Secure Agentic Coding

What Is LockedCode?

LockedCode is a security-hardened fork of OpenCode, the open-source AI coding agent with over 150,000 GitHub stars and 6.5 million monthly users. OpenCode lets LLMs read files, write code, run shell commands, and autonomously build projects in your workspace. It's fast, flexible, and provider-agnostic.

It's also entirely trust-based. The LLM proposes an action, the developer gets a confirmation prompt, and the action executes. There are no hard boundaries on what the agent can access, no scanning of what it produces, no audit trail of what it did, and no protection against what it sends to the model provider. For solo developers using frontier models from trusted providers, that's fine.

For corporate development teams — especially those using open-source, self-hosted, or offline models to manage token costs — it's a non-starter.

LockedCode fixes this. It adds a comprehensive security layer between the LLM's intent and the agent's execution. Every file write passes through static scanning. Every shell command is parsed and analyzed. Every outbound context payload is checked for secrets and PII. Every action is confined to the project directory at the operating system level. Everything is logged in an immutable audit trail. Every security decision is configurable via declarative policy. Every model that touches your code is tracked. Every compliance requirement is documented. And when something goes wrong, you can roll back to safety.

LockedCode is not a wrapper around OpenCode. It is OpenCode — every feature, every provider integration, every TUI capability — with a security layer that adds zero performance overhead. Same speed. Same workflow. Full protection.

Why Does This Exist?

The AI coding agent market is moving fast. Enterprises are under pressure from two directions: leadership wants AI-accelerated development, and finance wants to control the token spend that comes with routing everything through frontier model APIs. The obvious solution is running smaller, cheaper, or self-hosted models — Llama, Qwen, Mistral, DeepSeek, CodeGemma, local fine-tunes.

But the moment you step outside the frontier providers, you lose whatever implicit trust came with that relationship. Nobody at Anthropic or OpenAI is deliberately shipping a model that exfiltrates your source code. Can you say the same about a fine-tuned model someone uploaded to Hugging Face last week? Or a quantized variant running on an internal GPU cluster that was trained on data nobody fully audited?

This is the gap LockedCode fills. It treats every LLM output as potentially adversarial — regardless of the model's provenance, reputation, or provider — and enforces security at every layer:

• WritesWhat the model writes is scanned for malware patterns, encoded payloads, obfuscated network calls, credential theft, and crypto mining before it touches the filesystem.
• ExecutesWhat the model executes is parsed, analyzed, and validated against the project boundary before any shell command runs.
• SeesWhat the model sees is scanned for secrets, PII, and sensitive file content before it leaves the machine.
• ReadsWhat the model reads is checked for prompt injection attacks designed to manipulate the agent's behavior.
• InstallsWhat the model installs is checked for typosquatting, suspicious post-install scripts, and package policy violations.
• ReachesWhere the model can reach is confined to the project directory at the kernel level — no amount of clever LLM output gets past a Landlock jail.
• ExtendsWhat the model extends — MCP servers and plugins — is scanned through the same security pipeline. No tool bypasses scanning, whether built-in or external.
• TrackedWhich model produced which code is recorded per-file so compromised models can be identified and their output reviewed.
• LoggedEverything that happens is recorded in an immutable, content-hashed audit trail that satisfies compliance frameworks.

Who Is This For?

Feature Overview

Installation

# npm (recommended)
npm i -g lockedcode@latest

# Homebrew (macOS and Linux)
brew install LockedCodeAI/tap/lockedcode

# Scoop (Windows)
scoop install lockedcode

# Direct binary
# Download from https://github.com/LockedCodeAI/lockedcode/releases

Desktop App

LockedCode is also available as a desktop application. Download from the releases page or lockedcode.ai/download.

# macOS (Homebrew)
brew install --cask lockedcode-desktop

# Windows (Scoop)
scoop bucket add extras; scoop install extras/lockedcode-desktop

Installation Directory

The install script respects the following priority order:

1. $LOCKEDCODE_INSTALL_DIR — Custom installation directory
2. $XDG_BIN_DIR — XDG Base Directory Specification compliant path
3. $HOME/bin — Standard user binary directory
4. $HOME/.lockedcode/bin — Default fallback

# Examples
LOCKEDCODE_INSTALL_DIR=/usr/local/bin curl -fsSL https://lockedcode.ai/install | bash
XDG_BIN_DIR=$HOME/.local/bin curl -fsSL https://lockedcode.ai/install | bash

Post-Install: Security Capability Check

After installation, run:

lockedcode security-check

This reports the security capabilities available on your platform: confinement backend, scanner availability, policy file detection, and air-gap mode status.

Quick Start: Security Configuration

LockedCode works out of the box with sensible defaults. For custom configuration, create a lockedcode.json at your project root:

security:
  strictness: standard          # strict | standard | permissive

  confinement:
    pre_approved_paths:
      - ~/.npm                  # npm cache
      - ~/.bun                  # bun cache
      - /tmp                    # temp directory

  scanning:
    semgrep: true
    yara: true
    entropy: true
    secrets: true

  dlp:
    redaction_mode: true        # redact secrets instead of blocking files
    sensitivity_patterns:
      - "**/.env*"
      - "**/credentials.*"
      - "**/config/production/**"

  trust:
    auto_approve_below: 20      # auto-approve low-risk actions
    prompt_above: 50            # require approval for medium+ risk
    block_above: 90             # hard-block critical risk

  models:
    approved:                   # empty = all allowed
      - claude-sonnet-4
      - gpt-4o
    blocked:
      - untrusted-model-v3

  audit:
    retention_days: 90

Agents

LockedCode includes the same built-in agents as OpenCode, with security policies applied to all of them:

• buildDefault, full-access agent for development work. All actions pass through the security layer.
• planRead-only agent for analysis and code exploration. Denies file edits by default. Asks permission before running bash commands. Security scanning still applies to any approved operations.
• generalSubagent for complex searches and multistep tasks. Invoked using @general in messages. Security policies cascade with no privilege escalation.

Relationship to OpenCode

LockedCode is a standalone project built on OpenCode (MIT License). It selectively merges upstream features and fixes. All original OpenCode capabilities — provider integrations, TUI, LSP support, client/server architecture — are preserved, with security-incompatible features removed or hardened (mDNS removed, plugins disabled by default, server auth required, parent directory config injection eliminated).

LockedCode adds a comprehensive security layer with zero performance overhead — same speed, same capabilities, plus confinement, scanning, auditing, and compliance. The only things removed from the upstream are security vulnerabilities: mDNS network broadcasting, parent directory config injection, and unrestricted external plugins.

There is no tradeoff. LockedCode is OpenCode with security. Nothing is slower, nothing is missing, nothing is harder to use. You get verifiable evidence that the agent can't do anything it wasn't supposed to — for free.

vs OpenCode

Everything OpenCode does, plus — with zero performance overhead:

• OS-level directory confinement (Landlock, sandbox-exec, restricted tokens)
• Seven-scanner static analysis pipeline (Semgrep, YARA, Entropy, Secrets, Injection, Custom, License)
• Shell command structural parsing and analysis before execution
• Outbound DLP preventing secrets and PII from reaching the model
• Prompt injection detection on ingested files
• Dependency vetting with typosquatting detection
• Immutable, content-hashed audit trail
• Declarative policy engine with configurable strictness
• Trust scoring with session decay and model trust history
• Model provenance tracking — know which model wrote which code
• Model registry with approval and blocking lists
• Compliance report generation for SOC2, ISO 27001, HIPAA, FedRAMP
• SIEM integration (Splunk, Datadog, Elastic)
• Session recording and replay for incident investigation
• License contamination detection
• Rollback and quarantine for automated response
• Custom rule authoring SDK
• Runtime monitoring (eBPF)
• Multi-agent security cascade
• MCP tool scanning — external tools go through the same security pipeline
• Plugin lockdown — external plugins disabled by default
• Server authentication — web and serve modes require auth tokens
• No mDNS service discovery — never advertises presence on network
• No parent directory config injection — reads config only from project root
• Full air-gap mode with bundled rule sets

vs Claude Code

Everything that differentiates OpenCode from Claude Code, plus the full security layer above:

• 100% open source
• Not coupled to any provider — works with Claude, OpenAI, Google, or local models
• Security layer that treats every model as potentially adversarial
• Built-in opt-in LSP support
• Terminal-first TUI, built by neovim users
• Client/server architecture allowing remote operation from a mobile app

Documentation

For more info on how to configure LockedCode, including detailed security configuration, policy authoring, and platform-specific confinement setup, head over to our docs.

Contributing

If you're interested in contributing to LockedCode, please read our contributing docs before submitting a pull request. Security-related contributions — new scanner rules, confinement improvements, and audit trail enhancements — are especially welcome.

License

LockedCode is licensed under the MIT License. It includes attribution to the original OpenCode project by anomalyco.