惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

O
OpenAI News
I
Intezer
C
CERT Recently Published Vulnerability Notes
V
Vulnerabilities – Threatpost
S
Securelist
C
Cyber Attacks, Cyber Crime and Cyber Security
G
GRAHAM CLULEY
P
Palo Alto Networks Blog
P
Privacy & Cybersecurity Law Blog
T
Tenable Blog
T
Threatpost
Latest news
Latest news
Cisco Talos Blog
Cisco Talos Blog
A
Arctic Wolf
罗磊的独立博客
云风的 BLOG
云风的 BLOG
L
LangChain Blog
博客园 - 【当耐特】
P
Privacy International News Feed
The GitHub Blog
The GitHub Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
www.infosecurity-magazine.com
www.infosecurity-magazine.com
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
T
Troy Hunt's Blog
量子位
Security Archives - TechRepublic
Security Archives - TechRepublic
爱范儿
爱范儿
S
Security @ Cisco Blogs
Martin Fowler
Martin Fowler
博客园_首页
SecWiki News
SecWiki News
Spread Privacy
Spread Privacy
I
InfoQ
博客园 - 司徒正美
T
Tor Project blog
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
H
Help Net Security
L
LINUX DO - 最新话题
H
Heimdal Security Blog
TaoSecurity Blog
TaoSecurity Blog
Hacker News - Newest:
Hacker News - Newest: "LLM"
Vercel News
Vercel News
Y
Y Combinator Blog
D
DataBreaches.Net
T
Threat Research - Cisco Blogs
Stack Overflow Blog
Stack Overflow Blog
C
CXSECURITY Database RSS Feed - CXSecurity.com
M
MIT News - Artificial intelligence
Recorded Future
Recorded Future
博客园 - 叶小钗

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
OpenCode 的 5 个隐藏用法:17.8 万 Star 终端 AI 代理,会话中随意切换提供商
· 2026-06-25 · via DEV Community

韩

你知道吗?你的终端 AI 代理其实可以无缝切换 30+ 个 LLM 提供商、运行隔离的后台任务、从 npm 加载自定义插件,还能通过 OAuth 认证连接 GitHub 和 Slack —— 这一切只需一次 npm install

OpenCode 是一个拥有 178,218 Stars 的开源 AI 编程代理,用 TypeScript 构建。它在 2026 年 3 月突破了 1,274 票的程序员新闻(Hacker News)讨论度,最新版本(v1.17.10,2026 年 6 月 24 发布)新增了 MCP 资源模板、OAuth 绑定回调和新版 --mini CLI 模式。大多数人把它当作终端里的 Claude Code 替代品 —— 但深入了解后你会发现,它的插件生态、多代理架构和提供商抽象层远超普通自动补全工具。

在 2026 年 AI 编程工具的格局中,Cursor、Claude Code、Codex CLI 和 Goose 都在争夺开发者的注意力。OpenCode 之所以脱颖而出,是因为它采用 MIT 完全开源、提供商无关(支持 30+ 提供商包括自托管)、并围绕可扩展的插件 + 技能 + MCP 架构搭建。以下是大多数人忽略的五个隐藏用法。

隐藏用法 #1:多提供商故障转移 + 自定义提供商

大多数人的用法: 只用单个 API 密钥 —— Anthropic 或 OpenAI。

隐藏技巧: OpenCode 的提供商插件系统原生支持 30+ 提供商,包括 Anthropic、OpenAI、Google、DeepSeek、Mistral、Groq、TogetherAI、OpenRouter、GitHub Copilot、GitLab、Snowflake Cortex 等。你可以配置多个提供商和不同模型,用 /model 命令在会话中随时切换。更妙的是,你可以添加指向自托管模型的自定义 OpenAI 兼容提供商(Ollama、vLLM、LM Studio)。

# 配置 OpenCode 连接本地 Ollama 提供商
opencode config set providers.ollama.baseUrl "http://localhost:11434/v1"
opencode config set providers.ollama.models '[{"id":"llama3.3","name":"Llama 3.3 70B"}]'

# 在会话中切换提供商
# 输入: /model ollama/llama3.3
# 或者: /model anthropic/claude-sonnet-4-20250514

效果: 你的编程代理变成了提供商无关的。当 Anthropic 触发速率限制时,切换到 DeepSeek。需要便宜的探索模型时,用 Groq。需要在本地部署时,指向 Ollama 实例 —— 所有操作都不需要离开当前会话。

数据来源: OpenCode GitHub 178,218 Stars,HN 1,274 pts/618 评论(story 47460525),30+ 提供商插件从仓库目录树确认(packages/core/src/plugin/provider/*.ts)。

隐藏用法 #2:插件生态 —— 用 npm 包扩展代理能力

大多数人的用法: 直接用 OpenCode 的内置功能。

隐藏技巧: OpenCode 拥有完整的插件系统。你可以从 npm 包安装插件,从目录加载自定义插件,或自己编写。插件可以添加自定义代理、命令、提供商、甚至注入系统上下文。插件生命周期支持安装、加载、热重载和沙箱隔离。

# 从 npm 安装插件
opencode plugin install @my-org/opencode-custom-agent

# 从本地目录加载插件
opencode --plugin ./my-custom-plugin/

# 列出已安装插件
opencode plugin list

插件用 TypeScript 编写,可以注册:

  • 自定义代理(拥有独立系统提示和工具集)
  • 自定义斜杠命令(如 /review-pr/deploy-staging
  • 自定义 LLM 提供商(指向任意 OpenAI 兼容 API)
  • 自定义工具(通过 MCP 服务器集成)

效果: 你可以用领域特定能力扩展 OpenCode —— 一个了解数据库架构的 /run-migrations 命令、一个针对你团队规范调整过的代码审查代理、或一个封装 CI/CD 工具的部署插件。

数据来源: OpenCode v1.17.10 发布说明(2026-06-24),插件系统从仓库目录树确认(packages/plugin/src/v2/, packages/core/src/plugin/)。

隐藏用法 #3:MCP OAuth —— 与外部服务的认证工具调用

大多数人的用法: 使用没有认证或静态 API 密钥直接粘贴到配置的 MCP 服务器。

隐藏技巧: OpenCode 支持完整的 MCP OAuth 流程。当你连接需要 OAuth 的 MCP 服务器(如 GitHub、Slack、Jira)时,OpenCode 会打开浏览器进行 OAuth 认证,在 IPv4 回环服务器上处理回调(v1.17.10 中为安全起见绑定),并自动管理令牌刷新。这意味着你可以通过自然语言在终端中使用 GitHub 的 MCP 服务器来创建 Issue、阅读 PR 和管理仓库。

# 添加支持 OAuth 的 MCP 服务器
opencode mcp add github --url https://api.github.com/mcp

# OpenCode 会在浏览器中提示 OAuth 登录
# 认证后,你可以说:
# "从当前分支创建一个标题为 'Fix auth bug' 的 PR 到 main"
# "列出所有分配给我的未关闭 Issue"

效果: 你的终端代理成为了连接外部服务的桥梁,拥有正确的认证机制。不再需要在配置文件中粘贴令牌 —— OAuth 安全地处理一切,并自动刷新。

数据来源: OpenCode v1.17.10 发布说明 —— "将 MCP OAuth 回调绑定到 IPv4 回环以提高本地认证可靠性"(@he-yufeng),MCP 认证系统见 packages/opencode/src/mcp/auth.ts。

隐藏用法 #4:规划/构建双代理架构 + 后台子代理

大多数人的用法: 一直用默认的 "build" 代理做所有事。

隐藏技巧: OpenCode 内置两个代理:build(完全访问权限,默认)和 plan(只读模式,运行命令前请求权限)。你可以用 Tab 键在它们之间切换。Plan 代理非常适合探索不熟悉的代码库、分析架构或规划重构 —— 而且不会有意外编辑的风险。此外,OpenCode 支持后台并行运行的子代理。你可以派一个 @general 子代理做复杂搜索,同时继续在主会话中写代码。

# 启动 OpenCode
opencode

# 按 Tab 切换 build 和 plan 代理
# 在 plan 代理中: "分析这个代码库的认证流程"
# 在 build 代理中: "重构 auth 模块使用新的 token 格式"

# 派后台子代理做并行工作
# 输入: @general 搜索所有与错误处理相关的 TODO 项
# 子代理工作时你继续写代码

效果: Plan 代理充当安全的探索模式 —— 你可以把它交给初级开发者,或在 CI 管道中使用(只需要分析不需要修改)。后台子代理让你能并行进行研究和编码,有效地将终端变成多代理工作空间。

数据来源: OpenCode README(dev 分支)—— "build 代理(完全访问)/ plan 代理(只读,请求权限)",HN 319pts 讨论 "Opencode: AI coding agent, built for the terminal"(id 44482504)。

隐藏用法 #5:技能系统 —— 用可复用的提示模板替代重复输入

大多数人的用法: 反复输入相同的指令("写测试"、"审查这个 PR"、"检查安全问题")。

隐藏技巧: OpenCode 拥有内置的技能系统。技能是存放在 .opencode/skills/ 中的 Markdown 文件(.md),定义可复用的提示模板。你调用 /skill-name 即可使用,它们支持前置元数据配置以便自定义。OpenCode 内置了 customize-opencodeeffect 等技能,你也可以创建自己的。

# .opencode/skills/review-security.md
---
name: review-security
description: "安全导向的代码审查"
tools: [read, list, grep]
---

审查当前文件的安全漏洞:
1. 检查 SQL 注入模式
2. 查找硬编码的密钥或 API 密钥
3. 验证所有面向用户的端点的输入校验
4. 标记任何 eval() 或动态导入的使用

# 调用自定义技能
/review-security

# 或使用内置技能
/customize-opencode  # OpenCode 自己的配置向导

效果: 技能将重复的指令变成可分享、版本控制的模板。你的团队可以在仓库中维护一套技能库,团队中的每个开发者都能获得一致的行为 —— 不再需要复制粘贴提示词或在代码审查中遗漏步骤。

数据来源: OpenCode 仓库目录树 —— .opencode/skills/effect/SKILL.mdpackages/core/src/skill/*packages/opencode/src/skill/discovery.ts,v1.17.10 发布说明中提到技能基础目录。


总结:OpenCode 的 5 个隐藏用法

  1. 多提供商故障转移 —— 在 30+ LLM 提供商之间随时切换,包括自托管模型
  2. 插件生态 —— 用 npm 包、自定义代理和领域特定命令扩展代理能力
  3. MCP OAuth —— 通过浏览器 OAuth 流程认证外部服务(GitHub、Slack、Jira)
  4. 规划/构建架构 —— 用只读规划代理安全探索,用后台子代理并行工作
  5. 技能系统 —— 创建可复用、版本控制的提示模板,实现团队一致的工作流

系列回顾

如果你喜欢这篇文章,欢迎阅读"5 个隐藏用法"系列的前作:


你有没有发现 OpenCode 的隐藏用法 —— 一个插件、技能或大多数人不知道的工作流?欢迎在评论区分享!