
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
opencode-codebase-index
Advanced tools
Semantic codebase indexing and search for OpenCode - find code by meaning, not just keywords
Stop grepping for concepts. Start searching for meaning.
opencode-codebase-index brings semantic understanding to your OpenCode workflow. Instead of guessing function names or grepping for keywords, ask your codebase questions in plain English.
check_creds.tree-sitter and usearch. Incremental updates take milliseconds.Install the plugin
npm install opencode-codebase-index
Add to opencode.json
{
"plugin": ["opencode-codebase-index"]
}
Start Searching Load OpenCode and ask:
"Find the function that handles credit card validation errors"
The plugin will automatically index your codebase on the first run.
Scenario: You're new to a codebase and need to fix a bug in the payment flow.
Without Plugin (grep):
grep "payment" . → 500 results (too many)grep "card" . → 200 results (mostly UI)grep "stripe" . → 50 results (maybe?)With opencode-codebase-index:
You ask: "Where is the payment validation logic?"
Plugin returns:
src/services/billing.ts:45 (Class PaymentValidator)
src/utils/stripe.ts:12 (Function validateCardToken)
src/api/checkout.ts:89 (Route handler for /pay)
| Scenario | Tool | Why |
|---|---|---|
| Don't know the function name | codebase_search | Semantic search finds by meaning |
| Exploring unfamiliar codebase | codebase_search | Discovers related code across files |
| Know exact identifier | grep | Faster, finds all occurrences |
| Need ALL matches | grep | Semantic returns top N only |
| Mixed discovery + precision | /find (hybrid) | Best of both worlds |
Rule of thumb: Semantic search for discovery → grep for precision.
graph TD
subgraph Indexing
A[Source Code] -->|Tree-sitter| B[Semantic Chunks]
B -->|Embedding Model| C[Vectors]
C -->|uSearch| D[(Local Vector Store)]
end
subgraph Searching
Q[User Query] -->|Embedding Model| V[Query Vector]
V -->|Cosine Similarity| D
D --> R[Ranked Results]
end
tree-sitter to intelligently parse your code into meaningful blocks (functions, classes, interfaces).usearch.Performance characteristics:
The plugin exposes these tools to the OpenCode agent:
codebase_searchThe primary tool. Searches code by describing behavior.
"find the middleware that sanitizes input"Writing good queries:
| ✅ Good queries (describe behavior) | ❌ Bad queries (too vague) |
|---|---|
| "function that validates email format" | "email" |
| "error handling for failed API calls" | "error" |
| "middleware that checks authentication" | "auth middleware" |
| "code that calculates shipping costs" | "shipping" |
| "where user permissions are checked" | "permissions" |
index_codebaseManually trigger indexing.
force (rebuild all), estimateOnly (check costs).index_statusChecks if the index is ready and healthy.
index_health_checkMaintenance tool to remove stale entries from deleted files.
For easier access, you can add slash commands to your project.
Copy the commands:
cp -r node_modules/opencode-codebase-index/commands/* .opencode/command/
| Command | Description |
|---|---|
/search <query> | Pure Semantic Search. Best for "How does X work?" |
/find <query> | Hybrid Search. Combines semantic search + grep. Best for "Find usage of X". |
/index | Update Index. Forces a refresh of the codebase index. |
Zero-config by default (uses auto mode). Customize in .opencode/codebase-index.json:
{
"embeddingProvider": "auto",
"scope": "project",
"indexing": {
"autoIndex": false,
"watchFiles": true,
"maxFileSize": 1048576
},
"search": {
"maxResults": 20,
"minScore": 0.1,
"hybridWeight": 0.5,
"contextLines": 0
}
}
| Option | Default | Description |
|---|---|---|
embeddingProvider | "auto" | Which AI to use: auto, github-copilot, openai, google, ollama |
scope | "project" | project = index per repo, global = shared index across repos |
| indexing | ||
autoIndex | false | Automatically index on plugin load |
watchFiles | true | Re-index when files change |
maxFileSize | 1048576 | Skip files larger than this (bytes). Default: 1MB |
| search | ||
maxResults | 20 | Maximum results to return |
minScore | 0.1 | Minimum similarity score (0-1). Lower = more results |
hybridWeight | 0.5 | Balance between keyword (1.0) and semantic (0.0) search |
contextLines | 0 | Extra lines to include before/after each match |
The plugin automatically detects available credentials in this order:
nomic-embed-text)Be aware of these characteristics:
| Aspect | Reality |
|---|---|
| Search latency | ~800-1000ms per query (embedding API call) |
| First index | Takes time depending on codebase size (e.g., ~30s for 500 chunks) |
| Requires API | Needs an embedding provider (Copilot, OpenAI, Google, or local Ollama) |
| Token costs | Uses embedding tokens (free with Copilot, minimal with others) |
| Best for | Discovery and exploration, not exhaustive matching |
Build:
npm run build
Deploy to OpenCode Cache:
# Deploy script
rm -rf ~/.cache/opencode/node_modules/opencode-codebase-index
mkdir -p ~/.cache/opencode/node_modules/opencode-codebase-index
cp -R dist native commands skill package.json ~/.cache/opencode/node_modules/opencode-codebase-index/
Register in Test Project:
mkdir -p .opencode/plugin
echo 'export { default } from "$HOME/.cache/opencode/node_modules/opencode-codebase-index/dist/index.js"' > .opencode/plugin/codebase-index.ts
git checkout -b feature/my-featurenpm run build && npm run test:run && npm run lintgit commit -m "feat: add my feature"CI will automatically run tests and type checking on your PR.
├── src/
│ ├── index.ts # Plugin entry point
│ ├── config/ # Configuration schema
│ ├── embeddings/ # Provider detection and API calls
│ ├── indexer/ # Core indexing logic + inverted index
│ ├── tools/ # OpenCode tool definitions
│ ├── utils/ # File collection, cost estimation
│ ├── native/ # Rust native module wrapper
│ └── watcher/ # File change watcher
├── native/
│ └── src/ # Rust: tree-sitter, usearch, xxhash
├── tests/ # Unit tests (vitest)
├── commands/ # Slash command definitions
├── skill/ # Agent skill guidance
└── .github/workflows/ # CI/CD (test, build, publish)
The Rust native module handles performance-critical operations:
Rebuild with: npm run build:native (requires Rust toolchain)
MIT
FAQs
Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling
The npm package opencode-codebase-index receives a total of 579 weekly downloads. As such, opencode-codebase-index popularity was classified as not popular.
We found that opencode-codebase-index demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.