opencode.json

{
  "$schema": "https://opencode.ai/config.json",

  "instructions": ["./instructions.md"],

  "mcp": {
    "securable": {
      "type": "local",
      "command": ["node", "./tools/mcp_server.js"],
      "environment": {
        "SECURABLE_DATA_DIR": "./data",
        "SECURABLE_TEMPLATES_DIR": "./templates"
      }
    }
  },

  "command": {
    "securability-review": {
      "description": "Run a FIASSE/SSEM securability review on the current workspace",
      "prompt": "Use the securability_review tool to analyze the code in this workspace. Review the results and present a summary of the SSEM scores, key findings, and recommended improvements."
    },
    "secure-generate": {
      "description": "Run end-to-end securable code generation workflow with review execution and final scoring",
      "prompt": "Run an end-to-end securable generation workflow that follows five-step play and do not reorder steps. If required inputs are missing, ask only for the minimum needed to proceed (PRD/spec path, target language/framework, and code scope).\n\nStep 1 - Requirements/spec enhancement:\n- Use prd_securability_enhance first against the provided PRD/spec.\n- Produce ASVS-mapped enhanced requirements, feature securability notes, and open assumptions/gaps.\n\nStep 2 - FIASSE-guided generation/refactor:\n- Use secure_generate with the enhanced requirements from Step 1 to produce the generation contract/handoff.\n- Implement or refactor code in the workspace based on that contract with trust-boundary discipline and tests.\n\nStep 3 - Baseline securability review:\n- Use securability_review to score the implemented/refactored code.\n- Present baseline pillar scores and overall score plus prioritized findings.\n\nStep 4 - Execute on review findings:\n- Apply high-impact review recommendations directly in code.\n- Re-run securability_review after changes to get post-enhancement scores.\n\nStep 5 - Final score report:\n- Write securability_report.md in the workspace root including: scope/date, baseline pillar+overall scores, enhancement summary, post-enhancement pillar+overall scores, score deltas, final grade, and concise next recommendations.\n- End with a clear final securability score and grade.\n\nWorkflow guards:\n- Do not generate/refactor before Step 1 completes.\n- Do not skip the baseline review before implementing enhancements.\n- Do not finish without writing securability_report.md and reporting final score delta."
    },
    "fiasse-lookup": {
      "description": "Look up FIASSE/SSEM reference material by topic",
      "prompt": "Ask me what FIASSE/SSEM topic I want to look up, then use the fiasse_lookup tool to find relevant sections and guidance. Present the results clearly."
    },
    "prd-enhance": {
      "description": "Enhance a PRD with ASVS and FIASSE/SSEM securability annotations",
      "prompt": "Ask me for the path to a PRD markdown file, then use the prd_securability_enhance tool to annotate it with ASVS requirements and FIASSE/SSEM notes. Present the enhanced PRD."
    }
  },

  "agent": {
    "securability-reviewer": {
      "name": "securability-reviewer",
      "description": "Read-only securability analysis agent — reviews code using FIASSE/SSEM but cannot edit files",
      "mode": "primary",
      "prompt": "You are a securability engineering reviewer. Use the securability_review and fiasse_lookup tools to analyze code for securable engineering qualities using the FIASSE/SSEM framework. Score nine attributes across three pillars (Maintainability, Trustworthiness, Reliability). Present findings using the severity scale: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL. You may NOT edit files — only analyze and report.",
      "permission": {
        "edit": { "*": "deny" },
        "read": { "*": "allow" }
      }
    }
  }
}