Secure Agentic Coding

What Is LockedCode?

LockedCode is a security-hardened fork of OpenCode, the open-source AI coding agent with over 150,000 GitHub stars and 6.5 million monthly users. OpenCode lets LLMs read files, write code, run shell commands, and autonomously build projects in your workspace. It's fast, flexible, and provider-agnostic.

It's also entirely trust-based. The LLM proposes an action, the developer gets a confirmation prompt, and the action executes. There are no hard boundaries on what the agent can access, no scanning of what it produces, no audit trail of what it did, and no protection against what it sends to the model provider. For solo developers using frontier models from trusted providers, that's fine.

For corporate development teams — especially those using open-source, self-hosted, or offline models to manage token costs — it's a non-starter.

LockedCode fixes this. It adds a comprehensive security layer between the LLM's intent and the agent's execution. Every file write passes through static scanning. Every shell command is parsed and analyzed. Every outbound context payload is checked for secrets and PII. Every action is confined to the project directory at the operating system level. Everything is logged in an immutable audit trail. And every security decision is configurable via declarative policy.

LockedCode is not a wrapper around OpenCode. It is OpenCode — every feature, every provider integration, every TUI capability — with a security layer that makes it safe for real codebases, real teams, and real compliance requirements.

Why Does This Exist?

The AI coding agent market is moving fast. Enterprises are under pressure from two directions: leadership wants AI-accelerated development, and finance wants to control the token spend that comes with routing everything through frontier model APIs. The obvious solution is running smaller, cheaper, or self-hosted models — Llama, Qwen, Mistral, DeepSeek, CodeGemma, local fine-tunes.

But the moment you step outside the frontier providers, you lose whatever implicit trust came with that relationship. Nobody at Anthropic or OpenAI is deliberately shipping a model that exfiltrates your source code. Can you say the same about a fine-tuned model someone uploaded to Hugging Face last week? Or a quantized variant running on an internal GPU cluster that was trained on data nobody fully audited?

This is the gap LockedCode fills. It treats every LLM output as potentially adversarial — regardless of the model's provenance, reputation, or provider — and enforces security at every layer:

• WritesWhat the model writes is scanned for malware patterns, encoded payloads, obfuscated network calls, credential theft, and crypto mining before it touches the filesystem.
• ExecutesWhat the model executes is parsed, analyzed, and validated against the project boundary before any shell command runs.
• SeesWhat the model sees is scanned for secrets, PII, and sensitive file content before it leaves the machine.
• ReadsWhat the model reads is checked for prompt injection attacks designed to manipulate the agent's behavior.
• ReachesWhere the model can reach is confined to the project directory at the kernel level — no amount of clever LLM output gets past a Landlock jail.
• LoggedEverything that happens is recorded in an immutable, content-hashed audit trail that satisfies compliance frameworks.

Who Is This For?

Feature Overview

V2 Roadmap

These features are planned for V2 and are not yet implemented:

• Runtime Monitoring — eBPF-based syscall monitoring, process tree analysis, and network activity detection v2
• Model Provenance Tracking — per-file, per-line attribution of which model generated the code v2
• Model Registry & Approval Workflow — centralized control over which models developers can connect to v2
• Dependency Vetting — typosquatting detection, vulnerability checking, and approved package registry enforcement v2
• SIEM Integration — structured event export to Splunk, Datadog, Elastic in CEF, OCSF, and JSON formats v2
• Compliance Report Generation — automated evidence generation for SOC2, ISO 27001, HIPAA, and FedRAMP v2
• License Contamination Detection — code fingerprinting against known open-source bodies to flag license issues v2
• Session Recording & Replay — full session replay with visual timeline interface v2
• Custom Rule Authoring — SDK/DSL for writing organization-specific scanning rules v2
• Rollback & Quarantine — automated response including quarantine to a holding branch v2

Installation

# npm (recommended)
npm i -g lockedcode@latest

# Homebrew (macOS and Linux)
brew install LockedCodeAI/tap/lockedcode

# Scoop (Windows)
scoop install lockedcode

# Direct binary
# Download from https://github.com/LockedCodeAI/lockedcode/releases

Desktop App

LockedCode is also available as a desktop application. Download from the releases page or lockedcode.ai/download.

# macOS (Homebrew)
brew install --cask lockedcode-desktop

# Windows (Scoop)
scoop bucket add extras; scoop install extras/lockedcode-desktop

Installation Directory

The install script respects the following priority order:

1. $LOCKEDCODE_INSTALL_DIR — Custom installation directory
2. $XDG_BIN_DIR — XDG Base Directory Specification compliant path
3. $HOME/bin — Standard user binary directory
4. $HOME/.lockedcode/bin — Default fallback

# Examples
LOCKEDCODE_INSTALL_DIR=/usr/local/bin curl -fsSL https://lockedcode.ai/install | bash
XDG_BIN_DIR=$HOME/.local/bin curl -fsSL https://lockedcode.ai/install | bash

Post-Install: Security Capability Check

After installation, run:

lockedcode --security-check

This reports the security capabilities available on your platform: confinement backend, scanner availability, policy file detection, and air-gap mode status.

Quick Start: Security Configuration

LockedCode works out of the box with sensible defaults. For custom configuration, create a lockedcode.yaml at your project root:

security:
  strictness: standard          # strict | standard | permissive

  confinement:
    pre_approved_paths:
      - ~/.npm                  # npm cache
      - ~/.bun                  # bun cache
      - /tmp                    # temp directory

  scanning:
    semgrep: true
    yara: true
    entropy: true
    secrets: true

  dlp:
    redaction_mode: true        # redact secrets instead of blocking files
    sensitivity_patterns:
      - "**/.env*"
      - "**/credentials.*"
      - "**/config/production/**"

  trust:
    auto_approve_below: 20      # auto-approve low-risk actions
    prompt_above: 50            # require approval for medium+ risk
    block_above: 90             # hard-block critical risk

  audit:
    retention_days: 90

Agents

LockedCode includes the same built-in agents as OpenCode, with security policies applied to all of them:

• buildDefault, full-access agent for development work. All actions pass through the security layer.
• planRead-only agent for analysis and code exploration. Denies file edits by default. Asks permission before running bash commands. Security scanning still applies to any approved operations.
• generalSubagent for complex searches and multistep tasks. Invoked using @general in messages. Security policies cascade with no privilege escalation.

Relationship to OpenCode

LockedCode is a fork of OpenCode (MIT License). It tracks upstream development and selectively merges new features and fixes. All original OpenCode capabilities — provider integrations, TUI, LSP support, MCP, client/server architecture, plugin system — are fully preserved.

The fork diverges in one dimension: LockedCode adds a security layer that OpenCode's maintainers are unlikely to add as a core feature, because deep security confinement adds friction by design.

LockedCode is for organizations and developers who need that friction — who need verifiable evidence that the agent can't do anything it wasn't supposed to.

vs OpenCode

Everything OpenCode does, plus:

• OS-level directory confinement (Landlock, sandbox-exec, restricted tokens)
• Static scanning of all LLM-generated code before it touches the filesystem
• Shell command parsing and analysis before execution
• Outbound DLP preventing secrets and PII from reaching the model
• Prompt injection detection on ingested files
• Secret detection in generated code
• Immutable, content-hashed audit trail
• Declarative policy engine with configurable strictness
• Trust scoring with score-driven approval UX
• Multi-agent security cascade
• Full air-gap mode with bundled rule sets

vs Claude Code

Everything that differentiates OpenCode from Claude Code, plus the full security layer above:

• 100% open source
• Not coupled to any provider — works with Claude, OpenAI, Google, or local models
• Security layer that treats every model as potentially adversarial
• Built-in opt-in LSP support
• Terminal-first TUI, built by neovim users
• Client/server architecture allowing remote operation from a mobile app

Documentation

For more info on how to configure LockedCode, including detailed security configuration, policy authoring, and platform-specific confinement setup, head over to our docs.

Contributing

If you're interested in contributing to LockedCode, please read our contributing docs before submitting a pull request. Security-related contributions — new scanner rules, confinement improvements, and audit trail enhancements — are especially welcome.

License

LockedCode is licensed under the MIT License. It includes attribution to the original OpenCode project by anomalyco.