A Technical Critique of OpenCode CLI's Prompt Caching and Security Flaws
A technical analysis critiques the agentic CLI tool OpenCode, highlighting significant inefficiencies in its prompt caching mechanism and critical security vulnerabilities. Specifically, the tool invalidates its prompt cache frequently by reading files on every turn and inserting dynamic data like the current date into the system prompt. As agentic developer tools gain popularity, inefficient prompt caching can lead to high latency and unnecessary API costs for developers. Furthermore, security flaws in CLI tools that execute commands locally pose severe risks to developers' environments. The critique reveals that OpenCode scans the filesystem and re-reads configuration files like AGENTS.md on every Server-Sent Events (SSE) turn. Additionally, inserting the current date into the initial system prompt forces a full re-evaluation of the prompt cache, defeating the purpose of caching.
## BACKGROUND
Agentic CLI tools are terminal-based assistants that can run commands, write code, and automate workflows using Large Language Models (LLMs). Prompt caching is a technique used by LLM providers to store frequently used prompt segments, which reduces API latency and token costs. When a prompt changes even slightly, the cache is invalidated, requiring the LLM to reprocess the entire input.