OpenCode Browse (official)
Capped at 80: 1 of 3 real tool calls passed in our test; the tests add up to 85. Why scores are capped
Test points add up to 85; the score is capped at 80 because not every real tool call passed. Not a quality or security rating. Why scores are capped
Test points before the cap (85/100)
- Install20/20
- Handshake30/30
- Maintenance25/25
- Docs0/15
- License10/10
Tested npm @opencode/browse 0.0.15 (MIT; repo anomalyco/browse, 255 GitHub stars when tested; published by the @opencode npm scope). Initialize and tools/list over stdio with args ["mcp"] succeeded with no credentials and listed 18 tools (execute, status, session_*, network, recording, tabs_cleanup, settings, flight_recorder, secrets_*). Real calls (no LLM, no credentials): secrets_list returned {"secrets":[]} (isError false). status and session_list returned isError with "browse relay is not reachable at http://127.0.0.1:19988" — we did not run browse install, pair a Chromium extension, or start the local relay. Browser-driving tools were not called. Vendor product page https://opencode.ai/product/browse documents npm install -g @opencode/browse and links https://github.com/anomalyco/browse. Already listed on Glama (not tagged New / early find). OpenCode announced the launch at https://x.com/opencode/status/2118895128152621153 (2026-11-07T02:35:40Z).
Tool-call test (2026-11-08, direct MCP stdio client, no LLM): pass. 1 of 3 calls passed (secrets_list). status and session_list need the browse relay / paired Chromium extension, which we did not set up. Evidence: local test run, Nov 8, 2026.
Transport (tested 2026-11-08): stdio
Tested version: 0.0.15 · tested 2026-11-08
Token cost (estimate): approx. 3526 tokens, cl100k estimate (18 tools, measured 2026-11-11, version 0.0.15). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.
Permissions: 4 read, 14 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown
Auth: none. Rate limit: unknown. Pricing unit: unknown.
execute— write (state-changing)flight_recorder— write (state-changing)network— write (state-changing)recording— write (state-changing)secrets_list— readsecrets_refresh— write (state-changing)secrets_run— write (state-changing)secrets_status— readsession_adopt— write (state-changing)session_allowlist— write (state-changing)session_delete— write (state-changing)session_list— readsession_new— write (state-changing)session_reset— write (state-changing)session_use— write (state-changing)settings— write (state-changing)status— readtabs_cleanup— write (state-changing)
handshake and tools listed without a recorded key or OAuth
Score 80/100 · Tools 18 · Token cost approx. 3,526 tokens · Compare · Last tested 2026-11-08 · Version tested 0.0.15 · Package @opencode/browse · Repo anomalyco/browse
Summary: OpenCode Browse (official) completed an MCP handshake without credentials and exposed 18 tools.
Evidence summary
- Handshake
- pass
- Tools listed
- 18
- Context cost
- approx. 3526 tokens, cl100k estimate (18 tools, measured 2026-11-11, version 0.0.15; an estimate) ranking · add up your servers' context cost
- API key
- No key needed for the tools we called
- Tested
- 2026-11-08
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | npm install @opencode/browse (Node 20, Linux) succeeded in 1s. |
| handshake | pass | 30 | MCP initialize + tools/list over stdio succeeded with no credentials; 18 tools listed in 1.7s. |
| maintenance | pass | 25 | Repo pushed 0 days before test; 255 GitHub stars. |
| docs | fail | 0 | README checks failed. Check of the package's own README (README shipped in npm package). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Token cost (estimate): approx. 3526 tokens, cl100k estimate for 18 tools · about 43% of an 8k context. This is an estimate from our testing (counted with cl100k_base).
Small-model friendly (schema heuristic, not a model result): unknown.
Not tested
Small-model task runs: Not yet tested.
What we tested and what we didn't
Tested on 2026-11-08
- Install from the registry
- We connected with no credentials and asked for its tool list: it listed 18 tools (Method details: MCP
initializethentools/list) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
- Token cost (estimate)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.
Known security issues
Checked on 2026-11-09 for version 0.0.15 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.
No published advisories found in OSV and GitHub advisories for @opencode/browse 0.0.15 as of 2026-11-09. This is not a security audit.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
Unchanged since the previous snapshot (latest 2026-11-11).
Snapshot hash (fingerprint of the tool list)
f795dffcb267: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.
Raw test record (JSON)
{
"name": "@opencode/browse",
"version": "0.0.15",
"registry": "npm",
"status": "working",
"tested": "2026-11-08",
"tools_count": 18,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"`npm install @opencode/browse` (Node 20, Linux) succeeded in 1s."
],
"handshake": [
"pass",
30,
"MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 18 tools listed in 1.7s."
],
"maintenance": [
"pass",
25,
"Repo pushed 0 days before test; 255 GitHub stars."
],
"docs": [
"fail",
0,
"README checks failed. Check of the package's own README (README shipped in npm package)."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
npx -y @opencode/browse mcp
Pin the version we tested
npx -y @opencode/browse@0.0.15 mcp
tested 2026-11-08. Newer versions may differ and were not tested by us.
{
"mcpServers": {
"opencode-browse": {
"command": "npx",
"args": [
"-y",
"@opencode/browse@0.0.15",
"mcp"
]
}
}
}Tools listed
execute, flight_recorder, network, recording, secrets_list, secrets_refresh, secrets_run, secrets_status, session_adopt, session_allowlist, session_delete, session_list, session_new, session_reset, session_use, settings, status, tabs_cleanup
Tool history: captured Nov 11, 2026. All tool history.
Quick config
{
"mcpServers": {
"opencode-browse": {
"command": "npx",
"args": [
"-y",
"@opencode/browse",
"mcp"
]
}
}
}Add to config Opens the config generator with this server selected.
Setup
- Install. Run
npm install @opencode/browse(Node 20). This is the exact command we ran on 2026-11-08. - Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools (18 in our test).
{
"mcpServers": {
"opencode-browse": {
"command": "npx",
"args": [
"-y",
"@opencode/browse",
"mcp"
]
}
}
}Test history
- 2026-11-08: New
FAQ
Is OpenCode Browse deprecated?
No. @opencode/browse was not deprecated or archived when we last tested it on 2026-11-08.
What replaces OpenCode Browse?
Nothing; OpenCode Browse (official) is not deprecated as of 2026-11-08.
Does OpenCode Browse need an API key?
No. It completed an MCP handshake with no credentials and listed 18 tools.
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.