We Replaced a $200 Claude Code Seat With a $100 OpenCode Setup

In October we cancelled a $200 a month seat and replaced it with a $100 one.

Not because the expensive model got worse. Because the subscription bundled three things we had been treating as one: a harness, a model, and an invisible quota. Once we separated them, only one of the three was worth paying for at that price.

The $200 Seat Stopped Covering the Work

Claude Max 20x costs $200 a month. Anthropic does not publish how many messages or tokens that buys. What it does publish is a five-hour rolling window and a weekly cap, and if you have used a Max seat through a heavy week you know the shape of the experience: fine on Monday, rationing by Thursday.

That was survivable when Opus was a treat you reached for on hard problems. It stopped being survivable when Opus 5.5 became the sensible default for most work. At $4 per million input tokens and $20 per million output, a single long agent session with heavy context re-reading is an expensive object, and the cap is what stands between you and the bill.

So the honest description of the old arrangement is this. We paid $200 for the right to run an agent until an unpublished limit stopped us, and we paid it mostly because the harness was good.

The harness is not the expensive part. The harness is a loop around a model call, a set of tools, and a permission system. OpenCode now does that in the open, for nothing, with an API you can extend.

What We Actually Built

OpenCode 2.0 shipped on 14 October and it is the reason this became practical rather than fiddly. The parts that matter for this setup are unglamorous:

• The server runs as one background process. The TUI, the desktop app and anything scripted talk to the same session.
• There is a real plugin API with hooks, including tool.execute.before, which lets you refuse an action before it happens.
• Agents are first-class config. A primary agent and a subagent can run different models, different temperatures and different permissions.
• Background subagents let the primary agent hand work off while it keeps going.
• The whole thing is hot-reloadable, so a plugin can be written and used in the same session.

We use five agents, drawn from three vendors on purpose.

The config below is a trimmed V2 example, not the whole harness. Run opencode models to see the exact ids your own plan exposes, because they change with your Copilot tier.

{
  "$schema": "https://opencode.ai/config.json",
  "agents": {
    "plan": {
      "model": "github-copilot/claude-opus-5-5",
      "permissions": [
        { "action": "tool:edit", "resource": "*", "effect": "deny" },
        { "action": "tool:write", "resource": "*", "effect": "deny" }
      ]
    },
    "build": {
      "model": "ollama-cloud/deepseek-v4.1-flash:1017"
    },
    "review-a": {
      "description": "Independent review. Read-only. Security, correctness, lifecycle.",
      "model": "github-copilot/claude-opus-5-5",
      "permissions": [{ "action": "*", "resource": "*", "effect": "deny" }]
    },
    "review-b": {
      "description": "Independent review from a different vendor ecosystem.",
      "model": "github-copilot/gpt-6-astra",
      "permissions": [{ "action": "*", "resource": "*", "effect": "deny" }]
    },
    "explore": {
      "description": "Read-only codebase search. Never worth frontier rates.",
      "model": "ollama-cloud/deepseek-v4.1-flash:1017",
      "permissions": [
        { "action": "tool:edit", "resource": "*", "effect": "deny" },
        { "action": "tool:write", "resource": "*", "effect": "deny" }
      ]
    }
  }
}

The roles matter more than the model names. plan is configured without the edit and write tools, so it cannot quietly rewrite the requirement to match what it built. build can edit but is refused the obvious push, publish and merge commands, because the guardrail is code rather than a sentence in a prompt. The reviewers carry a blanket deny, which means their output is an opinion you can act on and not a change you have to trust.

That is the whole argument in one line. A reviewer with edit rights is a second author, and a second author does not review.

The Plugin That Catches the Obvious Mistakes

OpenCode 2.0 implements nearly all of its own features as internal plugins, which is a good sign for the API surviving contact with real use. The V2 plugin API is not the V1 one: a V2 plugin exports Plugin.define and registers hooks inside setup. Ours is small. It refuses direct secret reads and the commands an implementer should never run on its own authority.

// .opencode/plugins/implementer-guard/index.ts
import { Plugin } from "@opencode/plugin"

const SECRETS = [".env", ".aws/credentials", ".ssh/id_", "auth.json"]

const FORBIDDEN = [
  /\bgit\b[^\n]*\bpush\b/,
  /\bnpm\s+publish\b/,
  /\bgh\s+pr\s+merge\b/,
]

const mentionsSecret = (value: string) =>
  SECRETS.some((secret) => value.includes(secret))

export default Plugin.define({
  id: "implementer-guard",
  async setup(ctx) {
    await ctx.tool.hook("execute.before", (event) => {
      if (event.tool === "read") {
        const file = String(event.input?.filePath ?? "")
        if (mentionsSecret(file)) {
          throw new Error(`Blocked secret read: ${file}`)
        }
      }

      if (event.tool === "bash") {
        const command = String(event.input?.command ?? "")
        if (mentionsSecret(command)) {
          throw new Error(`Blocked secret access: ${command}`)
        }
        if (FORBIDDEN.some((re) => re.test(command))) {
          throw new Error(`Blocked command for implementer: ${command}`)
        }
      }
    })
  },
})

OpenCode loads a local plugin directory from .opencode/plugins/implementer-guard/. No build step, no publish, no marketplace. Note the version: a V1 plugin that returns a string-keyed hook object will not run under V2, which is exactly the sort of migration detail that turns a copied example into an afternoon.

Now the limits, stated once. This plugin is a tripwire, not a sandbox. It reads the arguments the agent passes and refuses the obvious forms. An agent that base64-decodes a path, or shells out through python -c, or finds a command variant the regex does not anticipate, gets past it. It catches some accidental requests; it does not contain a determined process.

That is why the real boundary has to be outside the harness: a container without your SSH keys or cloud sessions mounted, short-lived scoped credentials, and an egress allowlist. Use the plugin to catch mistakes and isolation to limit what the agent can reach.

What It Costs

Here are the subscription prices and implementation options, not a single bill. The $100 in the headline is the fixed frontier line, and it is the one that replaced the $200 seat. Everything below it is either free or metered.

The fixed subscription is $100; the monthly total depends on implementation usage and on whether you buy extra Copilot credits. That is the honest shape of it. We chose Max for the larger allowance rather than for access, and we have not published a billing period total here because the implementation line moves with the work.

The $100 is not a trick, and it is not free either. Copilot Max carries the larger credit pool and access to the top tier models, and OpenCode connects to a Copilot subscription through /connect. We are using one vendor's billing relationship to reach models from two vendors, plus a third provider entirely for the volume work.

The trade is real. We left a subscription with an unpublished cap and bought a subscription with a published credit pool. That is better, because we can see the meter and budget against it, but it is still a meter. A team that sends every commit through Opus 5.5 and GPT-6 Astra for review will spend real money, and the plan does not make that disappear. What the split does is put the expensive calls where they earn their price and the cheap calls everywhere else.

The volume work is where the money went before. DeepSeek V4.1 Flash 1017 lists $0.15 per million input tokens and $0.60 output off-peak, doubling at peak. Ollama's hosted pricing for the same weights lists $0.003 per million cached input off-peak and $0.006 at peak, so quote the peak number when you are budgeting rather than the flattering one. The mechanism behind the saving is cache: long agent sessions are mostly re-reads, and DeepSeek describes a KV-cache reduction of roughly 437 times against its V1 generation. That is an architectural claim from a widely shared analysis, not a measurement of our own cache-hit share. We are not going to quote a cost per task, because we have not measured one.

Two notes on the arithmetic.

First, credits are not unlimited. Copilot's tiers come with an allowance and then metered usage, so a team that plans and reviews every single commit through a frontier model can still spend real money. We route deliberately: the planner sees the requirement and the interfaces, the reviewers see the diff, and neither sees the 40,000 tokens of test output.

Second, local inference still uses hardware and electricity. If you already own the machine, the marginal cost is power. If you need to buy hardware, include that purchase before claiming a saving.

What the Split Actually Buys

The cost story is easy. The quality story is the reason we kept it.

A single model in a single context has one view of a problem, and that view was formed by the same conversation that produced the code. If it misunderstood the requirement, the review inherits the misunderstanding. You get a confident second pass over the same mistake.

Split the roles and the reviewer reads the diff cold. It has the requirement and the change, not the twenty minutes of reasoning that produced it. That gives it a chance to question assumptions the implementing session has already accepted.

Using two vendors is not tribal. It is variance. Claude and GPT models fail differently. One over-engineers the abstraction, the other under-specifies the boundary. Agreement between them is a useful signal. A finding still needs checking when only one reviewer raises it; consensus is not a substitute for judgement.

Our working estimate, from our own logs, is two to three times fewer escaped defects than the single-model setup we ran before. We cannot defend that number. Treat it as a belief about the mechanism rather than a result, and the next section explains why we are not dressing it up as one.

What We Have Not Measured

We have not run a controlled trial. We have no randomised task set, no blinded reviewers and no counterfactual branch where the same work ran through one harness with one model.

What we do have is a defect log before and after, our own memory of which classes of bug used to reach production, and a strong prior about why independent review works. The mechanism is legible: separation of authorship from judgement, different context, different vendor, read-only tools. These observations do not establish a reliable improvement rate.

If you want the real number for your team, the experiment is cheap. Take ten merged changes from last quarter and re-run the review with an independent agent. That can surface missed defects; it cannot measure how much this setup would have reduced production defects.

The Security Bill Nobody Quotes

Neither half of this setup is automatically safer. On 17 October OpenCode warned that a breach of its Console platform may have exposed AI provider keys for 1.4% of Console users, all of whom had linked external providers. It described the incident as related to a large-scale distillation attack. At the end of the same month, Phorion published an analysis of Claude Code for VS Code versions 2.1.312 and 2.1.313 on the Cursor Marketplace, which contained an injected function that planted an SSH key and opened a reverse tunnel before the extension's own startup code ran.

Read those side by side and the lesson is not "open source good, marketplace bad". One was a hosted credential service and the other an editor marketplace. Different channels, same delegated trust, and the same question about what the tool can reach once it is running.

Our setup removes one of those channels and does nothing about the supply chain.

It removes OpenCode Console from the credential path. With a local V2 server, saved provider credentials live in the server's SQLite database rather than in a hosted account, and the legacy auth.json file is only migration input. That is a narrower blast radius, not an absence of one. It also removes the editor marketplace from the plugin path, because plugins are files in a directory we control and the harness is installed from a package registry we already audit.

It does nothing about the software underneath. Ollama is software. OpenCode is software. Bun installs the packages your plugin imports at startup. A malicious dependency in any of those gets the same privileges as the agent. We treat the harness exactly like any other privileged developer tool: pinned versions, a container, no production credentials, and an egress allowlist.

If you want the longer version of this argument, it is in The Month the Web Got Cheaper and Less Trustworthy and in Nothing Asked Permission.

When This Is the Wrong Choice

We would not recommend this to everyone, and the cases where it fails are predictable.

If your work is mostly ambiguous, keep the best model in the driver's seat. The hybrid shines on well-specified volume: tests, migrations, refactors with a clear target, the fourth component that looks like the first three. It is weaker when the requirement itself is the problem, because the cheap implementer will confidently build the wrong thing and the reviewer will confidently approve it.

If you need one vendor to hold the contract, this is not for you. Splitting models across a Copilot bill and a local runtime means your support story is a config file you own. That is the point, and it is also the cost.

If nobody on the team will maintain the config, do not start. Agent definitions, permissions and plugin hooks drift. A setup nobody owns becomes a security hole with good documentation.

And if the $200 seat is genuinely covering your week without friction, keep it. The argument here is not that subscriptions are bad. It is that you should know which part you are paying for.

Frequently Asked Questions

Does OpenCode Work With a GitHub Copilot Subscription?

Yes. OpenCode ships a GitHub Copilot provider, and you connect it with the /connect command rather than an API key. That is how one Copilot Max subscription at $100 reaches both Anthropic's Opus 5.5 and OpenAI's GPT-6 Astra from inside OpenCode. The exact model ids available depend on your Copilot tier, so run opencode models after connecting to see what your plan actually exposes. Lower tiers carry smaller credit allowances and a narrower model set.

Is a Hybrid Setup Actually Cheaper Than Claude Code Max?

For us, yes, but the reason is routing rather than price alone, and the margin is smaller than the token prices suggest. A Max 20x seat costs $200 a month and does not publish how much work it includes. Copilot Max costs $100 and publishes a credit pool instead. The hybrid spends that $100 on frontier planning and review, then sends the high-volume work to DeepSeek V4.1 Flash at $0.15 per million input tokens off-peak with cached input at $0.003. If your work is mostly ambiguous design problems that need a frontier model all day, the credit pool becomes the constraint and the saving shrinks.

Is DeepSeek V4.1 Flash Good Enough to Write Production Code?

For bounded work with a clear target, yes. It handles tests, migrations, refactors, component variants and the kind of change where the interesting decision was already made. It is not where we would put an ambiguous architectural call. The pattern that works is to give it a tight ticket, a reviewed plan and a test suite that can tell it when it is wrong, then let an independent reviewer read the diff. Treat it as a fast, literal contractor rather than a design partner.

What Changed After the OpenCode Breach?

We stopped treating hosted agent consoles as credential stores. On 17 October OpenCode warned that the Console incident may have exposed provider keys for 1.4% of Console users who had linked external providers, naming OpenAI, Anthropic and Google. Our model credentials now live in the local server's database rather than a hosted account, the console is not in the credential path, and the guard plugin refuses the direct read path and the obvious commands that would expose a credential file. That plugin is a tripwire rather than a containment boundary, so the load-bearing controls are the container, the short-lived scoped credentials and the egress allowlist. We also pin harness versions, because a local setup still depends on OpenCode, Ollama and every package the plugin imports.

Can the Implementer Run Fully Offline?

Yes, if your hardware can hold the model, but it is a separate profile rather than what the config above shows. DeepSeek published the V4.1 Flash 1017 weights on 17 October, and OpenCode treats Ollama as a custom provider, so the implementing agent can run with no network path at all. The config in this article points build at Ollama's hosted tier, because that is what works on a laptop. For client work that cannot leave the building we run a second profile with a local Ollama endpoint and no hosted provider configured. The tradeoff is throughput, and the reviewer still needs a frontier model, so "fully offline" usually means "offline for the code, online for the judgement".

Sources

• Anomaly. (2026, October 14). "OpenCode 2.0." Read notes
• OpenCode. (2026). "Agents" and "Plugins" documentation. Read agents Read plugins
• OpenCode. (2026). "Providers" documentation, including GitHub Copilot and Ollama. Read providers
• DeepSeek. (2026, October 17). "DeepSeek-V4.1-Flash-1017 model card." View repository
• DeepSeek. (2026). "Models and pricing." Read pricing
• Yottalabs. (2026, October 19). "DeepSeek V4.1 Flash pricing: off-peak and peak rates." Read analysis
• G. (2026, October 7). "Why isn't the industry freaking out about DeepSeek 4.1 Flash?" Read post
• Anthropic. (2026). "Claude Opus 5.5 pricing and plans." Read pricing
• GitHub. (2026, October 28). "Route and orchestrate models with GitHub Copilot Fusion." Read changelog
• GitHub. (2026). "About GitHub Copilot Fusion." Read documentation
• The Hacker News. (2026, October 19). "OpenCode Console breach may have exposed OpenAI, Anthropic and Google API keys." Read report
• Phorion. (2026, October 30). "Official Claude Code extension compromise: security advisory." Read advisory