OpenCode VAPT Agent

This repository packages the custom OpenCode VAPT agent so it can be installed on another computer.

Prereqs

• OpenCode installed
• Bun available
• Kali Linux if you want execution mode to work

Install on another computer

The included installer copies the agent files into your OpenCode config directory.

Default install

git clone https://github.com/mustosoft/opencode-vapt-agent
cd opencode-vapt-agent
./scripts/install.sh

This installs:

• agents/vapt-pentest.md → ~/.config/opencode/agents/vapt-pentest.md
• agents/vapt-network.md → ~/.config/opencode/agents/vapt-network.md
• agents/vapt-content.md → ~/.config/opencode/agents/vapt-content.md
• agents/vapt-analysis.md → ~/.config/opencode/agents/vapt-analysis.md
• plugins/vapt-tooling.js → ~/.config/opencode/plugins/vapt-tooling.js
• ensures ~/.config/opencode/package.json contains:

{
  "dependencies": {
    "@opencode-ai/plugin": "1.3.17"
  }
}

Restart OpenCode after installation so the local plugin is loaded.

Install into another config location

You can override the target config directory:

OPENCODE_CONFIG_DIR=/path/to/opencode-config ./scripts/install.sh

Uninstall

./scripts/uninstall.sh

Or with a custom config directory:

OPENCODE_CONFIG_DIR=/path/to/opencode-config ./scripts/uninstall.sh

The uninstaller removes only the VAPT-owned agent/plugin files. It intentionally does not try to remove @opencode-ai/plugin from package.json.

Notes

• OpenCode auto-loads local plugins from the config plugin directory, so no opencode.json editing is required.
• If you want to continue an existing engagement, copy your existing vapt_plan.todo and findings_summary.md into the working directory where the agent will run.
• Execution mode is blocked unless:
  • the environment is Kali Linux
  • authorization has been recorded
  • a vapt_plan.todo exists

Safety model

• Authorization required before execution mode
• Kali-only execution enforcement
• Allowlisted scanner commands only
• Logged command execution to vapt_execution.log
• No built-in bash access for the agent