Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

Analysis · October 15, 2026 · concept

OpenCode 2.0Code ModeMCPmcpagent-harnessagent-security

OpenCode 2.0 Stops Calling Your MCP Tools One at a Time

Code Mode is now the default. Here is what it saves, what it changes about approvals, and the config worth adding before you upgrade.

Most coding agents still use tools the slow way. The model asks for one tool, waits for the answer, reads the whole answer, then asks for the next one.

That loop gets expensive fast. Ask an agent to find every open bug in a GitHub repo and file each one in Linear, and it makes one call to list the bugs, then one call per bug, with every raw result landing in its context window (the working memory the model reads on every turn) along the way.

OpenCode 2.0 changes the default. Its release notes, posted October 12, say "All MCP servers in 2.0 are opted into code mode by default." (MCP, the Model Context Protocol, is the common plug format that lets an agent talk to outside tools like GitHub, Linear or a database.) Instead of handing the model a long menu of tools, OpenCode turns each connected server into functions the model calls from a short JavaScript script. The whole bug-to-Linear job becomes one script, one round trip.

That is a real improvement. It also means one model turn can now fire dozens of tool calls, and the setting that decides whether any of them stop to ask you is, by default, "allow."

Code Mode does not create a new permission risk. It speeds up whatever permission policy you already have. So the useful question for anyone upgrading is a plain one: which of your servers should run as code, and which tools inside them deserve a speed bump?

What OpenCode is, and what changed in 2.0

OpenCode is an open-source coding agent you run in your terminal, a desktop app or a web UI. It is MIT licensed, and its newest core release tag, v2.0.29, landed on October 14. The 2.0 announcement passed 600 points on Hacker News the same day. (The desktop app is still labeled beta.)

Three changes matter for this piece:

  • One background server. The release notes say the OpenCode server "now automatically runs as a single background process on your machine," and the terminal UI, web interface and desktop app all connect to it.
  • Everything is a plugin. The team says nearly every 2.0 feature is built as an internal plugin, more than 80 of them, and that plugins can hot-reload mid-session.
  • Code Mode. A small JavaScript interpreter in the @opencode/codemode package "ingests MCP servers or OpenAPI endpoints, converting them into functions that the agent can call in a script."

Before 2.0, each MCP tool showed up to the model as its own entry on the tool list. Now, by default, it shows up as a function.

How Code Mode works, in plain terms

Think of the difference between phoning a store five times to ask about five items and emailing them one list.

In direct mode, the model makes a tool call, the result comes back into its context, and it decides what to do next. Five tools, five round trips, five results to read.

In Code Mode, OpenCode gives the model a tool called execute. The tools docs describe it this way: "execute runs JavaScript in Code Mode so the agent can call and combine tools from the catalog." Your MCP servers appear as namespaces, one named group of functions per server. A server named github exposes its tools as tools.github.list_issues(...), and the release notes show exactly that kind of script: list the open GitHub bugs, map over them, call tools.linear.save_issue for each.

Two details make this safer than it sounds:

  • The script runs in a tight box. Per the tools docs, "The runtime has no direct filesystem access, imports, timers, or fetch; it can only call tools in its catalog." The script cannot read your disk or call the internet on its own. Everything it does goes through a tool.
  • Intermediate results stay out of the model's head. The docs say Code Mode suits parallel calls and "processing results without adding every intermediate value to the model's context." A 400-issue list can get filtered inside the script, and only the summary comes back.

That second point is the whole pitch. The release notes say the opt-in default lets you connect many servers with little context overhead, and let the agent discover and combine them.

The part to read twice: approvals

Here is the thing a fast upgrade can miss.

OpenCode decides whether to run, block or pause on each action using permission rules. The permissions docs give each rule three fields (action, resource, effect) and three effects: allow runs without prompting, deny blocks, ask waits for you. Rules run in order and the last match wins.

Now look at the base policy every agent starts with:

{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "external_directory", "resource": "*", "effect": "ask" },
{ "action": "read", "resource": "*.env", "effect": "ask" },
{ "action": "read", "resource": "*.env.*", "effect": "ask" },
{ "action": "read", "resource": "*.env.example", "effect": "allow" }

Everything is allowed, except reaching outside the project and reading .env files. Shipped agents layer their own rules on top (the plan agent denies edits, for example), and your global and agent rules come after that. But for everyday work in the build agent, the starting answer is yes.

The good news is that Code Mode does not bypass your rules. The permissions docs say execute "controls whether Code Mode is available" and that nested tools "still enforce their own rules." MCP tools are checked under the name <server>_<tool>, inside a script or not.

So the risk is the default policy plus the new speed. A script that loops over 40 issues and calls a write tool 40 times will do all 40 without pausing, because nothing in the base policy asks it to stop. In direct mode you would at least watch the calls go by one at a time. In Code Mode the model writes the loop, and the loop runs.

None of this is a bug. It is a default worth changing on purpose.

Put this into practice

You can do all of this in one sitting. Plan on about 20 minutes, most of it reading your own MCP list.

1. Upgrade carefully. The release notes say to move to the latest 1.x release first, then run:

opencode upgrade --major

The migration guide adds two warnings. If you installed V1 through a package manager, remove that install first, because V2 replaces the V1 binary. And keep a copy of your V1 setup while you test, because both versions read the same config locations.

2. Move your MCP config to the new shape. V2 still reads V1 syntax in memory, so this step is not required to test, but the native shape is where the new keys live. Servers now live under mcp.servers. The old enabled flag becomes its opposite, disabled. The single timeout splits into timeout.catalog and timeout.execution, and OAuth fields switch to snake_case (clientId becomes client_id). The MCP servers docs list the defaults: 30 seconds to start, 30 seconds to fetch the tool catalog, and 12 hours for execution. Twelve hours is generous. Set it lower for anything that writes.

3. Sort your servers into two piles. Read-heavy servers (docs search, issue lookups, logs) are the best case for Code Mode: lots of data, filtered in the script, little of it reaching the model. Servers whose tools must appear on the model's own tool list, for example because a provider-specific feature depends on that list, can opt out with one key:

{
  "mcp": {
    "servers": {
      "context7": {
        "type": "remote",
        "url": "https://mcp.context7.com/mcp",
        "codemode": false
      }
    }
  }
}

One trap from the docs: a project-level config that overrides a server replaces the whole server object. If you override just to set codemode, repeat the server's other required fields, or it breaks.

4. Add speed bumps to write tools. This is the step that matters most. Find the tools that create, delete, send or pay, and set them to ask:

{ "action": "github_create_issue", "resource": "*", "effect": "ask" },
{ "action": "linear_save_issue", "resource": "*", "effect": "ask" },
{ "action": "github_merge_pull_request", "resource": "*", "effect": "deny" }

Tool names follow the <server>_<tool> pattern, with odd characters turned into _, so check the exact names on your own setup. When a rule says ask, you can answer once, always (saves the pattern for the project) or reject, and the docs promise saved approvals "never override a configured deny."

5. Know your off switch. If a project should never run scripts at all, deny the execute action:

{ "action": "execute", "resource": "*", "effect": "deny" }

What to expect after step 4: the first time a script hits a write tool, OpenCode pauses and asks. (If you run OpenCode headless, meaning from a script or CI with no one at the keyboard, check how that client answers ask before you rely on the prompt.) If a loop asks 40 times, that is your signal to either batch the work differently or approve always for a narrow pattern you actually trust.

Honest limitations

The docs leave gaps. The MCP page does not say how its permission rules play with Code Mode; you have to read the tools and permissions pages to learn that nested tools keep their own checks. Expect a few more rough edges like that in a release this size.

Your old plugins are gone. "V1 plugin implementations do not run in V2," per the migration guide. If you rely on a community plugin, check that it has been ported before you upgrade.

The SDK is still moving. The release notes say the @opencode/sdk interfaces are still changing. Do not build anything you cannot rewrite on top of it yet.

Fewer calls in view. Code Mode keeps intermediate results out of the model's context, which is the point. It can also mean the session you review later shows a script and its output rather than each call as its own step. If you audit agent sessions, check what your client actually records before you rely on it.

Code Mode is not a sandbox for your tools. The JavaScript box has no filesystem or network of its own, but the tools it calls do. A github tool that can delete a branch can delete it from inside a script just as well.

The default is a decision someone else made

Code Mode is a better way to use tools. It cuts context, it cuts round trips, and it lets a model do what it is good at: write a small program instead of making a dozen phone calls.

But a default is a choice made for the average user, and you are not the average user. You know which of your servers can only read and which can merge, send or pay. OpenCode hands you the exact controls to say so: codemode per server, ask and deny per tool, and execute for the whole thing.

Spend the 20 minutes. Then let it write the loop.

Sources: OpenCode 2.0 release notes (October 12, 2026), OpenCode v2 docs: MCP servers, tools, permissions, migrating from V1, anomalyco/opencode on GitHub (core tag v2.0.29, October 14, 2026, reviewed), Hacker News discussion.

Medium metadata

Title: OpenCode 2.0 Stops Calling Your MCP Tools One at a Time

Alternate titles to test:

  • OpenCode 2.0 Turns Every MCP Server Into Code Your Agent Writes
  • You Don't Have to Run MCP Tools One Call at a Time Anymore

Subtitle options:

  • Code Mode is now the default. Here is what it saves, what it changes about approvals, and the config lines worth adding. (picked, trimmed for length below)
  • One script instead of forty tool calls. Great for context, worth a second look for approvals.
  • The new default saves tokens. Here is how to keep it from saving you a prompt you wanted.

Subtitle (final, under 130 characters): Code Mode is now the default. Here is what it saves, what it changes about approvals, and the config to add first.

Description: OpenCode 2.0 runs every MCP server through Code Mode by default. What that means, why it saves context, and the permission rules to set before you upgrade.

Tags (priority order):

  1. AI Agents: the core audience, builders running coding agents.
  2. Model Context Protocol: the protocol the piece explains in practical terms.
  3. Open Source: OpenCode is an MIT-licensed project with a large following.
  4. Developer Tools: practical config and upgrade steps.
  5. AI Security: the approvals and permissions angle.

Article type: A (spike). A real release with a clear payoff and a concrete change to how readers configure their agent.

Publish plan: Post at 7 to 8 AM ET. Let Medium distribute for 2 to 6 hours, then send to subscribers only if it is performing.