to securely fetch credentials from credential managers like macOS Keychain, 1Password,
pass, or custom credential helpers (like git credential helpers).

Users who want to configure MCP server authentication must either:
- Hardcode tokens in config files (insecure)
- Store tokens in environment variables (requires manual setup)
- Store tokens in plain text files (insecure)

Solution

A {cmd:command} placeholder that executes a shell command and uses its stdout (trimmed) as the value. This enables integration with any credential manager or helper that can output secrets to stdout.

Use Cases

 macOS Keychain:
 Authorization: Bearer {cmd:security find-generic-password -s mcp-token -w}

 1Password CLI:
 Authorization: Bearer {cmd:op read op://vault/mcp-api/token}

 pass (password-store):
 Authorization: Bearer {cmd:pass show api/token}

 Custom credential helper (git-style host:token format):
 Authorization: Bearer {cmd:grep '^api.example.com:' ~/.credentials | cut -d: -f2}

 Encrypted secrets:
 Authorization: Bearer {cmd:openssl enc -aes-256-cbc -d -a -pass pass:$KEY -pbkdf2 -in secret.enc}

Example

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "internal-api": {
      "type": "remote",
      "url": "https://api.internal.example.com/mcp",
      "headers": {
        "Authorization": "Bearer {cmd:security find-generic-password -s mcp-token -w}"
      }
    }
  }
}

I already have working implementation, if this is accepted I can open a PR.

Originally created by @taulfsime on GitHub (Feb 8, 2026). Originally assigned to: @thdxr on GitHub. ### Feature hasn't been suggested before. - [x] I have verified this feature I'm about to request hasn't been suggested before. ### Describe the enhancement you want to request # Config placeholder for credential helpers ### Problem Im soving Currently, config files support {env:VAR} and {file:path} placeholders for injecting values. However, there's no way to securely fetch credentials from credential managers like macOS Keychain, 1Password, pass, or custom credential helpers (like git credential helpers). Users who want to configure MCP server authentication must either: - Hardcode tokens in config files (insecure) - Store tokens in environment variables (requires manual setup) - Store tokens in plain text files (insecure) ### Solution A {cmd:command} placeholder that executes a shell command and uses its stdout (trimmed) as the value. This enables integration with any credential manager or helper that can output secrets to stdout. ### Use Cases macOS Keychain: Authorization: Bearer {cmd:security find-generic-password -s mcp-token -w} 1Password CLI: Authorization: Bearer {cmd:op read op://vault/mcp-api/token} pass (password-store): Authorization: Bearer {cmd:pass show api/token} Custom credential helper (git-style host:token format): Authorization: Bearer {cmd:grep '^api.example.com:' ~/.credentials | cut -d: -f2} Encrypted secrets: Authorization: Bearer {cmd:openssl enc -aes-256-cbc -d -a -pass pass:$KEY -pbkdf2 -in secret.enc} ### Example ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "internal-api": { "type": "remote", "url": "https://api.internal.example.com/mcp", "headers": { "Authorization": "Bearer {cmd:security find-generic-password -s mcp-token -w}" } } } } ``` I already have working implementation, if this is accepted I can open a PR.
yindo added the discussion label 2026-02-16 18:10:59 -05:00
yindo commented 2026-02-16 18:11:00 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 8, 2026):

This issue might be a duplicate of existing issues. Please check:

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Feb 8, 2026): This issue might be a duplicate of existing issues. Please check: - #2405: [feat(apikey): Allow apikeys loaded from commands](https://github.com/anomalyco/opencode/issues/2405) - Directly proposes loading API keys from command output, a predecessor to this feature - #4318: [Allow storage of secrets in system credential store](https://github.com/anomalyco/opencode/issues/4318) - Complimentary approach using system keyrings; the `{cmd:}` placeholder enables integration with CLI tools that keyrings alone don't cover - #1703: [store sensitive info in keychain](https://github.com/anomalyco/opencode/issues/1703) - Related keychain integration approach Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label discussion
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8841
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?