OpenCode source code review reveals 7 external domain connections with mixed privacy controls and 12 unmerged community contributions pending over 3 months.

OpenCode contacts 7 external domains (app.opencode.ai, api.opencode.ai, opencode.ai, opncd.ai, models.dev and others) with varying opt-in requirements and disable flags

User prompts are NOT sent through web UI proxy; only HTML/JS/CSS assets are handled there, maintaining better privacy than initially feared

Critical feature gaps: no disable flag yet for app.opencode.ai (developers promise to bundle when moving to Node), and models.dev startup calls cannot be disabled

Despite privacy concerns, reviewer confirms OpenCode remains the best agentic coding tool tested in 1.5 years with excellent TUI functionality for serious workflows

12 community pull requests remain unmerged for over 3 months, indicating potential maintenance or review bottlenecks in the project