Spin up an isolated opencode instance from prebuilt public GHCR images and hand
it to Claude Code as an MCP server. No build step, no checkout of the opencode
fork — each instance is its own Docker Compose project with its own named
volumes, and its workspace is a named volume rather than a host bind, so it
cannot see your filesystem. Images are public and pull anonymously; the
backend reports opencode 1.18.4 and the MCP bridge exposes 80 tools.
Build from source and drop the binary on your PATH:
bun run build
cp dist/opencode-sandbox ~/.local/bin/
(bun run install-local does both in one step.) Or grab a prebuilt binary
from this repo's GitHub Releases.
Create an instance. Any provider API key already in your shell
(ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY,
OPENROUTER_API_KEY) is forwarded into it at create time — there's no UI
login step and no auth.json to manage.
opencode-sandbox create scratch --seed ./my-project --config ./opencode.jsonc
--seed copies a directory into the fresh workspace before the instance first
starts; --config places an opencode.jsonc for that instance alone. Both are
optional.
Register it with Claude Code. create prints this line, and url reprints it
later:
opencode-sandbox url scratch
claude mcp add --transport http scratch http://127.0.0.1:4784/mcp
Now use it — the instance's 80 tools (read, write, run shell commands, all
scoped to its own /workspace) are available in that Claude Code session.
When you're done:
opencode-sandbox destroy scratch --yes
destroy removes the containers and their volumes, including the workspace.
A web UI is available too, behind --web on create; without it, the MCP
bridge is the only interface.
The MCP bridge has no inbound authentication of its own. Anyone who can
reach its port gets the full opencode tool surface — reading and writing
files and running shell commands inside that instance's /workspace. The
published port is bound to 127.0.0.1 by default; keep it that way. Do not
widen it to 0.0.0.0 or put it behind a public reverse proxy without a real
auth layer in front of it.