OpenCode

OpenCode reads MCP servers from its config file: ~/.config/opencode/opencode.json for every project, or opencode.json in a project root for that project only.

Get a token

Open the dashboard's Connect an agent page and create a token. Read & write is the recommended choice — it lets the agent deploy, restart, and manage your apps hands-free. Pick read-only if the agent should only look. The full token is shown once, at creation — copy it now.

Add the server

Merge this into ~/.config/opencode/opencode.json, with your token in place of {{token}}:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "orbitorca": {
      "type": "remote",
      "url": "https://api.orbitorca.com/mcp",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer {{token}}"
      }
    }
  }
}

Keep "oauth": false: the server authenticates with your token, and without it OpenCode tries to start an OAuth flow instead. Run opencode mcp list to check that orbitorca is listed.

Try it

Ask OpenCode to "list my OrbitOrca apps". If it comes back with your apps, you're connected.

Keep the token out of the file

OpenCode fills {env:VAR} from your environment, so the header can point at a variable instead of holding the token:

"headers": { "Authorization": "Bearer {env:ORBITORCA_TOKEN}" }

Then set ORBITORCA_TOKEN in the environment OpenCode starts from, for example in your shell profile.

Approvals

OpenCode starts from permissive defaults, so it may run tools without asking you first. To be asked before each tool call, set a catch-all "ask" rule in its permission config — see OpenCode's permissions docs for the exact rules — or use a read-only token if the agent should only look.

The dashboard's Connect an agent page generates this block with your token already filled in — copy it from there if you'd rather not edit by hand.

Next: what a token can and can't do.