opencode-workbenchBLOCK
OpenCode Workbench: a reproducible, self-documenting, recoverable OpenCode development workstation — configuration, agent skills, MCP stack, and a clone MCP server for any Linux box
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A reproducible, self-documenting, and recoverable OpenCode development workstation — configuration, agent skills, MCP stack, and an MCP server that clones the entire setup onto any Linux machine (locally or over SSH).
[](https://github.com/simonmak-ascent/opencode-workbench/actions/workflows/secret-scan.yml) [](https://github.com/simonmak-ascent/opencode-workbench/actions/workflows/tdqs.yml) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.simonmak-ascent/opencode-workbench) [](https://glama.ai/mcp/servers/simonmak-ascent/opencode-workbench) [](https://github.com/simonmak-ascent/opencode-workbench/actions/workflows/mcp-server.yml) [](https://github.com/simonmak-ascent/opencode-workbench/actions/workflows/validate-docs.yml) [](LICENSE)
Homepage & remote MCP: https://opencode-workbench.simonmak.com · POST https://opencode-workbench.simonmak.com/mcp
Overview
This repository is the single source of truth for a complete cloud development workstation. Everything needed to rebuild from scratch is versioned here:
- Workstation configuration and automation
- OpenCode configuration (model, providers, MCP servers)
40cc0657513bOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add opencode-workbench -- npx -y @simonmak-ascent/[email protected]
Exposed tools (27)
18 read · 8 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
apply_clone | write | |
create_websocket_connection | write | Create WebSocket connection for Puppeteer/Playwright |
describe_workbench | read | |
download_files | read | Handle file downloads |
execute_browserql | write | Execute BrowserQL GraphQL queries |
execute_function | write | Execute custom JavaScript function in browser context |
export_page | read | Export webpage with resources |
generate_pdf | read | Generate PDF from URL or HTML content |
get_config | read | Get configuration |
get_content | read | Extract rendered HTML content from a webpage |
get_health | read | Get health status of Browserless instance |
get_metrics | read | Get metrics |
get_sessions | read | Get active sessions |
initialize_browserless | read | Initialize connection to Browserless instance |
inspect_target | read | |
install_component | write | |
list_required_credentials | read | |
perplexity_search | read | Search the web and return a ranked list of results with titles, URLs, snippets, and dates. Best for: finding specific URLs, checking recent news, verifying facts, discovering sources. No AI synthesis. For AI-generated answers with citations, use perplexity_ask instead. |
plan_clone | read | |
remove_component | destructive | |
run_auth_flow | write | |
run_performance_audit | write | Run Lighthouse performance audit |
take_screenshot | read | Take screenshot of a webpage |
test_connection | read | Test connection to Browserless instance |
unblock | read | Bypass bot detection and anti-scraping measures |
update_component | write | |
verify_clone | read |
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (11 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (20)
"Runs the OpenCode CLI in a bubblewrap sandbox: read-only system, writable workspace, and no access to ~/.ssh, cloud credentials or ~/.env.workbench.",
CRED_FILES=$(find "$WORKSPACE" -maxdepth 5 -type f \( -name '.env' -o -name '.env.*' -o -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' -o -name 'credentials.json' -o -name 'cre
"DATABASE_URL": "postgres://opencode:opencode@localhost:5432/memory",
if curl -s -o /dev/null "http://127.0.0.1:${FIGMA_SERVICE_PORT}/mcp" 2>/dev/null; thenthis.browserlessUrl = 'http://172.22.0.1:3000';
| `DATABASE_URL` | `postgres://opencode:opencode@localhost:5432/memory` | Postgres connection |
| `DATABASE_URL` | `postgres://opencode:opencode@localhost:5432/memory` | `devcontainer.json` |
- [ ] PostgreSQL accessible: `psql postgres://opencode:opencode@localhost:5432/memory -c "SELECT 1"`
- `devcontainer.json:27`: `DATABASE_URL` = `postgres://opencode:opencode@localhost:5432/memory`
token: "browserless-local-token", protocol: "http"
remove_component
.gitleaks.toml
for (const rel of ["../package.json", "../../package.json"]) {@modelcontextprotocol/sdk, @vercel/analytics, zod, @types/node, typescript, vitest
@modelcontextprotocol/sdk, puppeteer, playwright, axios, ws, zod, dotenv, @types/node
@modelcontextprotocol/sdk
| **Streamable HTTP** | Remote, shared, independently deployed servers | Single `/mcp` endpoint; POST returns JSON or SSE; optional GET for server→client SSE; optional sessions with `MCP-Session-Id`;
and no access to `~/.ssh`, cloud credentials or `~/.env.workbench`. Wrapper:
| OpenCode not found | `curl -fsSL https://opencode.ai/install | bash` |
- **Install**: `curl -sSf https://install.surrealdb.com | sh`
Gates applied: no_behavioural_pass.
40cc0657513bfull audit observations/trust-audit/mcp-server/simonmak-ascent__opencode-workbench.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 40cc0657513b | BLOCK | F | 57 | first audit |
Questions
What is the opencode-workbench MCP server?
OpenCode Workbench: a reproducible, self-documenting, recoverable OpenCode development workstation — configuration, agent skills, MCP stack, and a clone MCP server for any Linux box
What tools does opencode-workbench expose?
27 in total: 18 read-only, 8 that write, and 1 that can delete or overwrite (remove_component). Every one is listed on this page with its risk.
Is opencode-workbench safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does opencode-workbench need?
It reads PERPLEXITY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does opencode-workbench run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as perplexity-agent-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (40cc0657513b), read on 2026-10-11. The repository is watched and re-audited when it changes.