OpsCode
Terminal-native AI agent for DevOps, SRE, and Platform Engineering
OpsCode is an open-source coding agent built on the Deep Agents SDK and LangGraph. It works with 20+ LLM providers (Anthropic, OpenAI, Google, and more), ships with 6 specialized DevOps subagents, and can be extended with custom skills, plugins, and MCP servers.
Unlike general-purpose coding agents, OpsCode understands infrastructure. It knows about state locking, blast radius, IAM policies, and why terraform apply without review is a terrible idea. It produces diffs and plans — not unreviewed deployments.
Quick install
curl -LsSf https://raw.githubusercontent.com/talkops-ai/opscode/main/scripts/install.sh | bash
# Launch the interactive TUI
ops
See the Quickstart to configure provider credentials and run your first task.
Why OpsCode?
General-purpose coding agents are great at application code. But they weren't built for infrastructure. They don't understand state locking, blast radius, or why running terraform apply without review is a terrible idea.
OpsCode is purpose-built for the infrastructure lifecycle.
How it compares
| Feature | Aider | OpenHands | Claude Code | OpsCode |
|---|---|---|---|---|
| Interface | Terminal CLI | Web Canvas / CLI | Terminal CLI | Terminal TUI & Headless CLI |
| Focus | Git-native app code | Full-stack software | General coding | DevOps, SRE, & Platform IaC |
| Guardrails | Git revert | Docker sandbox | User confirmation | 3-Tier Approval + Shell/Unicode Scanners |
| Multi-Agent Memory | Shared context | Multi-agent threads | Monolithic context | Isolated BranchMemoryStore per subagent |
| IaC State Safety | — | — | — | "Produce Diffs, Not Deployments" |
| Extensibility | Limited | Plugin API | Skills/MCP | Plugins, Marketplace, Custom Subagents, MCP |
| CI/CD Self-Grading | — | Test suites | — | Autonomous --rubric grader loops |
| MCP Integration | — | Native | Native | Native + 4-Tier Security Guard |
Domain expertise with isolated subagents
Generic coding agents dump hundreds of lines of raw Terraform schemas, Kubernetes manifests, and CLI errors straight into the main context window. That leads to context overflow and hallucinated configs.
OpsCode ships with 6 specialized subagents — each running in its own isolated memory sandbox (BranchMemoryStore). When a subagent searches AWS docs or iterates on a broken plan, all that intermediate work stays inside the subagent. Only the final, validated result comes back to your workspace.
Extend it to any stack
The built-in subagents cover Terraform, OpenTofu, Kubernetes, Ansible, Jenkins, and GitHub Actions. But OpsCode is designed to be extended:
- Plugin system: Install plugins from a marketplace or drop them into
.opscode/plugins/— each can bundle new skills, subagents, MCP servers, and slash commands. - Custom subagents: Create your own subagents in
.opscode/agents/or~/.opscode/agents/— just anAGENTS.mdfile with YAML frontmatter. - 7-tier skill hierarchy: Add skills at any level — built-in, plugin, user, or project — with deterministic priority resolution.
- Async remote subagents: Connect to remote LangGraph deployments via
config.tomlfor distributed workloads.
Safety first, not unchecked autonomy
Application code gone wrong? git revert and move on. Infrastructure gone wrong? Corrupted .tfstate files, dropped databases, public security groups — those create real damage with real blast radius.
OpsCode follows the "Produce Diffs, Not Deployments" principle:
- It generates plans, validates syntax, and inspects schemas.
- It shows you syntax-highlighted diffs and waits for your explicit approval.
- It will not run
terraform applyor perform destructive operations without your consent.
Works in your terminal and your pipelines
OpsCode isn't just an interactive tool — it runs equally well in CI/CD:
- Interactive TUI: Rich Textual interface with live reasoning streams,
/modelhot-swapping, andShift+Tabto toggle approval modes on the fly. - Headless Mode (
-n): Pipe it into Jenkins, GitHub Actions, or GitLab CI. Example:cat pod.yaml | ops -n "..." --rubric @specs/k8s.md -y
Capabilities
Core tools
OpsCode comes with a set of built-in tools for filesystem operations, shell execution, web search, and more:
| Tool | What it does |
|---|---|
execute | Run shell commands with stdout/stderr capture, timeouts, and safety checks |
read_file / write_file / edit_file | Read, create, and edit files with precision replacements |
delete | Remove files (gated behind approval) |
glob / grep / ls | Search and browse the filesystem |
web_search | Search the web for docs, CVEs, error codes, and release notes |
fetch_url | Extract content from documentation URLs |
js_eval | Evaluate JavaScript in an in-memory QuickJS interpreter |
get_goal / update_goal | Inspect and update goal acceptance criteria |
get_rubric | Retrieve rubric specifications for self-evaluation |
Built-in skills
Four global skills are always available to the root agent:
| Skill | What it covers |
|---|---|
cloud-core | Cloud infrastructure fundamentals — IAM, networking, tagging, cost governance |
docker | Dockerfile best practices, multi-stage builds, rootless security, caching |
kubernetes | K8s manifests, Pod Security Standards, RBAC, NetworkPolicies, probes |
remember | Saves learnings and conventions to persistent memory or new reusable skills |
Skills are loaded from multiple locations with a clear priority order — project-level skills override user-level, which override plugin and built-in defaults. See Memory and Skills for the full resolution order.
Built-in subagents
OpsCode ships with 6 DevOps subagents, each with their own system prompts, domain skills, and isolated memory:
| Subagent | Domain | Skills |
|---|---|---|
aws-opentofu-provisioner | OpenTofu on AWS | 7 skills covering IAM, VPC, state management, testing, and MCP schema lookup |
aws-terraform-module-writer | Terraform on AWS | 7 skills for IAM policies, VPC patterns, module layout, and repair loops |
ci-jenkins-automater | Jenkins CI | 4 skills for pipeline generation, Job DSL, shared libraries, and testing |
github-actions-writer | GitHub Actions | 4 skills for workflow architecture, performance, and security hardening |
infra-ansible-provisioner | Ansible | 7 skills for playbook authoring, linting, execution environments, and security |
k8s-helm-provisioner | Kubernetes & Helm | 5 skills for chart authoring, schema validation, secrets, and deployment recovery |
Each subagent runs with isolated memory — intermediate work (AWS doc searches, plan iterations) stays inside the subagent and doesn't pollute your main context. See Subagents.
Platform features
| Feature | What it does |
|---|---|
| Persistent memory | Project-scoped and user-scoped AGENTS.md files carry context across sessions |
| Skill hierarchy | Skills are discovered from built-in, plugin, user, and project directories with clear precedence |
| MCP tools | Connect external tools via Model Context Protocol — with automatic security classification in headless mode |
| Plugins & marketplaces | Install community or team plugins that bundle skills, subagents, MCP servers, and commands |
| 3 approval modes | Manual, Auto, and YOLO — switch mid-session with Shift+Tab |
| Goals & rubrics | Set interactive goals with acceptance criteria, or grade work automatically in CI/CD |
| Remote sandboxes | Run in ephemeral cloud environments (AgentCore, Daytona, Modal, and more) |
| Context compaction | Automatically summarizes older messages when approaching context limits |
| Cost tracking | Real-time token usage and USD cost calculation across all providers |
| Hooks | Run custom logic before or after tool execution via hooks.json |
DevOps environment awareness
OpsCode automatically detects and preserves your infrastructure environment:
- Kubernetes:
KUBECONFIG,KUBE_CONTEXT - AWS:
AWS_PROFILE,AWS_REGION,AWS_DEFAULT_REGION,AWS_SHARED_CREDENTIALS_FILE - GCP:
GOOGLE_APPLICATION_CREDENTIALS,GOOGLE_CLOUD_PROJECT,CLOUDSDK_CORE_PROJECT - Azure:
AZURE_SUBSCRIPTION_ID,AZURE_TENANT_ID - Ansible:
ANSIBLE_CONFIG,ANSIBLE_INVENTORY - Helm:
HELM_HOME,HELM_REPOSITORY_CONFIG - ArgoCD:
ARGOCD_SERVER,ARGOCD_AUTH_TOKEN - Terraform / OpenTofu:
TF_CLI_CONFIG_FILE,TERRAGRUNT_CONFIG
It also recognizes DevOps project markers (terragrunt.hcl, Chart.yaml, ansible.cfg, .opscode/) alongside standard ones (.git, pyproject.toml, package.json).
Architecture
OpsCode is built on:
- Deep Agents SDK — Agent framework with turn streaming, subagent orchestration, and middleware
- LangGraph — Stateful agent orchestration with SQLite checkpointing
- LangChain — LLM provider abstraction and tool interfaces
- Textual — Terminal UI framework for the interactive TUI
- MCP — Model Context Protocol for external tool integration
Every agent turn passes through a modular middleware pipeline that handles context injection, model hot-swapping, safety classification, skill discovery, session checkpointing, rubric grading, and subagent dispatch.
For the complete data location reference, see Configuration.
Not for you if...
We'd rather be upfront about what OpsCode isn't:
- ❌ Not a replacement for code review. Every infrastructure change should still be reviewed by a qualified engineer before it hits production.
- ❌ Not an unmonitored deploy bot. OpsCode produces diffs and plans. It doesn't blindly run
terraform apply -auto-approveon your live environment. - ❌ Not for zero-IaC-knowledge users. You need to understand Terraform, Kubernetes, or Ansible basics to meaningfully review what the agent proposes. If you can't read the diff, you shouldn't approve it.
Contributing
We'd love your help. Check out the Contributing Guidelines and Security Policy before opening a PR.
git clone https://github.com/talkops-ai/opscode.git
cd opscode
uv venv && source .venv/bin/activate
uv pip install -e ".[dev,test-integration]"
uv run pytest tests/ -m unit -v
What's next
- Quickstart — Install OpsCode, launch the TUI, and run your first task.
- CLI Reference — Complete flag and subcommand reference.
- Approval Modes — Choose how OpsCode reviews tool calls.
- Goals and Rubrics — Set goals interactively or grade work in CI/CD.
- Plugins — Extend OpsCode with community and team plugins.
- Memory and Skills — Persistent memory and custom skills.
- Remote Sandboxes — Run in isolated cloud environments.
- Subagents — Delegate tasks to specialized domain subagents.
- Model Providers — 20+ supported LLM providers.
- Configuration — Environment variables, settings resolution, and data locations.
- Credentials — Provider key management.
- config.toml — Full configuration reference.
- Hooks — Lifecycle event subscriptions.
- MCP Tools — External tool integration via MCP.