
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
opencode-codebase-index
Advanced tools
Semantic codebase indexing and search for OpenCode - find code by meaning, not just keywords
Stop grepping for concepts. Start searching for meaning.
opencode-codebase-index brings semantic understanding to your OpenCode workflow. Instead of guessing function names or grepping for keywords, ask your codebase questions in plain English.
check_creds.tree-sitter and usearch. Incremental updates take milliseconds.Install the plugin
npm install opencode-codebase-index
Add to opencode.json
{
"plugin": ["opencode-codebase-index"]
}
Index your codebase
Run /index or ask the agent to index your codebase. This only needs to be done once — subsequent updates are incremental.
Start Searching Ask:
"Find the function that handles credit card validation errors"
Scenario: You're new to a codebase and need to fix a bug in the payment flow.
Without Plugin (grep):
grep "payment" . → 500 results (too many)grep "card" . → 200 results (mostly UI)grep "stripe" . → 50 results (maybe?)With opencode-codebase-index:
You ask: "Where is the payment validation logic?"
Plugin returns:
src/services/billing.ts:45 (Class PaymentValidator)
src/utils/stripe.ts:12 (Function validateCardToken)
src/api/checkout.ts:89 (Route handler for /pay)
| Scenario | Tool | Why |
|---|---|---|
| Don't know the function name | codebase_search | Semantic search finds by meaning |
| Exploring unfamiliar codebase | codebase_search | Discovers related code across files |
| Know exact identifier | grep | Faster, finds all occurrences |
| Need ALL matches | grep | Semantic returns top N only |
| Mixed discovery + precision | /find (hybrid) | Best of both worlds |
Rule of thumb: Semantic search for discovery → grep for precision.
In our testing across open-source codebases (axios, express), we observed up to 90% reduction in token usage for conceptual queries like "find the error handling middleware".
graph TD
subgraph Indexing
A[Source Code] -->|Tree-sitter| B[Semantic Chunks]
B -->|Embedding Model| C[Vectors]
C -->|uSearch| D[(Vector Store)]
C -->|SQLite| G[(Embeddings DB)]
B -->|BM25| E[(Inverted Index)]
B -->|Branch Catalog| G
end
subgraph Searching
Q[User Query] -->|Embedding Model| V[Query Vector]
V -->|Cosine Similarity| D
Q -->|BM25| E
G -->|Branch Filter| F
D --> F[Hybrid Fusion]
E --> F
F --> R[Ranked Results]
end
tree-sitter to intelligently parse your code into meaningful blocks (functions, classes, interfaces). JSDoc comments and docstrings are automatically included with their associated code.usearch with F16 quantization for 50% memory savings. A branch catalog tracks which chunks exist on each branch.Performance characteristics:
The plugin automatically detects git branches and optimizes indexing across branch switches.
When you switch branches, code changes but embeddings for unchanged content remain the same. The plugin:
| Scenario | Without Branch Awareness | With Branch Awareness |
|---|---|---|
| Switch to feature branch | Re-index everything | Instant — reuse existing embeddings |
| Return to main | Re-index everything | Instant — catalog already exists |
| Search on branch | May return stale results | Only returns current branch's code |
.git/HEAD.opencode/index/
├── codebase.db # SQLite: embeddings, chunks, branch catalog
├── vectors.usearch # Vector index (uSearch)
├── inverted-index.json # BM25 keyword index
└── file-hashes.json # File change detection
The plugin exposes these tools to the OpenCode agent:
codebase_searchThe primary tool. Searches code by describing behavior.
"find the middleware that sanitizes input"Writing good queries:
| ✅ Good queries (describe behavior) | ❌ Bad queries (too vague) |
|---|---|
| "function that validates email format" | "email" |
| "error handling for failed API calls" | "error" |
| "middleware that checks authentication" | "auth middleware" |
| "code that calculates shipping costs" | "shipping" |
| "where user permissions are checked" | "permissions" |
index_codebaseManually trigger indexing.
force (rebuild all), estimateOnly (check costs), verbose (show skipped files and parse failures).index_statusChecks if the index is ready and healthy.
index_health_checkMaintenance tool to remove stale entries from deleted files and orphaned embeddings/chunks from the database.
The plugin automatically registers these slash commands:
| Command | Description |
|---|---|
/search <query> | Pure Semantic Search. Best for "How does X work?" |
/find <query> | Hybrid Search. Combines semantic search + grep. Best for "Find usage of X". |
/index | Update Index. Forces a refresh of the codebase index. |
Zero-config by default (uses auto mode). Customize in .opencode/codebase-index.json:
{
"embeddingProvider": "auto",
"scope": "project",
"indexing": {
"autoIndex": false,
"watchFiles": true,
"maxFileSize": 1048576,
"maxChunksPerFile": 100,
"semanticOnly": false
},
"search": {
"maxResults": 20,
"minScore": 0.1,
"hybridWeight": 0.5,
"contextLines": 0
}
}
| Option | Default | Description |
|---|---|---|
embeddingProvider | "auto" | Which AI to use: auto, github-copilot, openai, google, ollama |
scope | "project" | project = index per repo, global = shared index across repos |
| indexing | ||
autoIndex | false | Automatically index on plugin load |
watchFiles | true | Re-index when files change |
maxFileSize | 1048576 | Skip files larger than this (bytes). Default: 1MB |
maxChunksPerFile | 100 | Maximum chunks to index per file (controls token costs for large files) |
semanticOnly | false | When true, only index semantic nodes (functions, classes) and skip generic blocks |
retries | 3 | Number of retry attempts for failed embedding API calls |
retryDelayMs | 1000 | Delay between retries in milliseconds |
| search | ||
maxResults | 20 | Maximum results to return |
minScore | 0.1 | Minimum similarity score (0-1). Lower = more results |
hybridWeight | 0.5 | Balance between keyword (1.0) and semantic (0.0) search |
contextLines | 0 | Extra lines to include before/after each match |
The plugin automatically detects available credentials in this order:
nomic-embed-text)Be aware of these characteristics:
| Aspect | Reality |
|---|---|
| Search latency | ~800-1000ms per query (embedding API call) |
| First index | Takes time depending on codebase size (e.g., ~30s for 500 chunks) |
| Requires API | Needs an embedding provider (Copilot, OpenAI, Google, or local Ollama) |
| Token costs | Uses embedding tokens (free with Copilot, minimal with others) |
| Best for | Discovery and exploration, not exhaustive matching |
Build:
npm run build
Register in Test Project (use file:// URL in opencode.json):
{
"plugin": [
"file:///path/to/opencode-codebase-index"
]
}
This loads directly from your source directory, so changes take effect after rebuilding.
git checkout -b feature/my-featurenpm run build && npm run test:run && npm run lintgit commit -m "feat: add my feature"CI will automatically run tests and type checking on your PR.
├── src/
│ ├── index.ts # Plugin entry point
│ ├── config/ # Configuration schema
│ ├── embeddings/ # Provider detection and API calls
│ ├── indexer/ # Core indexing logic + inverted index
│ ├── git/ # Git utilities (branch detection)
│ ├── tools/ # OpenCode tool definitions
│ ├── utils/ # File collection, cost estimation
│ ├── native/ # Rust native module wrapper
│ └── watcher/ # File/git change watcher
├── native/
│ └── src/ # Rust: tree-sitter, usearch, xxhash, SQLite
├── tests/ # Unit tests (vitest)
├── commands/ # Slash command definitions
├── skill/ # Agent skill guidance
└── .github/workflows/ # CI/CD (test, build, publish)
The Rust native module handles performance-critical operations:
Rebuild with: npm run build:native (requires Rust toolchain)
MIT
FAQs
Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling
The npm package opencode-codebase-index receives a total of 755 weekly downloads. As such, opencode-codebase-index popularity was classified as not popular.
We found that opencode-codebase-index demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.