---
title: "OpenCode Setup for Security Models: opencode.jsonc Guide"
canonical: https://pentestllm.ai/agents/opencode
generated: 2026-11-11T18:02:51.116Z
source: https://pentestllm.ai/agents/opencode
base_url: https://api.pentestllm.ai/v1
---

![Patch cables in a network switch](https://pentestllm.ai/img/cables.webp)

## Steps

1. ### Create a key and export it
   Create a key in the PentestLLM console and add credit. Put the key in an environment variable in the shell that will start OpenCode. The provider block names this variable in its `env` list, so the key never sits in the config file.
   shell
   ```
   export PENTESTLLM_API_KEY="sk-ptl-live-…"
   ```
2. ### Add the provider to opencode.jsonc
   Create `opencode.jsonc` in the project root, or put the same block in `~/.config/opencode/opencode.json` to have it in every project; a project file overrides the global one. The `package` line selects OpenCode’s OpenAI-compatible runtime. The first model is an alias: OpenCode shows `auto-security` and sends `auto/security` to the API through `modelID`.
   opencode.jsonc
   ```
   {
     "$schema": "https://opencode.ai/config.json",
     "model": "pentestllm/auto-security",
     "providers": {
       "pentestllm": {
         "name": "PentestLLM",
         "env": ["PENTESTLLM_API_KEY"],
         "package": "@opencode/ai/providers/openai-compatible",
         "settings": {
           "baseURL": "https://api.pentestllm.ai/v1"
         },
         "models": {
           "auto-security": {
             "modelID": "auto/security",
             "name": "Security router"
           },
           "gemma-4-26b-a4b-it-cybersecurity": {
             "name": "Gemma 4 26B A4B Cybersecurity",
             "limit": { "context": 262144 }
           }
         }
       }
     }
   }
   ```
3. ### Start OpenCode and pick the model
   Run `opencode` in the project. The `model` line already selects the router alias. Type `/models` to switch to another entry under PentestLLM for the session, or pass a model for a single run on the command line.
   shell
   ```
   opencode run --model pentestllm/auto-security "Summarize the findings in notes/scan.txt and rank them by severity."
   ```
4. ### Check the key outside OpenCode
   If OpenCode reports an authentication or model error, test the key directly. A list of model ids means the key and URL are right and the problem is in the config file.
   shell
   ```
   curl https://api.pentestllm.ai/v1/models -H "Authorization: Bearer sk-ptl-live-…"
   ```

## What each setting does

- providers.pentestllm: The provider id. It is the first half of every model reference, as in `pentestllm/auto-security`.
- env: The environment variable names OpenCode reads the credential from, in order.
- package: The runtime that talks to the API. `@opencode/ai/providers/openai-compatible` sends the OpenAI chat format.
- settings.baseURL: Where requests go. Keep the `/v1` at the end.
- models: The entries the picker offers. The key is OpenCode’s id; `modelID` is the id sent to the API when the two differ.
- limit: Context and output token limits. For a model it does not know, OpenCode assumes 200,000 tokens of context and 32,000 of output, so set the real figures from the [model page](https://pentestllm.ai/models).

## If you are on OpenCode 1

OpenCode’s migration guide says V1 config is meant to keep working in V2 and that converting is optional. If you still run V1, the same provider is written with the singular `provider` key, an `npm` package and `options`. V1 has no `modelID` alias in its custom provider example, so this block uses a named build.

opencode.json (V1)

```
{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "pentestllm": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "PentestLLM",
      "options": {
        "baseURL": "https://api.pentestllm.ai/v1",
        "apiKey": "{env:PENTESTLLM_API_KEY}"
      },
      "models": {
        "gemma-4-26b-a4b-it-cybersecurity": { "name": "Gemma 4 26B A4B Cybersecurity" }
      }
    }
  },
  "model": "pentestllm/gemma-4-26b-a4b-it-cybersecurity"
}
```

## Approvals for security work

OpenCode’s permission rules decide whether an action runs, is blocked or waits for you, and when no rule matches it asks. For engagement work, state that explicitly so a later config change does not loosen it. The rule below makes every shell command wait for approval. Add the engagement scope to your project instructions so the model’s proposals stay inside it.

opencode.jsonc

```
{
  "permissions": [
    { "action": "shell", "resource": "*", "effect": "ask" }
  ]
}
```

## Authorized use

OpenCode on a security build will propose real commands against real hosts. Run it only against systems you own or have written permission to test, as the [acceptable use policy](https://pentestllm.ai/acceptable-use) requires. To let the agent drive tools on a Kali machine, continue with the [Kali MCP guide](https://pentestllm.ai/agents/kali-mcp); for prices per build see [pricing](https://pentestllm.ai/pricing).

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- From opencode.jsonc or opencode.json in the project, and from ~/.config/opencode/opencode.json for every project. Project settings override the global file.
- OpenCode references models as provider/model. The router id auto/security contains a slash, so the config gives it the local id auto-security and sends the real id through the modelID field, which is the mechanism OpenCode documents for aliases.
- OpenCode’s /connect command stores credentials for providers it lists. For a custom provider, its docs show the credential coming from the variables named in env, or from an apiKey setting with an {env:NAME} substitution.
- The router alias is the simplest: it sends agent turns with tools and code to a stronger build and short turns to a fast one. Pin a single build when you want every turn on the same model.
- OpenCode re-sends the conversation and tool results each turn, so input tokens dominate. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.

## Read next

- [All agent guides The same three values in every supported client.](https://pentestllm.ai/agents)
- [Kali MCP mcp-kali-server on Kali, driven by a security build through an MCP client.](https://pentestllm.ai/agents/kali-mcp)
- [Claude Code Two environment variables point Claude Code at the Messages endpoint.](https://pentestllm.ai/agents/claude-code)
- [Aider The two environment variables and the .aider.conf.yml keys.](https://pentestllm.ai/agents/aider)
- [CTF Models that reason through web, crypto, reversing, forensics and pwn challenge categories.](https://pentestllm.ai/ctf)

Facts about other products and tools on this page were read from their own pages on 11 November 2026: [OpenCode docs: Providers](https://opencode.ai/docs/providers/), [OpenCode docs: Models](https://opencode.ai/docs/models/), [OpenCode docs: Config](https://opencode.ai/docs/config/), [OpenCode docs: Migrate from V1](https://opencode.ai/docs/migrate-v1/). They change; check the source before relying on a figure.

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75