What one command wires
Wire opencode to Vulnetix. Skills install to ~/.config/opencode/skills and the MCP server answers with live data from a database aggregating 150+ sources.
vulnetix agent install --agent opencode- Agent Skills: supported —
~/.config/opencode/skills - Dependency guard: not wired by the installer —
hook contract not yet verified - MCP server: supported —
https://mcp.vulnetix.com/mcp
Where opencode reads skills
Agent Skills is an open standard, but hosts disagree about the directory. The installer writes the one opencode actually opens.
- Everywhere, for you:
~/.config/opencode/skills - This repository:
.opencode/skills
Add the MCP server
opencode mcp add vulnetix \
--url https://mcp.vulnetix.com/mcp \
--header "Authorization: ApiKey $VULNETIX_ORG:$VULNETIX_KEY"True of opencode specifically
- `opencode run --format json` makes the whole surface scriptable in CI.
The ordinary case: nothing is wrong
Across 33 everyday commands the guard produced no output at all. Silence when the policy is satisfied is what makes a guard liveable; one that comments on every install gets switched off.
$
npm install
(no output — a lockfile install adds nothing new)
$
npm i left-pad
(no output — clean package, nothing to say)
$
git commit -m "add http client"
(no output)
19 ms per tool call. 0 of 33 everyday commands
produced a single line.