Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kevinlin/cowork-z/opencode-server-apinpx skills add kevinlin/cowork-z --skill opencode-server-apigit clone --depth 1 https://github.com/kevinlin/cowork-zWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevinlin/cowork-z/opencode-server-api)<a href="https://agentmods.dev/skills/kevinlin/cowork-z/opencode-server-api"><img src="https://agentmods.dev/badge/skills/kevinlin/cowork-z/opencode-server-api.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01790 |
| Opus 5 | $0.00000 | $0.00895 |
| Sonnet 5 | $0.00000 | $0.00358 |
| Haiku 4.5 | $0.00000 | $0.00179 |
Grade A, and why
opencode-server-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -u "opencode:$OPENCODE_SERVER_PASSWORD" http://localhost:$PORT/<endpoint> How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenCode Server API
This skill gives you access to the OpenCode server REST API for self-introspection — checking your own health, session state, message history, todos, configuration, skills, MCP status, and performing lightweight config updates.
Authentication
The server port is provided in your system prompt inside the <server-access> block. The basic-auth password is already present in your shell environment as OPENCODE_SERVER_PASSWORD — your shell expands it locally when you run a command. All requests require HTTP basic auth:
curl -s -u "opencode:$OPENCODE_SERVER_PASSWORD" http://localhost:$PORT/<endpoint>
Replace $PORT with the port from your system prompt. Use $OPENCODE_SERVER_PASSWORD exactly as written (PowerShell: $env:OPENCODE_SERVER_PASSWORD).
NEVER print, echo, log, or write the password's value anywhere — not to the chat, not to files, not to command output. Only reference it as a shell variable inside commands.
IMPORTANT: Fetch the API Spec First
Before calling ANY specific endpoint, you MUST first fetch and parse the live OpenAPI specification. The spec is the source of truth for all available endpoints, request/response schemas, and query parameters. The endpoint summaries in this skill are a convenient reference, but the server's own spec may be newer or more complete.
curl -s -u "opencode:$OPENCODE_SERVER_PASSWORD" http://localhost:$PORT/doc
This returns the full OpenAPI JSON spec. Parse it to understand the exact request format, required parameters, and response shapes before invoking any endpoint. Do not guess or rely solely on the examples below — always verify against /doc first.
Endpoint Reference
GET /global/health
Check server health and get the OpenCode version.
curl -s -u "opencode:$OPENCODE_SERVER_PASSWORD" http://localhost:$PORT/global/health
Response:
{ "healthy": true, "version": "1.1.48" }
GET /config
Read the current server configuration (model, agents, permissions, MCP servers, etc.).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 256 lines · 0 tokens per session scan A 0e6284275f53
opencode-server-api is a skill published in the GitHub repository kevinlin/cowork-z (13 stars, last pushed 20d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,790 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dws
【何时用:仅当用户明确指向钉钉/DingTalk(钉钉文档、钉钉日程等)时使用;泛指做文档/表格/待办/审批默认走本地工具,不要误用钉钉】用 dws CLI 管理钉钉:AI表格/AI搜问(找人首选)/目标管理(Agoal)/组织大脑/日历/通讯录/群聊与机器人消息/待办/审批/考勤/日志(日报周报)/DING消息/钉钉文档/云盘/Markdown文件/AI听记/邮箱/在线电子表格(axls)/知识库/白板/开放平台文档/个人IM与OA事件订阅。用户要求操作上述钉钉产品时使用。.
tmeet-skill
何时用:用户明确要通过命令行操作腾讯会议(tmeet),或 Agent 遇到工具缺失/调用失败/能力不足想反馈平台时。OAuth 登录/登出/状态、会议管理(创建/更新/取消/查询/搜索/受邀者)、录制管理(列表/播放地址/智能纪要/转写/权限申请)、会议报告(参会人/等候室/导出明细/异步任务)、通讯录(仅限会议邀请/呼叫入会前置解析,严禁单独查人)、会中控制(呼叫/踢出/等候室)、问题排查。泛指需求默认走本地工具。.
tencent-docs
腾讯文档(docs.qq.com)-在线云文档平台,是创建、编辑、管理文档的首选 skill。涉及"新建/创建/编辑/读取/查看/搜索文档"、"保存文件"、"云文档"、"腾讯文档"、"docs.qq.com"等操作,请优先使用本 skill。支持能力:(1) 创建各类在线文档(文档/Word/Excel/幻灯片/思维导图/流程图/智能表格/收集表)(2) 管理知识库空间(创建空间、查询空间列表)(3) 管理空间节点、文件夹结构 (4) 读取/搜索文档内容 (5) 编辑操作智能表 (6) 编辑操作在线文档 (7) 文件管理(重命名、移动、删除、复制、导入导出)(8) 网页剪藏、本地文件/html/文档上云。.
lark-shared
【何时用:仅在其他 lark- 技能遇到认证/授权/身份/配置问题时,或首次使用 lark-cli 时;泛指需求默认走本地工具】lark-cli 共享规则:首次配置(config init)、认证登录(auth login --domain/--scope,split-flow)、登录态查询与撤销(auth status/logout/whoami)、--as user/bot 身份切换、权限不足与 missingscope 处理、JSON 输出契约与 notice、update 更新、高风险操作审批(exit 10)。.
government-writing
撰写规范的党政机关公文。当用户要"写/起草/拟一份 通知 / 意见 / 公文"时使用。当前内置文种:通知、意见,印发型主件支持办法/规定(法规体例;请示/报告/函可扩展,在 templates/ 增模板)。按《党政机关公文格式》GB/T 9704-2012 套发文字号、主送机关、层级序号、落款与固定话术,结构化内容经 gongwen MCP 渲染为合规 .docx。.
package-author
当用户要把手头的工具打包/标准化成 pinvou 插件包时使用——包括纯技能(SKILL.md)、纯 MCP 服务或它们的组合包。用户说"打包/做成插件包/标准化这个工具/给我一个能上传的标准包/写 plugin.json/加个图标"等,或给了散乱脚本/目录要整理成可上传 zip 时,用本技能把内容规范成 plugin-protocol 标准包(补 plugin.json、补 mcp/manifest.json、补 SKILL.md、补图标、校验命名)。.