Switch card · AI CODING HARNESSES

Claude Code ⇄ OpenCode

CONFIDENCE: LOW· updated 2026-08-18· n=18 independent, 38 sources on the face, 84-row ledger· vendor content discounted

This is a ⇄, not a migration. Nothing here says leave Claude Code, and nothing says leave OpenCode. The two harnesses are close enough on outcome that the published measurements disagree about which is faster and which is cheaper, in both directions, and the corpus contains people moving each way and a third group who left for a different harness entirely. What is not close is the paperwork. Claude Code is proprietary (LICENSE.md: “All rights reserved… subject to Anthropic’s Commercial Terms”); OpenCode is MIT. On security this card reports and does not rank. Counting is harder than it looks and we will not rank on it. Both names collide with unrelated products — a bare NVD keyword search for “opencode” returns a telecom USSD gateway and an unrelated “OpenCode Studio”; one for “Claude Code” returns Linux-kernel entries. Filtering on the description prefix each vendor uses, the registry holds 2 for this OpenCode and 26 for Claude Code (read 2026-08-19; a genuine by-hand pass keeps at least one more Claude Code entry, so 26 is a floor). The registries also disagree with each other on severity, in both directions. We report each tool’s record and rank neither. What is documented on one side only is the handling: 52 days to a first reply for OpenCode’s researcher, a partial fix on day 43, and seven of ten tabulated vectors marked Unfixed as that disclosure stood on 2026-01-12. And a counterpart does exist, in the same evidentiary class — a researcher’s own account of their own disclosure. A macOS sandbox-escape reported to Anthropic through HackerOne on 18 July 2026 was “validated… and assigned CVSS 4.0 7.7, High” on 20 July, two days later, with a bounty on 4 August. — though that Claude Code report was still private with “fixed version, advisory or CVE decision” marked TBD at the time it was written, while OpenCode’s fix shipped and its vectors are public. Neither side’s account is independently confirmed, and one data point per vendor is not a policy — but this card spent four rounds saying the comparison could not be made, and it can. Decide on the constraint you cannot live with, not on a benchmark — the benchmarks here are a January four-task run and a July small-n study, and they contradict each other.

The fact that decides it: this is two decisions wearing one name. Question one is the harness — Claude Code or OpenCode, the program in your terminal. Question two is the bill — an Anthropic subscription, or OpenCode Go, a $10/month key sold by OpenCode’s own maintainers. They are separable, and how far they separate is measurable: of the 20 models Go lists, six are served on Anthropic-compatible endpoints (the Endpoints table shows seven such rows, but one of them — MiniMax M2.5 — is not in the 20-model roster; count the intersection and it is six) (/zen/go/v1/messages, @ai-sdk/anthropic) — so for those six a Go key drives Claude Code through three environment variables — ANTHROPIC_BASE_URL, ANTHROPIC_API_KEY, ANTHROPIC_MODEL — as documented by a developer who packaged exactly that, and who is promoting his own tool, so we take the mechanism from him and nothing else. The other fourteen need a translating proxy. The one first-hand user on this card who states their whole stack is running exactly that: “claude code +opencodego deepseek v4flash + ccswitch路由” — and DeepSeek V4 Flash is one of the fourteen, which is why 「ccswitch路由」, a third-party router, is in the sentence. We are not claiming this is what most people do — no denominator appears in any of this card’s 84 ledgered sources, and of its own 18 counted voices the first-hand switchers mostly changed the harness. The point is narrower and firmer: “which harness” and “who bills me” are different questions, and answering the first does not answer the second.

The decision

CHOOSE OPENCODE IF →

  • Your reason is the licence, not the speed. anomalyco/opencode is MIT — fork it, audit it, keep running it. anthropics/claude-code is proprietary: its LICENSE.md reads in full “© Anthropic PBC. All rights reserved. Use is subject to Anthropic’s Commercial Terms of Service.” (read 2026-08-18). Note the GitHub API reports license: null for it — that means “not SPDX-detectable”, not “unlicensed”, and this card said the wrong one before correction. If forking or self-hosting is a real constraint, this is the one difference here that no other source contests.
  • You need to read the prompt your agent sends. A Japanese engineering blog puts the difference plainly: OpenCode’s system-prompt assembly is 「コードで追える」 — followable in the repo — while Claude Code’s detailed prompt is 「非公開」 (Zenn, spacemarket, published 2025-10-07). If you owe someone an answer about what your agent transmits, one of these is inspectable and one is not.
  • You want the cheap-model default, and you have checked your own burn. OpenCode Go is $5 the first month, then $10/month against Claude Code’s $20 Pro and $100 Max 5x (the Claude figures as stated by one ledgered secondary source and named by a user in another; Anthropic’s own pricing page was not read this sweep), against dollar caps of $12 / 5h, $30 / week, $60 / month (opencode.ai/docs/go, read 2026-08-18). But read the two first-hand reports on this card before assuming what that buys — on the same model, one reviewer reports pennies a day and one user reports a single code review eating 73% of the five-hour allowance.
  • Thoroughness is worth more to you than wall-clock. On Builder.io’s four-task run (2026-01-12) OpenCode wrote 94 tests to Claude Code’s 73 and ran the full suite; that one task is where 83% of its much-quoted slowness came from.
  • You type a language with an IME. The most concrete first-hand switch reason found in any language was not cost: 「Claude Code では、日本語入力の変換中に文字が横にずれる現象が頻繁に発生し」 — characters shifting mid-composition — which that author calls 「一番自分にとって大きいメリットだったかもしれません」 — possibly the biggest benefit of moving (jedipunkz, 2025-12-28). Across this card’s 84 sources, no English-language switch report raises IME — and both trackers carry IME issues — the same query returns 263 on Claude Code and 101 on OpenCode (2026-08-19). The Japanese account is about one specific composition bug, not about OpenCode being free of IME problems.

CHOOSE CLAUDE CODE IF →

  • You were going to switch for the token number. The “33k vs 7k” figure is real as measured on 2026-07-12 — but ~24,000 of Claude Code’s ~33,000 was tool schemas, and both harnesses ship changes weekly. This card did not re-measure it, and no later measurement appears in its 84 ledgered sources. Treat it as a dated reading, not a current property.
  • You were going to switch for the speed number. “78% slower” comes from one run of four tasks in January 2026. On its own table, two of the four tasks were within seven seconds — and OpenCode won the bug fix by a second.
  • You are choosing on security posture — in which case take OpenCode’s record on its own terms, because this card will not rank the two. OpenCode has two published CVEs, both dated 2026-01-12. CVE-2026-22812 (CVSS 3.1 8.8): before v1.0.216 an unauthenticated local HTTP server meant, in the disclosing researcher’s words, “any website could execute arbitrary code on your machine if OpenCode was running — no user interaction or configuration necessary”. CVE-2026-22813: the markdown renderer inserted unsanitised HTML, reaching script execution on the local origin; NVD scores it 6.1, the GitHub CNA 9.4. And the handling: 52 days to a first reply, a partial fix on day 43, and seven of ten tabulated vectors marked Unfixed as that disclosure stood on 2026-01-12, which we did not re-check. We are deliberately not scoring this against Claude Code. Both product names collide with unrelated software in the registry, so any count needs manual disambiguation before it means anything (after it: 2 for OpenCode and at least 26 for Claude Code); the two registries disagree on severity in both directions; and the handling comparison, which we long said we could not make, runs against OpenCode: a Claude Code sandbox escape reported through HackerOne on 18 July 2026 was validated and scored two days later, against OpenCode’s 52. Both figures are reporters’ own accounts; one case each is not a policy.
  • You depend on pointing a third-party harness at a Claude subscription. That path is closed at the OpenCode end — the provider and its auth plugin were removed on 2026-03-19, which is verifiable in the diff. And it is Anthropic’s stated policy, not user folklore — an earlier draft of this card said the opposite. The Consumer Terms forbid “Using OAuth tokens obtained through Claude Free, Pro, or Max accounts in any other product, tool, or service — including the Agent SDK”, and Anthropic’s own error string reads “This credential is only authorized for use with Claude Code”.
  • You are buying the newest model, not the harness. On the one board that measures both on the same model, they are level — 52.1% to 51.7% on Opus 4.5. But Claude Code has a 58.0% entry on Opus 4.6 and OpenCode has none, so if your reason for staying is access to Anthropic’s newest model through a harness tuned for it, the leaderboard supports you. It does not support a claim that the harness itself is better.

Works with your setup?

Licence
declared		Model
choice		Claude Pro/Max
works?		Published CVEs
reported, not ranked		Source you
can read		Prompt you
can audit		Measured on a
standard suite
Claude Code✗ proprietary · all rights reserved⚠ Anthropic-native · others via ANTHROPIC_BASE_URL✓ native⚠ 26 CVEs · hand-disambiguated✗ proprietary✗ not published⚠ 52.1% Opus 4.5 · 58.0% Opus 4.6
OpenCode✓ MIT✓ many providers · local models✗ removed 2026-03-19⚠ 2 CVEs · hand-disambiguated✓ MIT, forkable✓ assembled in repo code⚠ 51.7% Opus 4.5 · no 4.6 entry
OpenCode Go (the $10 subscription)⚠ n/a · a service⚠ 20 models · was 19 on 2026-08-18⚠ n/a — a key, not a harness⚠ n/a✗ hosted⚠ provider-dependent⚠ n/a — a key, not a harness

Sentiment — independent voices only

The bar is POSTURE toward moving off Claude Code, not a count of migrations. n=18: an identifiable author, reporting their own first-hand use or their own measurement, on a source with a ledger row, not selling either harness. The roster has been cut and partly restored: four voices were removed across three rounds for arguing about the tools without using them, and a fourth round found that two of those four had reported first-hand use after all — one ran OpenCode on a 512MB VPS and hit OOM, one measured which models Claude Code silently calls — so they are back. 20 → 18 → 17 → 16 → 18. Over-removing is the same error as over-counting, just in the flattering direction. Two red voices left OpenCode too — one for pi.dev, one for Crush. Benchmark authors, aggregators and one tool-launch post are quoted but excluded; no video’s spoken content is quoted anywhere — the one B站 item is quoted from its uploader-written description. The rule and the exclusion list are in quotes.md.

Weighted evidence

Show all 26 sourcesShow fewer

Why confidence is LOW

PR #18186 was merged 19 minutes after it was opened (2026-03-19) 52 days to a first reply — but a partial fix landed on day 43 Claude Code is proprietary — “All rights reserved”, read 2026-08-18 OpenCode is MIT · 198,697 ★ vs 141,850 ★, read 2026-08-18 OpenCode Go is sold by OpenCode's own maintainers — $10/mo Go's zero-retention deal on the DeepSeek models is renewed MONTHLY “78% slower” is 83% one task — writing 21 more tests the prior sweep's best source (readglim, “78% slower”) is a 404 two different projects are called OpenCode — Charm/Go and SST/TypeScript no YouTube video was watched; no spoken content is quoted here OpenCode has 2 CVEs, not 1 — this card missed one twice both product names collide with unrelated CVEs — counts hand-disambiguated

Coverage — what we read, what we skipped

⚠ THIS CARD REPLACES AN AUTOMATED SWEEP THAT COULD NOT REACH ITS OWN SOURCES. A scheduled cloud run on 2026-08-17 shortlisted this pair with agent-reach absent from that runtime — none of its 16 channels reachable, WebFetch returning PROVENANCE_REQUIRED on every call, and Reddit returning 403. It recorded Reddit, Twitter/X, 小红书 and B站 as coverage gaps. This sweep re-ran every one of them from the operator’s machine on 2026-08-18 and all four returned results. get_status itself under-reported again — it printed 3/16 个渠道可用 and listed those platforms as not installed, immediately before they worked. Two claims from the prior shortlist did not survive. Its best-rated artefact — a readglim.com post cited for a first-hand “78% slower” — is HTTP 404 on both bare and www variants; the Wayback Machine returned 429 Too Many Requests on three attempts. The figure’s real origin turned out to be a Builder.io benchmark, found through a Japanese article; readglim is an aggregator, not the first-hand account it was cited as. Nothing from that URL appears on this card. Read and used: Hacker News (13 threads, each counted separately — counts are never summed), api.github.com, the CVE registry, OpenCode’s own documentation, two published benchmarks, Reddit, Twitter/X, 小红书, B站, 掘金, and eight Japanese sources. Tried and failed, with the errors: 知乎 search is CAPTCHA-walled (「系统监测到您的网络环境存在异常」) so it could not be enumerated — that is different from returning nothing, and article pages remain readable if an id is found another way; the V2EX API returned HTTP 401 (our own notes had recorded an SSL failure — the failure mode has changed); LinkedIn search returned [], which for a jobs-only, title-driven index means no job-title demand signal, not an absence of content; A gap this card published and then had to withdraw: OpenCode’s own announcement of the 2026-08-16/17 repricing was written up here as unreadable, on the strength of HTTP 429 · rate-limited by Twitter (session quota) and an Apify scraper that returns nothing without a paid plan. The 429 was transient — its own message said “retry after cooldown” — and a later retry read the posts first try. They are now on the card. We documented a failure instead of waiting fifteen minutes. Separately, one tweet by an OpenCode principal initially returned “has no article content” — but that was the wrong subcommand, and a later attempt read it fine. It is now on this card as a primary source. We had published it as unreachable; it was not. Not quoted at all: YouTube. All ten videos the search returned are in the ledger with their view counts, but none was watched, so no spoken content is quoted anywhere on this card. The one B站 video we do cite is quoted from its uploader-written description only: its subtitle request returned AUTH_REQUIRED — “Bilibili subtitles are hidden behind login for this video”, a login wall on a track that exists rather than an absent one — and one of the largest carries a disclosed sponsor. Never attempted at all, so not gaps either: Qiita, note.com, はてなブックマーク, 微信公众号 and TikTok. docs/SWEEP-SOURCES.md lists them among the channels a card sweeps; this card did not run them, and silence would have read as coverage. What would change this card: a re-measurement of Claude Code’s first-turn payload after Tool Search; a re-check of the seven vectors the researcher listed Unfixed as of 2026-01-12 against current source; and OpenCode’s own account of the 52-day disclosure gap, which we looked for and did not find.

Show every source we read (84) Hide the ledger

The 84 sources in this card's ledger — 38 of them quoted above. Sources we read and did not quote are listed too, with why. This is the ledger, not a claim of exhaustiveness: anything the sweep read but deliberately left out of it is named in the coverage note above, with the reason. Reliability and neutrality are our own scores, not the publisher's. Vendor-owned pages are marked in the notes and never carry the verdict.

Straight answers

is opencode open source?
Yes — MIT. The GitHub API reports anomalyco/opencode as MIT-licensed, TypeScript, with 198,697 stars (read 2026-08-18). Claude Code is proprietary: its LICENSE.md reads “© Anthropic PBC. All rights reserved. Use is subject to Anthropic’s Commercial Terms of Service.” (The GitHub API returns license: null for it, which means only that the licence is not SPDX-detectable.)
can i use opencode with my claude pro or max subscription?
Not through stock OpenCode. On 2026-03-19 OpenCode removed Anthropic as a provider entirely — including the opencode-anthropic-auth plugin — in a pull request its maintainers titled “anthropic legal requests”, which is a matter of record in the diff. The January 2026 enforcement is documented as well as reported: Anthropic’s Consumer Terms forbid using Free/Pro/Max OAuth tokens in any other product or service, and its own error string says the credential “is only authorized for use with Claude Code”.
did anthropic sue opencode?
No lawsuit was found in this sweep. The widely shared Hacker News thread is titled “Anthropic takes legal action against OpenCode”, but the artefact it links to is a pull request titled “anthropic legal requests”, opened by an OpenCode maintainer and merged 19 minutes later on 2026-03-19. No complaint, docket or case number appeared in any of this card’s 84 ledgered sources.
is opencode slower than claude code?
On Builder.io’s four-task run — 2026-01-12, same model in fresh containers — OpenCode took 78% longer overall (16m 20s vs 9m 9s). But 83% of that gap is a single task, where OpenCode wrote 94 tests to Claude Code’s 73 and ran the full suite. Rename differed by seven seconds and refactor by 66, and OpenCode was one second faster on the bug fix. A separate July study measured OpenCode finishing faster. The honest answer is that it depends on the task: the two studies that held the model constant disagree with each other.
what is opencode go and is it the same as opencode?
They are different things sold by the same people. OpenCode is the open-source harness; OpenCode Go is a subscription from its maintainers — $5 the first month, then $10/month — giving one API key to 20 curated open models (read 2026-08-18). The vendor’s own docs say it is “completely optional”. Six of its 20 models are served on Anthropic-compatible endpoints, so for those six the same key also drives Claude Code directly by setting three environment variables; the other fourteen need a translating proxy.
does opencode go have zero data retention?
Mostly, but not uniformly, and not permanently. Of its 20 models, 15 are listed at 0 days, Grok 4.5 and GPT 5.6 Luna at 30 days, one (Muse Spark 1.2 Contributor) reads “Not ZDR”, and the two DeepSeek models read “0 days*” — the asterisk being a footnote: “ZDR agreement is renewed monthly. The current agreement is valid through August 31, 2026.” That was read on 2026-08-18 — check the current page before relying on it.
how do claude code and opencode compare on security?
This card reports both records and ranks neither. OpenCode has two published CVEs, both 2026-01-12: CVE-2026-22812 (CVSS 3.1 8.8, an unauthenticated local HTTP server, fixed in 1.0.216) and CVE-2026-22813 (NVD 6.1, GitHub CNA 9.4, fixed in 1.1.10). Claude Code has 26 after the same disambiguation, two of them scored 10.0 by NVD and 7.7 by the CNA. A larger count tracks product surface and paid scrutiny more than danger. Where they differ is handling: OpenCode’s reporter waited 52 days for a reply (partial fix on day 43), while a Claude Code sandbox escape reported through HackerOne on 18 July 2026 was validated and scored two days later — that one, though, was still unfixed and private when written up, where OpenCode’s fix shipped. Both are the reporters’ own accounts, and one case each is not a policy.
does claude code really send 33,000 tokens before your prompt?
That was measured at the API boundary on 2026-07-12: about 33,000 tokens for Claude Code against about 7,000 for OpenCode on a one-line reply. Two caveats matter. Roughly 24,000 of the 33,000 was tool schemas, which is the part of a harness most likely to change between releases — and this card did not re-measure it. The same study also notes most of those tokens are cache reads, billed at a tenth of the input price.

Stuck on a different switch?

If the card doesn't exist yet, request it — free, like everything here. Full sweep, weighted verdict, and one email the moment it's published.

Request a card