# OpenCode Features and Practical Usage 🧰 Wish you could decide in one line what your AI agent is allowed to do and what it must never touch? OpenCode's built-in tools plus permissions give you exactly that. 🏷️ Title: Built-in Tools + Permissions 🔗 URL: 📘 Overview OpenCode agents act on your codebase through "tools" such as file editing and shell execution. A rich set ships by default, and each tool can be governed by an allow / ask / deny policy. You get the safety-versus-convenience balance tuned entirely from config. ⚙️ How It Works The main built-in tools are: ・`bash`: run shell commands (git, npm, etc.) ・`edit`: modify existing files via exact string replacement ・`write`: create or overwrite files ・`read`: read files, with optional line ranges ・`grep`: regex search across files ・`glob`: find files by patterns like `**/*.js` ・`webfetch` / `websearch`: fetch and search the web ・helpers like `lsp`, `apply_patch`, `skill`, `todowrite`, `question` Permissions are set in the `permission` field with three states: `allow` (run freely), `ask` (confirm each time), `deny` (forbidden). Note that the `edit` permission governs `edit`, `write`, and `apply_patch` together. 🛠️ Practical Usage In `opencode.json`, you can forbid edits, confirm every bash call, and allow web fetches freely — set `"edit": "deny"`, `"bash": "ask"`, and `"webfetch": "allow"` under the `permission` block. Tools coming from MCP servers can be controlled with wildcards. Writing `"mymcp_*": "ask"` requires confirmation for every tool from that server. 💡 Use Cases On a production-adjacent repo, set `edit` to `deny` and `bash` to `ask` so the agent can plan and investigate but cannot rewrite code or run destructive commands on its own. On a throwaway experiment branch, allow everything to move fast. Switching between the two is just a config change. ⚠️ Caveats By default all tools are allowed, so nothing is restricted until you explicitly narrow it. The `lsp` tool needs `OPENCODE_EXPERIMENTAL_LSP_TOOL=true`, and `websearch` (powered by Exa) needs `OPENCODE_ENABLE_EXA=1`. It is easy to forget that the `edit` permission also covers write and apply_patch. #OpenCode# #AIAgents#