OpenCode vs Verdent

OpenCode 79

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. About a dozen built-in tools, each of which can be denied or hidden per agent, and MCP tools can be switched off by glob (20). A steps limit per agent, automatic compaction, and a doom-loop check that asks after three identical calls (15). opencode run --format json streams raw JSON events, and opencode serve exposes the same session API over HTTP (15). Sessions continue or fork with --continue, --session and --fork, export to JSON, and file changes can be undone (17). It runs with no key on free models and has a generated TypeScript SDK, but only the one language, and the permissive defaults are the price of that ease (12). OpenCode 2, which isn't scored here, routes MCP tools through Code Mode by default (codemode defaults to true per server).

Verdent 35

Harness reading. MCP servers per project or globally, subagents, skills and rules, but no per-tool disabling or deferred loading found (10). No output-size, turn-limit or budget controls for a run were found beyond credit balances (5). No exit codes or error format, since there is no headless mode (3). Parallel workers in git worktrees and a review column make runs reviewable and reversible, with no resume by ID documented (10). No CLI, API or SDK. A pipeline can only reach Manager through a paired Telegram, Slack or Feishu bot (7). 10+5+3+10+7 = 35.

OpenCode 60

No payment protocol (0). Scored on OpenCode Zen and Go. Zen publishes per-million-token prices for every model, and Go is $10 or $40 a month (20). The MIT package and the free Zen models need no card (20). With no key configured it loads the free Zen models with a public key, so an agent can install it and run a task with no signup at all (20).

Verdent 20

Harness reading of the published rubric, scored on the Verdent subscription the agent needs. No payment protocol (0). Plan prices from $5 a month, top-up prices and the credit value of about $0.059 are public without a login (20). Free Mode and the free trial ended on 29 October 2026, so there is no free tier (0). A person signs up in a browser (0). 0+20+0+0 = 20.

OpenCode 88

A JSON Schema for the config file at opencode.ai/config.json, and an OpenAPI 3.1 spec for the 1.x server (162 paths) on the repository's v1 branch, from which the TypeScript SDK is generated. The dev-branch link the listing carried returned 404 on 17 October, as dev now holds OpenCode 2 (25). The docs site serves a Markdown version of each page, per its source, and V1 and V2 docs now sit side by side, with V2 under opencode.ai/v2/docs (10). Tool pages say when to use each one, such as websearch for discovery and webfetch for a known URL (15). Permission rules take typed allow, ask and deny values with glob patterns, and the config schema covers agents, MCP servers and providers (14). Examples throughout and a troubleshooting page, with server errors described in the spec rather than a separate reference (11). A dated changelog at opencode.ai/changelog and GitHub releases (13).

Verdent 55

Framework reading for a harness. No schema for settings or output, only mcp.json examples in the standard mcpServers shape (5). Every current docs page has a Markdown twin at the same path with .md, though no llms.txt (10). The docs say when to use Agent Mode or Plan Mode and what Plan Mode can't do, but the Agent Mode page lists the actions that need approval only as "certain tool executions" and "destructive operations" (12). Modes and BYOA agent types are enumerated, permissions are not (5). Examples on the MCP, BYOA and messaging pages, and a recovery page, with no error codes (8). Version numbers and a dated public changelog (15). The archived 1.0 docs are still served beside the current ones. 5+10+12+5+8+15 = 55.

OpenCode 72

Read as a local package, graded on the 1.x line that npm i -g opencode-ai and the opencode.ai/install script put on a machine. opencode-ai 1.19.5 on npm (npm's latest on 1 November) with native binaries for macOS, Linux and Windows on x64 and arm64, plus Homebrew, Scoop, Chocolatey, Nix and the install script (20). A test workflow runs on the repository. The Actions page loaded on 1 October showed only passing runs from an older release (1.3.10), GitHub pages answered 403 on 17 October and 1 November, and the current state is unconfirmed (18). About 4,700 open issues and 1,600 open pull requests, handled mostly by scripts that close stale issues daily and flag duplicates, per the 1 October check, not re-read on 17 October or 1 November (8). Releases come almost daily with notes on GitHub and a changelog page. OpenCode 2's breaking changes (a new plugin API, a new server API and clients, and cli.json in place of tui.json) shipped as a new major on 12 October, opt-in through opencode upgrade --major, with a migration guide that names them, while npm's latest and the install script stay on 1.x. The 1.19.4 and 1.19.5 commits change no SDK code and mark no breaking change, but the 1.x release notes weren't read for a breaking-change section (11). 1.19, stable (15).

Verdent 43

Local-package reading, as for the other closed-source harnesses. The desktop app installs from verdent.ai with macOS 11 or later and 64-bit Windows 10 and 11 stated, and the extension from the editor marketplaces, but not from a package registry (15). No public CI or test suite, since the source isn't published (0). No public issue tracker, every task runs through Verdent's servers, and no status page was found, so there is no readable record (5). A dated changelog by version, with the end of Free Mode called out in v2.18.0, but no breaking-change sections (8). 2.18.0, generally available (15). 15+0+5+8+15 = 43.

OpenCode 60

Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry found in the source or docs, and OpenTelemetry export is opt-in through experimental.openTelemetry. It fetches the model list from models.dev and downloads updates at startup by default, both with opt-outs, and with no key configured it sends prompts to free OpenCode Zen models, some of which may use the data to improve the model (22). Allow, ask or deny per tool with glob patterns, .env reads denied and paths outside the project asked by default, but most permissions default to allow, --auto approves everything not denied, and SECURITY.md says the permission system is not a sandbox (9). SECURITY.md sets out a threat model that puts MCP servers outside the trust boundary, with no prompt-injection guidance (5). Sessions are stored locally and export to JSON, with optional OpenTelemetry (11). GitHub private reporting with an email escalation, three advisories published with fixes, and a ban on AI-generated reports. No security.txt (13). CVE-2026-88624 (published 22 September, CVSS 9.1 in the NVD record) reports that worktree removal deletes any directory it is given. In 1.19.5, as in 1.19.3, Worktree.remove still deletes an existing path that isn't a registered worktree. The call needs access to the server API, which SECURITY.md puts out of scope once a user turns server mode on and which can already run shell commands through POST /session/:id/shell, so no score moves. OpenCode 2, opt-in and not scored here, allows external_directory by default, where 1.x asks.

Verdent 33

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). Conversation history and tool results go to Verdent's US servers and on to Azure, Bedrock or Vertex, with zero data retention stated for Vertex and Bedrock only. Event logging to log.verdent.ai has no documented opt-out. BYOA keys stay on the machine (10). Plan Mode is read-only, Agent Mode asks before destructive commands and edits outside scope, and workers are isolated by git worktree, but there is no sandbox or network control and the approval list isn't enumerated (9). No prompt-injection guidance found, while web search and fetch results enter the context (2). Usage history in the dashboard, no audit log found (5). A security page with a disclosure address and a five-day acknowledgement, SOC 2 and ISO/IEC 42001 being pursued rather than held, no security.txt and no bug bounty (7). 10+9+2+5+7 = 33.

OpenCode 81

1.19.5 on npm on 2026-10-28, 4 days before the check, and v2.2.5 tagged on 30 October (30). 30 releases on the 1.x line (1.18.12 to 1.19.5) in the 90 days to 1 November, plus 44 v2 tags (20). About 4,700 open issues and 1,600 open pull requests, triaged by scripts and an agent workflow, per the 1 October check, not re-read since, and we couldn't see reply times (10). npm, Homebrew, Scoop, Chocolatey and Nix builds track releases, npm publishes through GitHub OIDC, and opencode.ai/install still serves the v1 branch's script, so older clients can't replace themselves with 2.x by accident (14). Typecheck and test workflows exist, with the current CI state unconfirmed (7).

Verdent 61

Closed service. v2.18.0 on 29 October 2026, eight days before this check (30). More than three dated releases in the 90 days from 8 August, among them 2.10.0 to 2.18.0 (20). A dated public changelog, a support address, Discord and a subreddit, with no public tracker to read reply times (8). No official SDK or MCP server to keep current (0). No public packages or CI to judge (3). 30+20+8+0+3 = 61.