6 Useful OpenCode Plugins—and What to Check Before Installing

OpenCode plugins can add persistent memory, interactive terminal sessions, cited web search, activity tracking, and reusable agent skills. They also run inside a development workflow that may contain source code, credentials, and command access, so usefulness is only half the decision: review the repository, permissions, data flow, maintenance, and provider terms before installation.

1. OpenCode Antigravity Auth

opencode-antigravity-auth connects OpenCode to Google's Antigravity/Gemini CLI authentication flow and exposes supported Gemini or Claude models through Google OAuth. Its conveniences include token refresh, multiple-account support, model switching, and Google Search grounding.

Important: the repository explicitly warns that using this unofficial integration may violate provider terms and that users have reported account restrictions. It is not endorsed by Google. Do not use a primary or business-critical account without reviewing the current terms, repository warning, token storage, and organizational policy. A provider's supported API is the safer route for production work.

2. OpenCode Supermemory

opencode-supermemory stores context so an agent can recall selected information across sessions and projects. This can reduce repeated explanations about conventions, architecture, and user preferences.

Persistent memory also creates a new data store. Before enabling it, determine what is uploaded, how memories are scoped, whether self-hosting is appropriate, and how to inspect or delete stored data. Do not save secrets, access tokens, personal data, or confidential code merely for convenience.

3. opencode-pty

opencode-pty gives an agent a pseudoterminal for long-running or interactive processes. It can start a development server, send later input, and read subsequent output instead of treating every command as a one-shot operation.

This is useful for test watchers, REPLs, debuggers, and local servers. The risk is equally direct: a terminal can modify files, start network services, and reveal output containing secrets. Use project-level permissions, isolated environments, bounded commands, and manual review for destructive or privileged operations.

4. opencode-websearch-cited

opencode-websearch-cited adds web search with inline citations and source lists through supported search backends. It is most helpful when an agent needs current documentation or traceable evidence.

Citations improve traceability, not truth. Open the cited page, check that it directly supports the claim, prefer primary sources, and keep API keys out of project files. Also review which prompts and query text are sent to the selected search provider.

5. opencode-wakatime

opencode-wakatime records OpenCode activity for WakaTime reporting. It can help an individual understand time spent and help a team measure adoption of AI-assisted coding.

Analytics can expose project names, file paths, timestamps, or other work patterns depending on configuration. Review exactly which fields leave the machine, retention settings, team visibility, employee-monitoring rules, and whether tracking can be paused for sensitive repositories.

6. opencode-agent-skills

opencode-agent-skills discovers reusable skills from project, user, plugin, and Claude-compatible directories. A skill can package instructions and supporting resources so teams do not have to repeat the same workflow in every prompt.

Skills are executable workflow inputs, not harmless documentation. Read each SKILL.md and any referenced script, pin trusted sources where possible, and keep project-local skills under code review. A malicious or outdated skill can encourage unsafe commands or conflict with repository rules.

How to choose among them

Installation checklist

• Confirm the repository is the intended one; similarly named packages can exist.
• Read recent releases, open security issues, license, and maintenance activity.
• Inspect install scripts, permissions, network destinations, and credential storage.
• Test in a disposable repository with low-privilege credentials.
• Pin or review updates instead of blindly accepting breaking changes.
• Remove the plugin and revoke credentials if it is no longer needed.

OpenCode maintains a broader ecosystem list, but inclusion is not a security endorsement. Start with the one plugin that solves a real bottleneck, validate its behavior, and add others only when the extra data access and complexity are justified.