anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Document all outbound network connections #8873

New Issue
Open
opened 2026-02-16 18:11:04 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 18:11:04 -05:00
Owner
Copy Link
Copy Source

Originally created by @tredondo on GitHub (Feb 8, 2026).

Originally assigned to: @jayair on GitHub.

Hi OpenCode team 👋

I’d like to request clearer documentation of all outbound network connections that OpenCode may initiate, including their purpose, timing, and whether they are optional or configurable.

This request was sparked by an unexpected outbound connection attempt to gitst.github.com:

Image

This is probably (hopefully) harmess, but from a user perspective, any undocumented network activity raises legitimate questions around security and privacy.

Concretely, it would be very helpful to document:

  • All external hosts/domains OpenCode may connect to
  • When and why each connection occurs (startup, runtime, background tasks, updates, telemetry, etc.)
  • What data categories are involved (e.g., metadata vs. user code/config)
  • Whether connections can be disabled, redirected, or run in a fully offline mode
  • Differences by platform or build (e.g. Desktop vs. TUI)

As you're probably well aware, this is important for:

  • Trust: Users are more comfortable adopting tools when network behavior is explicit and predictable. Undocumented network connections undermine user confidence in the application.
  • Privacy: Users want to understand what data is being transmitted and for what purpose
  • Compliance & enterprise use: Many environments require allowlisting, documentation, or prior review of all egress traffic.
  • Network security: Organizations with strict network policies require documentation to properly configure firewalls and security controls. Developers often run tools in restricted, monitored, or air-gapped environments.

This is just a request for transparency and documentation so users can make informed decisions and configure their environments appropriately.

If there’s already partial documentation on this, I’d be happy to be pointed to it. Otherwise, I think a short “Network Behavior” section in the docs would go a long way towards OpenCode becoming a mature and enterprise ready tool.

Thanks for considering, and appreciate the work you’re doing on OpenCode.

Originally created by @tredondo on GitHub (Feb 8, 2026). Originally assigned to: @jayair on GitHub. Hi OpenCode team 👋 I’d like to request clearer documentation of all outbound network connections that OpenCode may initiate, including their purpose, timing, and whether they are optional or configurable. This request was sparked by an unexpected outbound connection attempt to gitst.github.com: <img width="710" height="436" alt="Image" src="https://github.com/user-attachments/assets/f52d66fd-9b98-494e-98e5-1b0a9344cf55" /> This is probably (hopefully) harmess, but from a user perspective, any undocumented network activity raises legitimate questions around security and privacy. Concretely, it would be very helpful to document: - All external hosts/domains OpenCode may connect to - When and why each connection occurs (startup, runtime, background tasks, updates, telemetry, etc.) - What data categories are involved (e.g., metadata vs. user code/config) - Whether connections can be disabled, redirected, or run in a fully offline mode - Differences by platform or build (e.g. Desktop vs. TUI) As you're probably well aware, this is important for: - Trust: Users are more comfortable adopting tools when network behavior is explicit and predictable. Undocumented network connections undermine user confidence in the application. - Privacy: Users want to understand what data is being transmitted and for what purpose - Compliance & enterprise use: Many environments require allowlisting, documentation, or prior review of all egress traffic. - Network security: Organizations with strict network policies require documentation to properly configure firewalls and security controls. Developers often run tools in restricted, monitored, or air-gapped environments. This is just a request for transparency and documentation so users can make informed decisions and configure their environments appropriately. If there’s already partial documentation on this, I’d be happy to be pointed to it. Otherwise, I think a short “Network Behavior” section in the docs would go a long way towards OpenCode becoming a mature and enterprise ready tool. Thanks for considering, and appreciate the work you’re doing on OpenCode.
yindo added the docs label 2026-02-16 18:11:04 -05:00
yindo commented 2026-02-16 18:11:04 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 8, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #459: Privacy and Data Collection Clarification Request - Similar request for transparency about data collection and network requests
  • #10416: OpenCode is not private by default? - Concerns about undocumented outbound connections for session naming
  • #9158: Opencode web egress URLs - Request for documentation of required egress URLs for web functionality
  • #4959: [FEATURE]: Add option to disable models.dev fetch for corporate proxy environments - Documents the models.dev network call and requests configuration options

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Feb 8, 2026): This issue might be a duplicate of existing issues. Please check: - #459: Privacy and Data Collection Clarification Request - Similar request for transparency about data collection and network requests - #10416: OpenCode is not private by default? - Concerns about undocumented outbound connections for session naming - #9158: Opencode web egress URLs - Request for documentation of required egress URLs for web functionality - #4959: [FEATURE]: Add option to disable models.dev fetch for corporate proxy environments - Documents the models.dev network call and requests configuration options Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 18:11:04 -05:00
Author
Owner
Copy Link
Copy Source

@yanosh-k commented on GitHub (Feb 11, 2026):

Hey, I'm running opencode with mitmproxy from time to time but I never got a request to gist.github.com show up before. Are you sure this is not from a plugin, tool, skill, command or some other prompt trigger?

The only time I've detected a fishy request was while working with some PHP files. Turned out a PHP LSP was sending telemetry. I did a lot of digging unit I found out which component actually did that telemetry request - turns out opencode was auto-installing the LSP from npmjs (I think they later disable those telemetry requests as I saw a PR referencing a similar issue). All LSPs were turned off in my config from then on. But this goes to show that documenting just the core network connections might not be enough.

@yanosh-k commented on GitHub (Feb 11, 2026): Hey, I'm running `opencode` with `mitmproxy` from time to time but I never got a request to `gist.github.com` show up before. Are you sure this is not from a plugin, tool, skill, command or some other prompt trigger? The only time I've detected a fishy request was while working with some PHP files. Turned out a PHP LSP was sending telemetry. I did a lot of digging unit I found out which component actually did that telemetry request - turns out opencode was auto-installing the LSP from npmjs (I think they later disable those telemetry requests as I saw a PR referencing a similar issue). All LSPs were turned off in my config from then on. But this goes to show that documenting just the core network connections might not be enough.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label docs
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8873
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?