
Security News
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
opencode-bioresearcher
Advanced tools
Biomedical research plugin for OpenCode: biomcp MCP server tools, scientific plotting skills, and deep-research subagent
connector/opencode/ is the OpenCode flavor of this package, providing an
automatic plugin and connector bundle for the OpenCode AI coding agent
(CLI, TUI, and desktop).
A single biomcp stdio MCP server (pinned biomcp@1.4.0, 120 s connection
timeout, automatic China mirror fallback) plus four bundled skills and the
bioresearcher-dr-worker subagent:
| Bundled | Not bundled |
|---|---|
| bioresearcher-deep-research | bioresearcher-onboard |
| bioresearcher-plot-making | |
| bioresearcher-pubmed-weekly | |
| bioresearcher-python-setup-uv |
bioresearcher-onboard is excluded on purpose: its purpose — installing and
registering the biomcp server in harness configs — is exactly what the plugin's
config hook already performs automatically on startup.
The bundled skill list is defined in connector/opencode/skill-bundle.json.
The plugin entry point (index.js) exports an OpenCode Plugin factory function.
On startup, OpenCode executes its config lifecycle hook:
mcp.biomcp into OpenCode's
active configuration (type: "local", command npx -y -p biomcp@1.4.0 biomcp,
timeout 120000 ms). OpenCode spawns the server, completes the MCP handshake,
and exposes its 41 tools under the biomcp_<tool> namespace. Existing
user-configured biomcp servers are respected and not overwritten.skills/
directory to cfg.skills.paths.agent["bioresearcher-dr-worker"] with
mode: "subagent", aspect worker prompt, and permissions (bash: "deny",
task: "deny").node scripts/ci/build-connector-opencode.mjs # dist/
node scripts/ci/build-connector-opencode.mjs --out DIR
Stages dist/bioresearcher/ (root dir inside the tarball) and writes a
reproducible dist/bioresearcher-connector_opencode-v<VERSION>.tar.gz (GNU tar
--sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner piped through
gzip -n). CI runs this build script as a smoke gate (.github/workflows/ci.yml),
and the release workflow attaches the tarball to every GitHub release.
connector-meta.json and package.json version must equal the repo VERSION
(Series 1, manifest-governed via scripts/ci/version-coupling.json and enforced by
scripts/ci/check-drift.mjs). Release PRs bump them in unison with VERSION.
Users can install the plugin through any of the following methods:
Declare opencode-bioresearcher in your project or global opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": [
"opencode-bioresearcher"
]
}
OpenCode automatically installs and loads the plugin from npm on startup.
opencode plugin opencode-bioresearcher # Local project scope
opencode plugin -g opencode-bioresearcher # Global scope (~/.config/opencode)
Or from an extracted release tarball:
tar -xzf bioresearcher-connector_opencode-v<VERSION>.tar.gz
opencode plugin ./bioresearcher # Local (project) scope
opencode plugin -g /path/to/bioresearcher # Global scope (~/.config/opencode)
.opencode/plugins/ (Offline Zero Config)tar -xzf bioresearcher-connector_opencode-v<VERSION>.tar.gz -C .opencode/plugins/
cp .opencode/plugins/bioresearcher/loader.js .opencode/plugins/bioresearcher.js
OpenCode's shallow directory scanner discovers bioresearcher.js, which imports
and activates ./bioresearcher/index.js.
FAQs
Biomedical research plugin for OpenCode: biomcp MCP server tools, scientific plotting skills, and deep-research subagent
We found that opencode-bioresearcher demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.