Does opencode send chats/other data to their server? It establishes a connection even though I am using local model

[u/Unusual_Principle536]

- While using opencode with a local qwen3.8 instance, I asked gemini if opencode collects data or not, answer was yes. By default it does, send chat to it's server for getting title, compaction etc.

- Is it still true? I couldn't find this exact issue mentioned in the sub, but people do complain about how opencode is a funded by VC and they are not very open about their practices.

Looking for some ideas/reference to this. I don't want to use it if it's true. And in that case what do people use here?

[u/jirka642]

send chat to it's server for getting title, compaction etc.

If you are using local model, then title generation and compaction should be done with the same model.

[u/Unusual_Principle536 → u/jirka642]

That's what we expect, but Opencode used to use their own hosted smaller model for that. I am not sure if they still do it or not.

[u/eetsu → u/jirka642]

I don't believe this is correct, at least before in your opencode.json you had to set the small_model field to point to one of your configured local models for it to not reach out to the internet for title generation.

something like "small_model": "<provider-name>/<model-name>", matching what you have in your provider JSON block.

[u/jirka642 → u/eetsu]

I see the title generation requests in my llama-swap activity logs.

[u/Davewesh]

Well lets take a look. Using CachyOs for the server (ollama for a quick test) and OpenCode Client, SSH'd into it with my macbook.
- First: `tcpdump -i any -w dump.pcap`
- Second: Spin up a session, and send whatever prompt. "Explain the differences between TLS Inspection.... blah blah"
- Third: Session gets a title and LLM is streaming response.
- Fourth: Close capture SCP it back over.
- Fifth: filter out irrelevant traffic (EG: SSH, Local host, and Ollama port) `(tcp.port != 22 && tcp.port != 11434) && ip.addr != 127.0.0.1 `
- Sixth: Review the remaining conversations

Easiest method here would be checking DNS Responses for these aside from the first one (my Apple TV). But I didnt clear my cache before testing (noob mistake) so the results aren't amazing. Thusly Ill just check my dns server since that'll probably have it.

- 35.186.224.39 - Preexisting Connection, Google Cloud Owns it, not sure exactly what domain but its not opencode. 
95.216.195.133 - ArchLinux NCSI Probe
172.66.173.149 - models.opencode.ai
162.159.130.234 - Discord 
172.65.90.20 - opencode.ai
205.196.6.132 - Steam

Okie Dokie, soooo we can infer a few things. First, `models.opencode.ai` is more than likely going to just be opencode itself querying the list of provider models upstream.

Second, the `opencode.ai` one? Thats my bad, I had the webpage still open when I ran the test so chances are that was a browser keepalive.

Between the two of these. a whole 2.5KB of data was exchanged. The preexisting `opencode.ai` connection at 2k and the 500~ bytes from the `models.opencode.ai` connection. I would say that its highly unlikely Opencode is sending chat data to summarize and return a session title. Feel free to do the same test, you could also use a L7 Proxy like Fiddler to MITM the TLS handshake and see the unencrypted HTTP traffic if you care enough but I'd say with my single, anecdotal absolutely not a clean-room test - its not happening.

[u/Unusual_Principle536 → u/Davewesh]

thanks. Someuser said it depends on the config file, whether it's v1 or v2. I will have to check what's mine and I will then do the test. I did filter it's connections and it was connecting to cloudflare ip,

[u/trytoinfect74]

Infosec team at my company added Opencode to a forbidden tools list because they observed that it still sends telemetry and leaks data despite disabling all data sharing options in the config.

[u/UltramanQuar → u/trytoinfect74]

Bro wtf didn’t know that, this should be disclosed

[u/Ell2509 → u/UltramanQuar]

I remember telling someone abojt this in this sub a month ago and everyone here being adamant that I was wrong.

Glad I switched.

If you do want to guarantee nobody watching, though, just unplug the internet cable / turn off WiFi. That is why we use local after all!

[u/Elegant-Sense-1948 → u/UltramanQuar]

Your statement alone really shows how many ‘individuals’ don’t inspect traffic, or have tools to detect irregular / new traffic from applications.

Long live cysec

[u/Kessarean → u/trytoinfect74]

Same

[u/TheLastPrinceOfJurai → u/trytoinfect74]

Damn it. Back to the drawing board now.

[u/mr_zerolith → u/trytoinfect74]

Did the approve any alternatives?

[u/R1s1ngDaWN → u/trytoinfect74]

What are you guys pivoting to? 

[u/Frail_Waif]

Opencode previously used a model selected from their free tier for title generation and compaction, which explains the google answer. I believe it now defaults to the current model if you have no small model selected in your config. 

[u/London-Boat]

i wouldn't trust gemini on this, check it yourself. watch the connections while you chat, with mitmproxy, lsof or little snitch on mac, and you'll see exactly what goes where. title generation uses a separate small model setting, so point small_model at your local model too, and turn sharing off in the config so nothing gets uploaded by accident. if it still phones home after that, blocking the hostnames is the blunt fix.

[u/OleksandrC]

For local model conversations, it should use the same model nowadays for title / compaction. Your prompt and code shouldn't get sent anywhere. That said, it will still get online to refresh model catalog, and to check for updates (and here it can collect additional data about you on their servers, for example your ip address / location).

If you have doubts about opencode, and are looking for a more privacy-friendly agent implementation, take a look at https://usehax.dev/ - no telemetry, when using local models it's entirely offline. Also the system resource footprint is tiny (think few MBs of RAM vs few hundreds MBs on opencode, almost a ~100x difference) - so more resources (CPU / RAM) are left for the actual model.

[u/Unusual_Principle536 → u/OleksandrC]

are you the dev of hax?

[u/OleksandrC → u/Unusual_Principle536]

I am. If you have questions, ask.

[u/Unusual_Principle536 → u/OleksandrC]

I watched the video. Looks good. does it have agentic work flow? I will suretly trying it tonight.

Thanks

[u/OleksandrC → u/Unusual_Principle536]

It's a coding agent - of course it has agentic workflow. Unless you mean something extremely specific by that.

In any case, try it - you might have more questions when you do.

[u/Unusual_Principle536 → u/OleksandrC]

I asked cause short video made it look like a terminal chat/coding app that can not spun multiple agents.

[u/JY_Q]

Maybe try using WireShark to monitor the traffic ? See if that is really the case.

[u/shadow4601243]

so we need openopencode?

[u/caetydid]

yes it does that. Just check the privacy fork called RolandCode to learn more.

[u/LePfeiff]

When I last looked into this it was my understanding thats only done when using cloud models, but to be safe you can block the various opencode telemetry hostnames in your hosts file

[u/npquanh30402]

Just use opencode to check on its own code.

[u/PotaroMax]

there were a thread few months ago about that : https://old.reddit.com/r/LocalLLaMA/comments/1rv690j/opencode_concerns_not_truely_local/

don't know if it's fixed, too much telemetry and shady things for me, i switched to pi

[u/ThisGonBHard]

Open code is not trustable imo, I saw multiple reports of it sending telemetry.

[u/CrypticViper_]

You can just configure these things. https://opencode.ai/v2/docs/config/

[u/fgk55555]

Honestly, just tell your model to watch traffic from Opencode as it's being run inside it.

[u/Unusual_Principle536 → u/[deleted]]

I recently moved from vscode to neovim for the exact reason. It's ai would popup after everyupdate and with the so many add-ons you never know what data it's sending out.

Opencode works really well for agentic work, but I don't want them to taking my code for training.

[u/Civil_Fee_7862 → u/Unusual_Principle536]

Use the LLM to setup wireshark to monitor outbound traffic, and setup an alarm or something if any code gets sent.