This week, the OpenCode ecosystem finally got something it has needed for a long time: hard data. A major open-source benchmark dropped, an independent study put a price tag on token overhead, and a viral security critique forced maintainers to answer for their choices. Here is the roundup that matters.
1. Supabase Evals: Coding Agents Finally Get a Report Card
Supabase open-sourced supabase/evals on July 31 -- a benchmark and framework that runs coding agents like Claude Code, Codex, and OpenCode against real Supabase tasks: building a schema, debugging a failed Edge Function, or fixing a broken Row Level Security policy. It now powers both a published benchmark and an internal regression suite the team monitors daily.
The setup is refreshingly honest. Every scenario runs against a real Supabase environment, with a hosted-like stack and a local CLI project spun up in containers, so agents actually invoke the real MCP server and CLI. Scoring combines deterministic checks with LLM-as-a-judge, and agents get one retry before being graded. No synthetic toy tasks, no cherry-picked prompts.
The early findings are genuinely useful for anyone running agentic workflows:
- Opus 5 and Kimi K3 hit 100% with no skills loaded at all; skills closed the gap for the rest, with Sonnet 5 jumping from 78% to 100% and GPT-5.6 Sol from 89% to 100%.
- Agents still hand-write migrations instead of reaching for declarative schema workflows, even when the project already uses them.
- Docs usage varies wildly: Codex-based agents read about 8 pages per scenario, while Claude Code checks docs in under 40% of scenarios and reads around 2 pages.
2. The Token Tax: Claude Code vs OpenCode, Measured
On July 12, Systima published a deep study that spliced a logging proxy between each harness and the model endpoint to measure exactly what gets sent. On the same machine, same model, same tasks, Claude Code burned roughly 33,000 tokens of system prompt, tool schemas, and injected scaffolding before the user prompt even arrived. OpenCode used about 7,000.
The cache story is where the gap widens. OpenCode's request prefix was byte-identical run after run, so it paid to cache its payload once and read it back for pennies. Claude Code rewrote tens of thousands of cache tokens mid-session and wrote up to 54x more cache tokens on the same task. Throw in a production 72KB AGENTS.md file -- about 20,000 tokens per request -- and a real setup can be 75,000 to 85,000 tokens deep before a single user word.
The takeaway is not one-sided. Claude Code's request batching can win on multi-step tasks, but re-run on a newer model the same task cost 298,000 tokens against OpenCode's 133,000. Token efficiency is now a measurable competitive dimension, and OpenCode leads the baseline.
3. The Security Reckoning OpenCode Can't Ignore
A blistering critique titled "Stop Using OpenCode" went viral on Hacker News, calling the most popular open-source coding agent "clown-car turboslop" with a security posture that invited trouble. The author documented prompt cache misses, aggressive context pruning, and alarming shell-handling behaviors, citing specific git commits as evidence.
What matters more than the drama is the response. Within days, maintainers disabled tool call pruning by default, removed cross-session persistence of command prefix permissions, and added path validation for bash redirections. The team is reportedly working on version 2 -- a full rewrite -- which reads like an admission that the original architecture needed a reset.
The bottom line: with 160,000-plus GitHub stars and millions of monthly users, OpenCode was always going to end up under this microscope. How an open-source AI coding tool handles a security firestorm is now part of the evaluation, and this week set the template.
What to watch next: Supabase plans to expand benchmark coverage and graduate regression scenarios into the published results. OpenCode 2.0 is in the works. And the token-efficiency race just got a baseline every developer can quote.
Comments