
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@vymalo/opencode-devtools
Advanced tools
OpenCode plugin of everyday developer utilities the model can call locally: math (precise arithmetic, unit & base conversion, stats), codec (base64/hex/url, JWT decode, gzip), crypto (hash/hmac, uuid/ulid, random, keypairs), datetime (parse/format/diff, t
A belt of everyday, deterministic, local developer utilities for the model — maths, encoding, crypto, date/time, structured-data conversion, and an opt-in HTTP client.
An OpenCode plugin that registers a set of pure, in-process tools the model can call — no bridge, no
server, no auth. Tools are organised into groups (gated by the groups option, like the browser
plugin): math, codec, crypto, datetime, convert (on by default) and an opt-in, SSRF-guarded
http group. The same tool surface ships as an MCP server: @vymalo/opencode-devtools-mcp.
// opencode.json
{
"plugin": ["@vymalo/opencode-devtools"]
}
Enable the http group (off by default — it performs network egress):
{
"plugin": [
["@vymalo/opencode-devtools", {
"groups": ["math", "codec", "crypto", "datetime", "convert", "http"],
"http": { "allowPrivateNetwork": false }
}]
]
}
| Group | Tools |
|---|---|
math | math_eval (64-digit), math_convert_unit, math_stats, math_base |
codec | codec_base64, codec_hex, codec_url, codec_jwt_decode, codec_gzip |
crypto | crypto_hash, crypto_hmac, crypto_uuid (v4/v7), crypto_ulid, crypto_random, crypto_keypair |
datetime | datetime_now, datetime_parse, datetime_format, datetime_diff, datetime_convert_tz, datetime_cron |
convert | convert_data (JSON/YAML/TOML/CSV), convert_query (JSONPath) |
http (opt-in) | http_request, http_graphql |
Full reference, config, and the security model: docs/devtools.md.
Those already have mature MCP servers, so we adopt them rather than rebuild — see
docs/recommended-mcps.md. devtools fills only the gaps: the small
deterministic utilities nobody else maintains well.
MIT
FAQs
OpenCode plugin of everyday developer utilities the model can call locally: math (precise arithmetic, unit & base conversion, stats), codec (base64/hex/url, JWT decode, gzip), crypto (hash/hmac, uuid/ulid, random, keypairs), datetime (parse/format/diff, t
The npm package @vymalo/opencode-devtools receives a total of 5 weekly downloads. As such, @vymalo/opencode-devtools popularity was classified as not popular.
We found that @vymalo/opencode-devtools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.