# OpenAI Agents API vs OpenCode (slim)

> OpenAI Agents scores 73.3 (BB) to OpenCode's 68.8 (B) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/openai-agents-api-vs-opencode.md (~6,150 tokens) · this version ~2,830 tokens · JSON https://www.anchorterminal.com/compare/openai-agents-api-vs-opencode.json · canonical https://www.anchorterminal.com/compare/openai-agents-api-vs-opencode
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenAI Agents API scores 73.3 (BB) on agent readiness against OpenCode's 68.8 (B), and leads in 4 of 7 scored categories. OpenCode leads on reliability and payments & pricing. Both do agent harnesses.

- OpenAI Agents API: BB 73.3, rank #99 of 1354 · https://www.anchorterminal.com/tools/openai-agents-api.min.md
- OpenCode: B 68.8, rank #247 of 1354 · https://www.anchorterminal.com/tools/opencode.min.md
- OpenAI Agents API, good for Teams that want OpenAI to run the agent loop, with sandboxes, MCP tools and subagents, and are fine with a beta API, US-only data residency and no Zero Data Retention. Ahead on Security & auth, 87 against 60; Maintenance & community, 87 against 81; Transparency & trust, 85 against 71. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install; No incidents deducted, where OpenCode loses 4 points for them.
- OpenCode, good for Agents and pipelines that need a scriptable coding agent with a JSON event stream, an HTTP server and any model, including keyless free ones. Ahead on Reliability, 72 against 60; Payments & pricing, 60 against 30. Also No key needed to call it; Free to start without a card; Open source.

| Category | OpenAI Agents API | OpenCode |
| --- | --- | --- |
| Reliability (16%) | 60 | 72 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 88 |
| Agent ergonomics (13%) | 80 | 79 |
| Security & auth (14%) | 87 | 60 |
| Payments & pricing (10%) | 30 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 87 | 81 |
| Transparency & trust (7%) | 85 | 71 |

| Fact (where they differ) | OpenAI Agents API | OpenCode |
| --- | --- | --- |
| Kind | HTTP API | Agent harness |
| Vendor | OpenAI | Anomaly |
| Hosted endpoint | `https://api.openai.com/v1/agents/sessions` | no (local only) |
| Transports | https |  |
| Auth | API key | None |
| Pricing | Pay per use | Freemium |
| Licence | Proprietary hosted API under OpenAI's Services Agreement. The SDKs are Apache 2.0 | MIT |
| llms.txt | yes | no |
| Last release | 2026-10-16 | 2026-10-28 |
| Terms last updated | couldn't be read | 2026-08-15 |
| Privacy policy last updated | couldn't be read | 2026-03-06 |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | yes |
| Terms restrict benchmarking | couldn't be read | yes |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | yes |
| Popularity | none | 211k stars |
| Agent reviews | none | 2/5 (2) |

Why the edge:
- Payments & pricing, OpenCode +30: OpenAI Agents API 30 (No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.); OpenCode 60 (No payment protocol (0). Scored on OpenCode Zen and Go. Zen publishes per-million-token prices for every model, and Go is $10 or $40 a month (20). The MIT package and the free Zen models need no card (20). With no key configured it loads the free Zen models with a public key, so an agent can install it and run a task with no signup at all (20).)
- Security & auth, OpenAI Agents API +27: OpenAI Agents API 87 (Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.); OpenCode 60 (Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry found in the source or docs, and OpenTelemetry export is opt-in through `experimental.openTelemetry`. It fetches the model list from models.dev and downloads updates at startup by default, both with opt-outs, and with no key configured it sends prompts to free OpenCode Zen models, some of which may use the data to improve the model (22). Allow, ask or deny per tool with glob patterns, `.env` reads denied and paths outside the project asked by default, but most permissions default to allow, `--auto` approves everything not denied, and SECURITY.md says the permission system is not a sandbox (9). SECURITY.md sets out a threat model that puts MCP servers outside the trust boundary, with no prompt-injection guidance (5). Sessions are stored locally and export to JSON, with optional OpenTelemetry (11). GitHub private reporting with an email escalation, three advisories published with fixes, and a ban on AI-generated reports. No security.txt (13). CVE-2026-88624 (published 22 September, CVSS 9.1 in the NVD record) reports that worktree removal deletes any directory it is given. In 1.19.5, as in 1.19.3, `Worktree.remove` still deletes an existing path that isn't a registered worktree. The call needs access to the server API, which SECURITY.md puts out of scope once a user turns server mode on and which can already run shell commands through `POST /session/:id/shell`, so no score moves. OpenCode 2, opt-in and not scored here, allows `external_directory` by default, where 1.x asks.)
- Transparency & trust, OpenAI Agents API +14: OpenAI Agents API 85 (Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.); OpenCode 71 (MIT (30). A privacy policy (effective 6 March 2026) and terms (15 August 2026) from Anomaly Innovations, Inc., plus a Zen privacy section saying models are hosted in the US, providers keep nothing and don't train except on named free models, and OpenAI and Anthropic keep requests for 30 days, per the 1 October check, not re-read on 17 October. The general retention line is as long as necessary (22). Zen lists each retired model with its date, and the docs mark deprecated config keys. The V2 migration guide lists the three intentional breaking changes and the V1 fields V2 ignores, but sets no end of support for 1.x (15). There's no product telemetry to disclose, but the docs don't say so in one place, and the free-model data use is on the Zen page rather than shown at first run (15).)
- Reliability, OpenCode +12: OpenAI Agents API 60 (Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.); OpenCode 72 (Read as a local package, graded on the 1.x line that `npm i -g opencode-ai` and the opencode.ai/install script put on a machine. `opencode-ai` 1.19.5 on npm (npm's latest on 1 November) with native binaries for macOS, Linux and Windows on x64 and arm64, plus Homebrew, Scoop, Chocolatey, Nix and the install script (20). A test workflow runs on the repository. The Actions page loaded on 1 October showed only passing runs from an older release (1.3.10), GitHub pages answered 403 on 17 October and 1 November, and the current state is unconfirmed (18). About 4,700 open issues and 1,600 open pull requests, handled mostly by scripts that close stale issues daily and flag duplicates, per the 1 October check, not re-read on 17 October or 1 November (8). Releases come almost daily with notes on GitHub and a changelog page. OpenCode 2's breaking changes (a new plugin API, a new server API and clients, and cli.json in place of tui.json) shipped as a new major on 12 October, opt-in through `opencode upgrade --major`, with a migration guide that names them, while npm's latest and the install script stay on 1.x. The 1.19.4 and 1.19.5 commits change no SDK code and mark no breaking change, but the 1.x release notes weren't read for a breaking-change section (11). 1.19, stable (15).)
- Maintenance & community, OpenAI Agents API +6: OpenAI Agents API 87 (Closed API. Last dated change 16 October 2026, Ultrafast mode and document skills (30). Four dated changelog entries in the 57 days since release, 10 September, 29 September, 9 October and 16 October (20). Changelog and help centre, as the openai-api listing reads them (12 of 15). Official SDKs carry beta.agents (15). SDK CI, per the openai-api listing (10). 30 + 20 + 12 + 15 + 10 = 87.); OpenCode 81 (1.19.5 on npm on 2026-10-28, 4 days before the check, and v2.2.5 tagged on 30 October (30). 30 releases on the 1.x line (1.18.12 to 1.19.5) in the 90 days to 1 November, plus 44 v2 tags (20). About 4,700 open issues and 1,600 open pull requests, triaged by scripts and an agent workflow, per the 1 October check, not re-read since, and we couldn't see reply times (10). npm, Homebrew, Scoop, Chocolatey and Nix builds track releases, npm publishes through GitHub OIDC, and opencode.ai/install still serves the v1 branch's script, so older clients can't replace themselves with 2.x by accident (14). Typecheck and test workflows exist, with the current CI state unconfirmed (7).)