Where does OpenCode read its config?

From opencode.jsonc or opencode.json in the project, and from ~/.config/opencode/opencode.json for every project. Project settings override the global file.

Why is the router an alias in the config?

OpenCode references models as provider/model. The router id auto/security contains a slash, so the config gives it the local id auto-security and sends the real id through the modelID field, which is the mechanism OpenCode documents for aliases.

Can I store the key with /connect instead?

OpenCode’s /connect command stores credentials for providers it lists. For a custom provider, its docs show the credential coming from the variables named in env, or from an apiKey setting with an {env:NAME} substitution.

Which build should OpenCode use?

The router alias is the simplest: it sends agent turns with tools and code to a stronger build and short turns to a fast one. Pin a single build when you want every turn on the same model.

What does an OpenCode session cost?

OpenCode re-sends the conversation and tool results each turn, so input tokens dominate. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.

Set up OpenCode with PentestLLM

OpenCode runs on PentestLLM through a custom provider: add one providers block to opencode.jsonc with the base URL https://api.pentestllm.ai/v1, export your key as PENTESTLLM_API_KEY, and select the model. The config below is OpenCode’s current V2 format, read from its docs on 11 November 2026; the older V1 format is shown after it.

Get a key Prices per token

shell

export PENTESTLLM_API_KEY="sk-ptl-live-…"

Steps

Create a key and export it
Create a key in the PentestLLM console and add credit. Put the key in an environment variable in the shell that will start OpenCode. The provider block names this variable in its env list, so the key never sits in the config file.
shell
```
export PENTESTLLM_API_KEY="sk-ptl-live-…"
```

Add the provider to opencode.jsonc

Create opencode.jsonc in the project root, or put the same block in ~/.config/opencode/opencode.json to have it in every project; a project file overrides the global one. The package line selects OpenCode’s OpenAI-compatible runtime. The first model is an alias: OpenCode shows auto-security and sends auto/security to the API through modelID.

opencode.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "model": "pentestllm/auto-security",
  "providers": {
    "pentestllm": {
      "name": "PentestLLM",
      "env": ["PENTESTLLM_API_KEY"],
      "package": "@opencode/ai/providers/openai-compatible",
      "settings": {
        "baseURL": "https://api.pentestllm.ai/v1"
      },
      "models": {
        "auto-security": {
          "modelID": "auto/security",
          "name": "Security router"
        },
        "gemma-4-26b-a4b-it-cybersecurity": {
          "name": "Gemma 4 26B A4B Cybersecurity",
          "limit": { "context": 262144 }
        }
      }
    }
  }
}

Start OpenCode and pick the model
Run opencode in the project. The model line already selects the router alias. Type /models to switch to another entry under PentestLLM for the session, or pass a model for a single run on the command line.
shell
```
opencode run --model pentestllm/auto-security "Summarize the findings in notes/scan.txt and rank them by severity."
```
Check the key outside OpenCode
If OpenCode reports an authentication or model error, test the key directly. A list of model ids means the key and URL are right and the problem is in the config file.
shell
```
curl https://api.pentestllm.ai/v1/models -H "Authorization: Bearer sk-ptl-live-…"
```

What each setting does

providers.pentestllm: The provider id. It is the first half of every model reference, as in pentestllm/auto-security.
env: The environment variable names OpenCode reads the credential from, in order.
package: The runtime that talks to the API. @opencode/ai/providers/openai-compatible sends the OpenAI chat format.
settings.baseURL: Where requests go. Keep the /v1 at the end.
models: The entries the picker offers. The key is OpenCode’s id; modelID is the id sent to the API when the two differ.
limit: Context and output token limits. For a model it does not know, OpenCode assumes 200,000 tokens of context and 32,000 of output, so set the real figures from the model page.

If you are on OpenCode 1

OpenCode’s migration guide says V1 config is meant to keep working in V2 and that converting is optional. If you still run V1, the same provider is written with the singular provider key, an npm package and options. V1 has no modelID alias in its custom provider example, so this block uses a named build.

opencode.json (V1)

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "pentestllm": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "PentestLLM",
      "options": {
        "baseURL": "https://api.pentestllm.ai/v1",
        "apiKey": "{env:PENTESTLLM_API_KEY}"
      },
      "models": {
        "gemma-4-26b-a4b-it-cybersecurity": { "name": "Gemma 4 26B A4B Cybersecurity" }
      }
    }
  },
  "model": "pentestllm/gemma-4-26b-a4b-it-cybersecurity"
}

Approvals for security work

OpenCode’s permission rules decide whether an action runs, is blocked or waits for you, and when no rule matches it asks. For engagement work, state that explicitly so a later config change does not loosen it. The rule below makes every shell command wait for approval. Add the engagement scope to your project instructions so the model’s proposals stay inside it.

opencode.jsonc

{
  "permissions": [
    { "action": "shell", "resource": "*", "effect": "ask" }
  ]
}

Authorized use

OpenCode on a security build will propose real commands against real hosts. Run it only against systems you own or have written permission to test, as the acceptable use policy requires. To let the agent drive tools on a Kali machine, continue with the Kali MCP guide; for prices per build see pricing.

9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.

Build	Input	Output	Context
Qwen3.8 27B Cybersecurity	$0.40	$2.40	262,144
Gemma 4 26B A4B Cybersecurity	$0.4224	$1.3376	262,144
GLM-5.3 Flash Cybersecurity	$0.5093	$1.6975	1,048,576
Red Team (Flash)	$0.90	$3.00	not published
Red Team (Pro)	$1.50	$6.00	not published
OrcaCyber MiniMax M3.1 Flash	$2.00	$4.00	261,632
OrcaCyber Qwen3.8 Flash Next	$2.00	$4.00	261,632
Cyber Frontier	$5.25	$15.75	1,048,576
OrcaCyber Zero 1.5	$7.50	$18.75	999,488

Full price list and tool fees · Every model · API docs

Questions

From opencode.jsonc or opencode.json in the project, and from ~/.config/opencode/opencode.json for every project. Project settings override the global file.
OpenCode references models as provider/model. The router id auto/security contains a slash, so the config gives it the local id auto-security and sends the real id through the modelID field, which is the mechanism OpenCode documents for aliases.
OpenCode’s /connect command stores credentials for providers it lists. For a custom provider, its docs show the credential coming from the variables named in env, or from an apiKey setting with an {env:NAME} substitution.
The router alias is the simplest: it sends agent turns with tools and code to a stronger build and short turns to a fast one. Pin a single build when you want every turn on the same model.
OpenCode re-sends the conversation and tool results each turn, so input tokens dominate. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.

One key, from $10

PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.

Get a key

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

Input, 8,000 tokens at $0.40 per million: $0.0032
Output, 1,000 tokens at $2.40 per million: $0.0024
One turn: $0.0056
1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B CybersecurityOrcaCyber Zero 1.5 $18.75

Steps

Create a key and export it