Skip to content

com.ascent-partners/opencode-workbench

by ascent-partners.com · remote · local (npm) · no sign-in to list tools · v4.0.2 · published by com.ascent-partners

Provision an OpenCode workbench and MCP stack on any Linux box, local or over SSH.

Deletes · 4Changes · 22 high findings
CompareRegistry entry

10 tools: 4 can delete or cancel things, 2 change things and 4 only read.

Scanned Oct 21, 2026

9 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http opencode-workbench https://opencode-workbench.simonmak.com/mcp

Findings

Matches of fixed checks, with the text they matched.

2 high1 warn6 info
Show 3 more findings

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Deletes or cancels 4Claude Code: deny
  • apply_cloneApply the Workbench profile to a target: clone the repo and install missing components (OpenCode CLI, Node/pnpm, MCP servers, skills, plugins, optional Docker).1 finding

    Why it is in this group

    • The name "apply_clone" says "apply": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • High

      The description refers to "~/.env.workbench".

      Matched text

      description: "...can take minutes. Writes a names-only `~/.env.workbench` (mode 600); never secret values. Conse..."

      What this check looks for
    Description, as the server wrote it
    Apply the Workbench profile to a target: clone the repo and install missing components (OpenCode CLI, Node/pnpm, MCP servers, skills, plugins, optional Docker). It OVERWRITES `<home>/.config/opencode/opencode.json`, copies `AGENTS.md`, resets an existing profile repo to `origin/main`, and runs global installs that need write permission (plus SSH for `mode:ssh`) and can take minutes. Writes a names-only `~/.env.workbench` (mode 600); never secret values. Consent-gated and idempotent: without `confirm:true` it returns the plan and changes nothing. Parameter semantics: `components` defaults to required+core; `workspace` defaults to `~/opencode-workbench`; `skipRepo` skips the clone/update; `profileUrl` overrides the git remote; `dryRun` returns the plan. To preview only, use plan_clone.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • install_componentInstall a single Workbench component by id (e.g.No findings

    Why it is in this group

    • The name "install_component" says "install": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Install a single Workbench component by id (e.g. `node`, `opencode`, `npm-mcps`, `skills`) on a target; `component` must be an id from describe_workbench. Overwrites that component's files when present (e.g. `skills`/`plugins` replace the copies under `<home>/.config/opencode`); global installs need write permission and can take minutes. Idempotent and consent-gated: without `confirm:true` it returns the plan. Parameter semantics: `component` is required; `workspace` defaults to `~/opencode-workbench`; `confirm` defaults to false (plan only). Use it for one targeted component; use apply_clone to install the full default set.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • remove_componentUninstall one Workbench component by id from a target — the inverse of install_component — for a bounded, documented subset with an automated uninstall (e.g.No findings

    Why it is in this group

    • The name "remove_component" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Uninstall one Workbench component by id from a target — the inverse of install_component — for a bounded, documented subset with an automated uninstall (e.g. `opencode`, `pnpm`, `npm-mcps`, `skills`, `docker-containers`); `component` must be an id from describe_workbench. Idempotent: an already-absent component reports `absent`; a component with no automated uninstall (system packages such as git/curl/node) reports `manual`. Destructive and consent-gated: without `confirm:true` it returns a preview and changes nothing, and it deletes only that component's files — never `opencode.json` or the profile repo. Parameter semantics: `workspace` sets the profile path some removals need; `dryRun` reports without changing. Use it to tear down one component; for several, call it per id.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • update_componentUpdate one Workbench component in place by id: re-run its install script to fetch the current version (e.g.No findings

    Why it is in this group

    • The name "update_component" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update one Workbench component in place by id: re-run its install script to fetch the current version (e.g. `opencode` re-runs the official installer; `npm-mcps` reinstalls the latest globals). It OVERWRITES the component's files, needs write permission, and can take minutes for global installs; the resolved version may change. Parameter semantics: `component` must be an id from describe_workbench; `workspace` defaults to `~/opencode-workbench`; `dryRun` previews; `confirm` defaults to false — set `confirm:true` to apply. For the whole profile use apply_clone.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 2Claude Code: ask
  • run_auth_flowReturn the acquisition plan for one credential on a target: the provider URL, the exact non-interactive command when one exists (e.g.4 findings

    Why it is in this group

    • The name "run_auth_flow" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The title mentions "credential".

      Matched text

      title: "Acquire one credential (best-effort)"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Return the acquisition plan for one credential on a target: the provider URL, the exac..."

      What this check looks for
    • Info

      The input schema at properties.var.description mentions "Credential".

      Matched text

      inputSchema.properties.var.description: "Credential env var name from list_required_credent..."

      What this check looks for
    • Warn

      The server marks "run_auth_flow" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "run_auth_flow" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Return the acquisition plan for one credential on a target: the provider URL, the exact non-interactive command when one exists (e.g. `opencode auth login`, `opencode mcp auth vercel`, `gh auth login`), and whether it is already present. Read-only and value-blind: it emits guidance and re-checks presence with one read-only probe; it does not run the commands or handle secret values. Parameter semantics: `var` must be an env var name returned by list_required_credentials (unknown names error); `target` selects the machine and its `home` is where the value should be written. Use it for a single credential; it does not replace that listing.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: true
  • verify_cloneRe-check a target after a clone: return a per-component `present`/`missing` list plus whether `opencode.json` and `~/.env.workbench` exist.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • High

      The description refers to "~/.env.workbench".

      Matched text

      description: "...list plus whether `opencode.json` and `~/.env.workbench` exist. Read-only and idempotent: it ru..."

      What this check looks for
    Description, as the server wrote it
    Re-check a target after a clone: return a per-component `present`/`missing` list plus whether `opencode.json` and `~/.env.workbench` exist. Read-only and idempotent: it runs a detection probe (SSH or local) and checks files, writing nothing. `target` selects the machine (`local` or SSH) and its `home` is where the `opencode.json` and `~/.env.workbench` checks run; `components` restricts the check to those ids (omit it to check every component, the default); `workspace` sets the profile path used by component checks. Use it after apply_clone and after component changes; for a pre-clone preview use plan_clone.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: true
Only reads 4Claude Code: allow
  • describe_workbenchDescribe this MCP server from its bundled profile without contacting any target or making a network call: repository URL, the default component set, components grouped by tier (req…No findings

    Why it is in this group

    • The name "describe_workbench" says "describe": a word for reading.
    Description, as the server wrote it
    Describe this MCP server from its bundled profile without contacting any target or making a network call: repository URL, the default component set, components grouped by tier (required/core/optional), and optional MCP add-ons. It takes no parameters, is always safe, and returns instantly. Use it first to resolve a component id for install_component/remove_component/update_component or to see available add-ons; use inspect_target for a machine's live state.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
  • inspect_targetProbe one Linux machine — this host (`local`) or a remote host over SSH (`ssh`) — and report its OS, kernel, architecture, package manager, Node/npm, OpenCode, Docker, and per-tool…1 finding

    Why it is in this group

    • The name "inspect_target" says "inspect": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...flags, plus the names (never values) of credentials present. Read-only: it runs one shell p..."

      What this check looks for
    Description, as the server wrote it
    Probe one Linux machine — this host (`local`) or a remote host over SSH (`ssh`) — and report its OS, kernel, architecture, package manager, Node/npm, OpenCode, Docker, and per-tool detection flags, plus the names (never values) of credentials present. Read-only: it runs one shell probe as the target user (over SSH when `mode:ssh`), installs nothing, writes nothing, contacts no external service, and can take a few seconds per hop. Parameter semantics: `target.mode` selects local vs ssh (default `local`); `target.host` is required only for ssh; `target.user` defaults to the ssh config/current user; `target.cwd` sets the directory for relative checks; `target.port`/`identityFile` pass straight to ssh. Use it to see what a clone would touch, then plan_clone to turn that into an ordered plan and apply_clone to perform it.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: true
  • list_required_credentialsList the credentials the profile references, which the target already provides, and how to acquire each missing one.2 findings

    Why it is in this group

    • The name "list_required_credentials" says "list": a word for reading.

    Findings

    Description, as the server wrote it
    List the credentials the profile references, which the target already provides, and how to acquire each missing one. Value-blind: it reads only whether each env var is set — no values, no network, no writes — via one read-only probe. Parameter semantics: `target` selects the machine (`local` or SSH) and its `home` sets the returned `template` path and the env file the presence check reads; there are no other parameters. Returns `present`/`missing` var-name arrays plus one guidance record per credential (`var`, `purpose`, `url`, `method`, `command`). Use it after plan_clone to see what would degrade; act on one credential with run_auth_flow.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: true
  • plan_cloneReturn a read-only plan for a target: compare it against the Workbench profile and list each component as `install`, `present`, or `manual`, with the commands that would run.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return a read-only plan for a target: compare it against the Workbench profile and list each component as `install`, `present`, or `manual`, with the commands that would run. It still runs a detection probe on the target (same access as inspect_target) but clones nothing and writes nothing. Parameter semantics: `components` restricts the diff to those ids (default: required+core); `workspace` sets the expected profile path on the target (default `~/opencode-workbench`); `profileUrl` overrides the git remote. Use it to preview before apply_clone, which performs the changes.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 4.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http opencode-workbench https://opencode-workbench.simonmak.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__opencode-workbench__describe_workbench",
      "mcp__opencode-workbench__inspect_target",
      "mcp__opencode-workbench__plan_clone",
      "mcp__opencode-workbench__list_required_credentials"
    ],
    "ask": [
      "mcp__opencode-workbench__verify_clone",
      "mcp__opencode-workbench__run_auth_flow"
    ],
    "deny": [
      "mcp__opencode-workbench__apply_clone",
      "mcp__opencode-workbench__install_component",
      "mcp__opencode-workbench__remove_component",
      "mcp__opencode-workbench__update_component"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as opencode-workbench. Review it before you use it.