Atlas / MCP servers / oeronteros / OpenCode Orchestra

OpenCode OrchestraCAUTION

Name: OpenCode Orchestra
Author: oeronteros

mcp/oeronteros/opencode-orchestra

MCP server by oeronteros · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Verdict

CAUTION

Grade

Trust score

80 /100

Exposed tools

1 1r · 0w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@oeronteros-1/opencode-orchestra) [](LICENSE) [](https://opencode.ai/docs/plugins/)

English · Русский · 简体中文

OpenCode Orchestra turns a complex request into a controlled multi-agent workflow. It classifies the task, chooses connected models, dispatches focused specialists, merges their evidence, applies changes, verifies the result, and records local cost and usage telemetry.

OpenCode Orchestra targets OpenCode v2 and loads through its plugin setup API. A compatibility entrypoint remains available for OpenCode 1.18.29 and newer.

One primary agent with a team of focused, permission-scoped specialists
Automatic model discovery, budget modes, per-agent overrides, and fallback chains
Dependency-aware execution with hard concurrency, depth, and ownership limits
Optional isolated Git worktrees for parallel editors
Managed Chrome with persistent profiles, Playwright for UI workflows, and DevTools for diagnostics
Local dashboard for live activity, tokens, cost, models, agents, and MCP health
Diagnostics, MCP smoke tests, bounded autonomous loops, and offline voice input

Quick start

Requirements: OpenCode v2, Bun 1.2 or newer, Node.js 22.12 or newer, and a supported OpenCode model provider. Managed browsing additionally requires OpenCode 2.0.16 or newer and a separately installed Chrome.

bunx @oeronteros-1/opencode-orchestra@latest install

Restart OpenCode, then run:

/orchestra Find the cause of the intermittent login failure, fix it, and run the relevant tests

Useful status commands:

/orchestra-status
/plugin-status
/orchestra-resume

The installer is idempotent. It backs up the

Read from source at commit 0823f37b48e1OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add voice-overlay-win32-x64 --env GH_TOKEN=${GH_TOKEN} --env GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PERSONAL_ACCESS_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @oeronteros-1/[email protected]

claude-desktop

{
  "mcpServers": {
    "voice-overlay-win32-x64": {
      "command": "npx",
      "args": [
        "-y",
        "@oeronteros-1/[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (1)

1 read · 0 write · 0 destructive.

Tool	Risk	Description
`orchestra_browser`	read	Prepare a sealed browser scenario, switch backend with a reason, inspect safe status, release after verification, or restart after release. First login happens in the visible managed window. No credentials in chat.

Trust audit

CAUTIONgrade B · trust 80/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (6 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (24)

MEDIUMInventory / provenance · inv.binary · CWE-1104

voice-overlay/src-tauri/icons/icon.icns

icon.icns

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

dashboard/vite.config.ts:15

"/api": "http://127.0.0.1:43127",

LOWInventory / provenance · inv.binary · CWE-1104

test/fixtures/voice-ffmpeg.wav

voice-ffmpeg.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

test/voice-web.test.ts:131

assert.doesNotThrow(() => new Function(script))

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

voice-overlay/linux/gnome/extension.test.mjs:46

const Extension = new Function('Gio', 'GLib', 'Clutter', 'Meta', 'Shell', 'St', 'Main', 'Extension', 'global', source)(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

dashboard/src/app.tsx:1

import { MCP_LABELS } from "../../src/mcp/catalog"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

dashboard/src/components/ui/button.tsx:4

import { cn } from "../../lib/cn"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

dashboard/src/components/ui/card.tsx:2

import { cn } from "../../lib/cn"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

dashboard/src/components/ui/switch.tsx:3

import { cn } from "../../lib/cn"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/dashboard/server.ts:937

const besidePackage = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../dashboard-dist")

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README.md:393

Then open `http://127.0.0.1:4097`. The microphone button is added next to the prompt submit button and inserts recognized text into the draft by default. Its settings also offer explicit insert-and-se

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README.ru.md:403

Откройте `http://127.0.0.1:4097`. Кнопка микрофона появится рядом с отправкой промпта и по умолчанию вставит распознанный текст в черновик. В настройках можно явно выбрать «Вставить и отправить». Если

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README.zh-CN.md:364

然后打开 `http://127.0.0.1:4097`。麦克风按钮会显示在提交按钮旁边,默认将识别文本插入草稿。设置中也可显式选择插入并发送。如果录音或转写期间切换会话,结果会保留在可编辑的恢复面板中;恢复结果不会自动发送。

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/browser.md:44

"origins": ["http://127.0.0.1:3000"],

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@opencode-ai/plugin, @opencode/plugin, jsonc-parser, @base-ui/react, @hookform/resolvers, @hugeicons/core-free-icons, @hugeicons/react, @tailwindcss/vite

Why it matters. 30 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

voice-overlay/package.json

@tauri-apps/api, react, react-dom, @tauri-apps/cli, @types/node, @types/react, @types/react-dom, @vitejs/plugin-react

Why it matters. 10 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

README.md:366

For OpenCode 2 on Windows and Linux, launch `bunx @oeronteros-1/opencode-orchestra@latest voice-overlay` once, then focus the prompt in TUI, Desktop or any browser. **Ctrl+Alt+Space** starts recording