# OpenCode

Source: /docs/mcp/connect/opencode

OpenCode reads MCP servers from its config file: `~/.config/opencode/opencode.json` for every project, or `opencode.json` in a project root for that project only.

### Get a token [#get-a-token]

Open the dashboard's [Connect an agent](https://app.orbitorca.com/mcp) page and create a token. **Read & write** is the recommended choice — it lets the agent deploy, restart, and manage your apps hands-free. Pick read-only if the agent should only look. The full token is shown **once**, at creation — copy it now.

### Add the server [#add-the-server]

Merge this into `~/.config/opencode/opencode.json`, with your token in place of `{{token}}`:

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "orbitorca": {
      "type": "remote",
      "url": "https://api.orbitorca.com/mcp",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer {{token}}"
      }
    }
  }
}
```

Keep `"oauth": false`: the server authenticates with your token, and without it OpenCode tries to start an OAuth flow instead. Run `opencode mcp list` to check that `orbitorca` is listed.

### Try it [#try-it]

Ask OpenCode to *"list my OrbitOrca apps"*. If it comes back with your apps, you're connected.

## Keep the token out of the file [#keep-the-token-out-of-the-file]

OpenCode fills `{env:VAR}` from your environment, so the header can point at a variable instead of holding the token:

```json
"headers": { "Authorization": "Bearer {env:ORBITORCA_TOKEN}" }
```

Then set `ORBITORCA_TOKEN` in the environment OpenCode starts from, for example in your shell profile.

## Approvals [#approvals]

OpenCode starts from permissive defaults, so it may run tools without asking you first. To be asked before each tool call, set a catch-all `"ask"` rule in its `permission` config — see [OpenCode's permissions docs](https://opencode.ai/docs/permissions/) for the exact rules — or use a read-only token if the agent should only look.

The dashboard's [Connect an agent](https://app.orbitorca.com/mcp) page generates this block with your token already filled in — copy it from there if you'd rather not edit by hand.

Next: [what a token can and can't do](/docs/mcp/scopes-and-safety).