Loading the catalogue…
Coding agents · Anomaly · US
OpenCode
US CLOUD Act exposureOpen sourceMIT
STAV REVIEW · LAST REVIEWED 06/21/2026
“Near-daily releases and full Sovereign control in self-hosted mode, but two patched critical CVEs and no GDPR DPA mean governance gaps require active admin attention.”
Good for
- Engineering teams that want a self-hosted coding agent with zero vendor relay — all Inference flows to your configured provider, never Anomaly's servers
- Organisations already running an internal AI gateway or Smart Router who need a CLI-native agent they can wire in cleanly
- Teams on MIT-licensed open-source tooling where internal forking or custom integration is a requirement
- Air-gapped or on-premises environments paired with a locally hosted Inference provider
- Fast-moving teams that need an actively maintained agent — roughly one release per day with 7,000+ issues closed in 90 days
Watch out for
- The optional Zen tier routes Inference through Anomaly's CLOUD Act-exposed US infrastructure; the vendor states providers follow a zero-retention policy "with the following exceptions" without publicly enumerating those exceptions — block Zen-tier use until Anomaly provides a signed DPA and clarifies those terms in writing
- Two CVEs published 2026-01-12 are patched but were severe: CVE-2026-22813 (CVSS 9.4, XSS-to-RCE via the localhost web UI) and CVE-2026-22812 (CVSS 8.8, unauthenticated local HTTP server); verify all deployed instances are at or above v1.1.10 and v1.0.216 before broad rollout
- No GDPR section in the privacy policy, no published DPA, no SOC 2 or ISO 27001 — a material compliance gap for EU-regulated customers regardless of deployment mode
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
MODEL REQUIREMENTS
What OpenCode needs from a model.
Required
- Streaming
- Tool calling
Recommended
- Code-native
- Extended thinking
- Long context (≥128k)
Known issues6 open
Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.
2026-06-30
lowUpstream change on opencode: github_release 'v1.17.9' → 'v1.17.11', github_last_push '2026-06-23T06:20:52Z' → '2026-06-30T05:52:37Z'
other · open
Source ↗2026-06-23
lowUpstream change on opencode: github_release 'v1.17.7' → 'v1.17.9', github_last_push '2026-06-16T03:54:26Z' → '2026-06-23T06:20:52Z'
other · open
Source ↗2026-06-16
lowUpstream change on opencode: github_release 'v1.16.2' → 'v1.17.7', github_last_push '2026-06-09T06:22:52Z' → '2026-06-16T03:54:26Z'
other · open
Source ↗2026-06-09
lowUpstream change on opencode: github_release 'v1.15.13' → 'v1.16.2', github_last_push '2026-06-02T06:03:32Z' → '2026-06-09T06:22:52Z'
other · open
Source ↗2026-06-02
lowUpstream change on opencode: github_release None → 'v1.15.13', github_last_push None → '2026-06-02T06:03:32Z', cve_count 0 → 2
other · open