opencode 1.17.10 Expands MCP Resources Without Pretending Instructions Are Global Truth

opencode 1.17.10 is a broad release, but the useful story is narrower: MCP is becoming real enough that clients now have to care about provenance, resource naming, OAuth loopback behavior, structured errors, and the difference between a URL and a path. That is good news. It means the protocol is leaving the demo phase and entering the “why did this tool fail only on WSL?” phase, which is where useful software gets made.

The release shipped on June 24 at 20:37:42 UTC with 37 assets and four GitHub reactions, three rockets and one hooray. The compare from v1.17.9 to v1.17.10 is large: 190 ahead commits, one behind commit, and 300 files changed. Release notes include MCP server instructions, opencode-managed provider integration support, MCP resource template listing, MCP resource read tools, --mini mode, resource-template access-denial hiding, resource-tool collision prevention, legacy MCP tool-name restoration, IPv4 loopback OAuth binding, and preserved structured error details.

Server instructions are useful until they become ambient authority

PR #32490 appends MCP InitializeResult.instructions into session context, but with a crucial scoped block: Instructions from: MCP server <server>. The inserted text says the instructions apply to tools whose names start with the server prefix and to prompts/resources from that server. That sentence is doing real security work.

MCP server instructions are obviously useful. A server may know how its tools should be called, what constraints apply, which resources are safe to combine, or what workflow prevents bad results. But dumping server-provided instructions into the system prompt without scope is how a tool server’s local guidance becomes global policy. The model can easily blend “when using this tool, prefer X” into “always prefer X.” That is not a protocol bug; it is a context-design bug.

opencode’s approach is the right direction: include provenance, name the server, and state the scope. The model may still overgeneralize, because models are not proof engines. But the runtime has at least provided a correct contract: these instructions are server-local, not a new constitution for the whole session.

Anyone building an MCP client should copy the principle. Never launder third-party server instructions into anonymous system text. Label them. Scope them. Keep them close to the tool namespace they govern. If the server is untrusted or tenant-specific, make that visible in logs and, where appropriate, in the model context itself.

MCP resources need namespaces, not wishful thinking

The release also makes MCP resources more first-class with resource template listing and resource read tools. That is necessary. Discovery is not enough if the agent cannot read the resource during normal work. But once resources become tools, all the old tool problems arrive: collisions, denied access, legacy names, structured failures, and provider compatibility.

opencode explicitly hides MCP resource-template tools when access is denied and prevents resource tools from colliding when servers expose the same keys. That is the right instinct. A denied capability should not appear as a broken handle the model keeps trying to use. A colliding key should not depend on whichever server happened to register first. Namespaces are not ceremony in agent runtimes. They are how a model’s intended capability maps to the thing the runtime actually invokes.

The structured error detail fix belongs here too. If an MCP call fails and the client surfaces only “tool failed,” the model cannot recover and the human cannot debug. Preserving structured errors lets clients branch, retry, request auth, or point the user to the exact config issue. Agent tooling does not need more mystery failures. It needs boring error contracts.

The OAuth loopback bug is a one-line systems lesson

PR #30022 fixes MCP OAuth callback binding by changing the server listener to explicit 127.0.0.1, matching the redirect URI and WSL2 localhost forwarding behavior. The old hostless listen path could bind in a way that made browser callbacks fail under WSL-style networking. This is the kind of bug that reads trivial after the fix and consumes afternoons before it.

The broader lesson is that local OAuth callbacks are security and reliability surfaces. Bind to the exact loopback address your redirect URI uses. Do not accidentally listen more broadly than needed. Test under macOS, Linux, Windows, WSL2, containers, and remote devboxes if those are part of your target market. “Works on my laptop” is not an auth strategy.

PR #33580 fixes a different cross-boundary issue: the skill tool now emits the skill base directory as a filesystem path instead of a file:// URL. The bug hit git-tagged plugin cache directories such as ...git#v1.3.0, where # became %23 and downstream read tools reported “File not found.” This is another small fix with a large lesson. Give the model references in the format the next tool actually accepts. A valid URL is not automatically a valid path for your file-reading tool.

Media support is a capability map, not a universal promise

opencode also adds Gemini protocol support for video MIME types mp4, webm, and quicktime, plus audio types wav, mp3, aiff, aac, ogg, and flac, raising media limits to 20 MB decoded and 28 MB encoded. That is adjacent to coding, but increasingly relevant. Debugging sessions now include screenshots, terminal recordings, browser captures, voice notes, and clips of UI bugs.

The important part is provider specificity. Some providers can handle this media. Others cannot. A mature agent client should expose a capability map rather than pretending every model path accepts every artifact. Silent coercion is how a video turns into useless text or an audio note disappears without a clear error.

For builders, opencode 1.17.10 offers a practical MCP checklist. Scope server instructions by provenance and namespace. Make resource tools first-class but collision-resistant. Hide denied capabilities instead of baiting the model with unusable handles. Bind OAuth callbacks to the exact loopback address in the redirect URI. Emit paths in downstream-tool format, not merely standards-compliant URLs. Preserve structured errors. And treat media support as provider capability, not a global promise.

The release is valuable because it does not pretend MCP maturity is one big feature. It is many small boundaries: instruction scope, resource names, callback sockets, path formats, error shapes, and provider-specific media. That is where agentic coding is now. Not “can the model call a tool?” but “can the runtime keep enough provenance intact that calling the tool is safe, debuggable, and portable?”

Sources: GitHub release — anomalyco/opencode v1.17.10, GitHub compare, PR #32490, PR #30022, PR #33580, PR #31889