# OpenCode Features and Practical Usage
🧰 Wish you could decide in one line what your AI agent is allowed to do and what it must never touch? OpenCode's built-in tools plus permissions give you exactly that.
🏷️ Title: Built-in Tools + Permissions
🔗 URL:
📘 Overview
OpenCode agents act on your codebase through "tools" such as file editing and shell execution. A rich set ships by default, and each tool can be governed by an allow / ask / deny policy. You get the safety-versus-convenience balance tuned entirely from config.
⚙️ How It Works
The main built-in tools are:
・`bash`: run shell commands (git, npm, etc.)
・`edit`: modify existing files via exact string replacement
・`write`: create or overwrite files
・`read`: read files, with optional line ranges
・`grep`: regex search across files
・`glob`: find files by patterns like `**/*.js`
・`webfetch` / `websearch`: fetch and search the web
・helpers like `lsp`, `apply_patch`, `skill`, `todowrite`, `question`
Permissions are set in the `permission` field with three states: `allow` (run freely), `ask` (confirm each time), `deny` (forbidden). Note that the `edit` permission governs `edit`, `write`, and `apply_patch` together.
🛠️ Practical Usage
In `opencode.json`, you can forbid edits, confirm every bash call, and allow web fetches freely — set `"edit": "deny"`, `"bash": "ask"`, and `"webfetch": "allow"` under the `permission` block.
Tools coming from MCP servers can be controlled with wildcards. Writing `"mymcp_*": "ask"` requires confirmation for every tool from that server.
💡 Use Cases
On a production-adjacent repo, set `edit` to `deny` and `bash` to `ask` so the agent can plan and investigate but cannot rewrite code or run destructive commands on its own. On a throwaway experiment branch, allow everything to move fast. Switching between the two is just a config change.
⚠️ Caveats
By default all tools are allowed, so nothing is restricted until you explicitly narrow it. The `lsp` tool needs `OPENCODE_EXPERIMENTAL_LSP_TOOL=true`, and `websearch` (powered by Exa) needs `OPENCODE_ENABLE_EXA=1`. It is easy to forget that the `edit` permission also covers write and apply_patch.
#
OpenCode# #
AIAgents#