
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
opencode-bioresearcher
Advanced tools
Biomedical research plugin for OpenCode: biomcp MCP server tools, scientific plotting skills, and deep-research subagent
connector/opencode/ is the OpenCode flavor of this package, providing an
automatic plugin and connector bundle for the OpenCode AI coding agent
(CLI, TUI, and desktop).
A single biomcp stdio MCP server (pinned biomcp@1.4.0, 120 s connection
timeout, automatic China mirror fallback) plus four bundled skills and the
bioresearcher-dr-worker subagent:
| Bundled | Not bundled |
|---|---|
| bioresearcher-deep-research | bioresearcher-onboard |
| bioresearcher-plot-making | |
| bioresearcher-pubmed-weekly | |
| bioresearcher-python-setup-uv |
bioresearcher-onboard is excluded on purpose: its purpose — installing and
registering the biomcp server in harness configs — is exactly what the plugin's
config hook already performs automatically on startup.
The bundled skill list is defined in connector/opencode/skill-bundle.json.
The plugin entry point (index.js) exports an OpenCode Plugin factory function.
On startup, OpenCode executes its config lifecycle hook:
mcp.biomcp into OpenCode's
active configuration (type: "local", command npx -y -p biomcp@1.4.0 biomcp,
timeout 120000 ms). OpenCode spawns the server, completes the MCP handshake,
and exposes its 41 tools under the biomcp_<tool> namespace. Existing
user-configured biomcp servers are respected and not overwritten.skills/
directory to cfg.skills.paths.agent["bioresearcher-dr-worker"] with
mode: "subagent", aspect worker prompt, and permissions (bash: "deny",
task: "deny").node scripts/ci/build-connector-opencode.mjs # dist/
node scripts/ci/build-connector-opencode.mjs --out DIR
Stages dist/bioresearcher/ (root dir inside the tarball) and writes a
reproducible dist/bioresearcher-connector_opencode-v<VERSION>.tar.gz (GNU tar
--sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner piped through
gzip -n). CI runs this build script as a smoke gate (.github/workflows/ci.yml),
and the release workflow attaches the tarball to every GitHub release.
connector-meta.json and package.json version must equal the repo VERSION
(Series 1, manifest-governed via scripts/ci/version-coupling.json and enforced by
scripts/ci/check-drift.mjs). Release PRs bump them in unison with VERSION.
Users can install the plugin through any of the following methods:
Declare opencode-bioresearcher in your project or global opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": [
"opencode-bioresearcher"
]
}
OpenCode automatically installs and loads the plugin from npm on startup.
opencode plugin opencode-bioresearcher # Local project scope
opencode plugin -g opencode-bioresearcher # Global scope (~/.config/opencode)
Or from an extracted release tarball:
tar -xzf bioresearcher-connector_opencode-v<VERSION>.tar.gz
opencode plugin ./bioresearcher # Local (project) scope
opencode plugin -g /path/to/bioresearcher # Global scope (~/.config/opencode)
.opencode/plugins/ (Offline Zero Config)tar -xzf bioresearcher-connector_opencode-v<VERSION>.tar.gz -C .opencode/plugins/
cp .opencode/plugins/bioresearcher/loader.js .opencode/plugins/bioresearcher.js
OpenCode's shallow directory scanner discovers bioresearcher.js, which imports
and activates ./bioresearcher/index.js.
FAQs
Biomedical research plugin for OpenCode: biomcp MCP server tools, scientific plotting skills, and deep-research subagent
We found that opencode-bioresearcher demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.