opencode-swarm MCP工具

OpenCode Swarm

Key Features

• 🏗️ Specialized core, optional, and conditional agents — architect, coder, reviewer, test_engineer, critic, critic_finding_validator, explorer, sme, docs, designer, critic_oversight, critic_sounding_board, critic_drift_verifier, critic_hallucination_verifier, curator_init, curator_phase, council_generalist, council_skeptic, council_domain_expert. Run /swarm agents for the live roster — that is the source of truth, not this list.
• 🔒 Gated pipeline — code never ships without reviewer + test engineer approval
• 🔎 Independent auto-review engine — bounded whole-diff review in a fresh read-only model session, structured diff-anchored findings, optional independent validation, advisory-by-default phase review, and an evidence-backed opt-in completion gate. v7 remains opt-in; v8's default is pinned to a committed 30-diff cost burn-in.
• 🔍 DEEP_DIVE Protocol — High-rigor, on-demand read-only codebase audit via specialized skills
• 🔬 External Skill Curation Pipeline — Opt-in discovery, quarantine, evaluation, and promotion of external skill candidates from configured sources (disabled by default; enable via external_skills.curation_enabled: true in config). Includes 7 tools: external_skill_discover, external_skill_list, external_skill_inspect, external_skill_promote, external_skill_reject, external_skill_delete, external_skill_revoke. Candidates pass through a 3-gate validation pipeline before evaluation: prompt injection scan (12 regex patterns), unsafe instruction scan (25 patterns), and provenance integrity check (SHA-256, timestamp, URL, publisher, and hash verification).
• 🎯 Governed Skill Optimizer — Manually-activated, single-skill optimizer (/swarm skill-opt plan|run|status|diff|approve|reject|rollback|history) that drives one allowlisted SKILL.md candidate at a time through deterministic draft → smoke → evaluation-substrate validation → manual approval → atomic activation/rollback. Bounded, restartable, reversible, and unable to mutate source/harness/security surfaces. Disabled by default (skill_opt.enabled: false); see docs/skill-optimizer.md.
• 🌊 Epic Mode (opt-in preview) — one plan = one epic, run phase by phase as parallel waves of tasks whose declared scopes don't conflict. The delegation gate enforces the active wave; in git projects each coder works in an isolated worktree on an epic branch that /swarm epic close squash-lands as staged changes. Per-task QA always runs, and a phase reviewer + critic gate (epic_phase_review) runs before phase_complete. Epic learns per-file write risk across epics, suggests plan restructurings with a predicted speedup, and reports a scorecard (/swarm epic report). Enable with epic.mode.enabled: true; see docs/modes.md.
• 🔄 Phase completion gates — completion-verify and drift verifier gates enforced before phase completion
• 🔁 Resumable sessions — all state saved to .swarm/; pick up any project any day
• 🔀 GitLab as a first-class forge (#2733) — MR and issue URLs (https://<gitlab-host>/owner/repo/-/merge_requests/N, /-/issues/N) are accepted by /swarm pr-review, pr-feedback, pr subscribe/unsubscribe, ci-monitor, publication recording, and issue ingestion, with self-hosted instance hosts derived from the remote or forge.base_url (config forge: { provider, base_url }, default auto; ambiguous remotes fail closed). Every URL-security control (HTTPS-only, private/localhost rejection, IDN protection, credential stripping) applies identically to GitLab. The glab binary resolves through the same hardened resolver contract as gh (OPENCODE_SWARM_GLAB_BINARY env override). Honest capability reporting: GitLab does not synthesize GitHub's statusCheckRollup/reviewDecision/mergeStateStatus — those surface an explicit unavailable result instead of a fabricated value, and glab-backed live MR polling is tracked as follow-up issue #2882.
• 🖥️ PR Monitor — GitHub PR subscription and background polling via gh CLI; delivers real-time CI, review, and merge status updates via the AutomationEventBus (FR-001, opt-in via pr_monitor.enabled: true). Subscribe with /swarm pr subscribe <pr-url|owner/repo#N|N>; unsubscribe with /swarm pr unsubscribe <pr-url|owner/repo#N|N>; check status with /swarm pr status. With auto_pr_feedback: true, CI failures and merge conflicts mechanically activate PR_FEEDBACK only when no other workflow owns the session; otherwise they are durably queued for a later round.
• 🌐 13 full language profiles (TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C/C++, C#, Ruby, Swift, Dart, PHP) with tree-sitter parse validation across 20 grammars (adds CSS, Bash, PowerShell, INI, Regex — and .tsx / .c aliases) — extending: see docs/adding-a-language.md
• 🛡️ Built-in security — SAST, secrets scanning, dependency audit per task
• 🔒 Scope enforcement — Validates write targets against declared scope with cross-process persistence, TTL expiry, and scope-aware destructive command blocking. Handles both single-string and array-based path arguments (files[], paths[], targetFiles[]) to prevent scope bypass via multi-file tool calls.
• 📝 Shell write detection — Static analysis of POSIX/PowerShell/cmd commands to detect file writes (redirects, builtins, in-place editors, network downloads, archive extraction, git destructive ops) before execution
• 🆓 Free tier — works with OpenCode Zen's free model roster
• ⚙️ Fully configurable — override any agent's model, disable agents, tune guardrails

The Swarm architect coordinates all internal agents automatically. You never manually switch between internal roles. If the active OpenCode agent is not a Swarm architect, the plugin workflow is bypassed.

---

Shell Write Detection Features

• POSIX shell detection — Parses commands with bash-parser AST for accurate detection of:
• Redirect operators (>, >>, >|, <<, <<-)
• Here-documents and here-strings
• Write-effect builtins (cp, mv, install, ln, truncate, dd)
• In-place editors (sed -i, perl -i, awk -i)
• Interpreter eval (python -c, node -e, bun -e, ruby -e, php -r)
• Network downloaders (curl -o, wget -O, scp)
• Archive extraction (tar -x, unzip, gunzip)
• Git destructive operations (git clean -fd, git reset --hard)

• Windows shell detection — Uses regex heuristics for PowerShell and cmd.exe:
• PowerShell cmdlets: Out-File, Set-Content, Add-Content, Copy-Item, Move-Item
• cmd.exe builtins: copy, move, ren, del, rd, md
• Redirect operators (>, >>)

• Interactive session denial — Blocks commands that create persistent or open-ended sessions:
• POSIX: watch, screen, tmux new-session
• PowerShell: Start-Process

• Cross-process scope enforcement — Declared scope is persisted to .swarm/scopes/scope-{taskId}.json with:
• TTL expiry (default 24 hours)
• Symlink guards (O_NOFOLLOW + realpath containment)
• Schema versioning and fail-closed validation
• Scope-aware destructive command blocking — Recursive delete patterns (rm -rf, rmdir /s, del /s, Remove-Item -Recurse, rsync --delete) are blocked unless ALL target paths are within the declared scope (coder agents only)