opencode.example.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "instructions": [
    "AGENTS.md",
    "./opencode-cnvd/docs/workflow.md",
    "./opencode-cnvd/docs/memory.md",
    "./opencode-cnvd/docs/model-allocation.md",
    "./opencode-cnvd/docs/sanitization.md"
  ],
  "plugin": [
    "./opencode-cnvd/cnvd-plugin.ts"
  ],
  "default_agent": "cnvd-chief",
  "permission": {
    "edit": "deny",
    "bash": "allow"
  },
  "tools": {
    "write": false,
    "edit": false,
    "patch": false,
    "redteam_post_exploit*": false,
    "redteam_persistence*": false,
    "redteam_lateral*": false,
    "redteam_credential*": false,
    "redteam_vuln_scan": true,
    "redteam_ext_tools_status": true
  },
  "mcp": {
    "cnvd": {
      "type": "local",
      "command": [
        "python",
        "/path/to/cnvd-mcp-server/mcp_stdio_server.py",
        "--stdio"
      ],
      "enabled": true
    }
  },
  "agent": {
    "cnvd-chief": {
      "mode": "primary",
      "model": "deepseek/deepseek-v4-pro",
      "description": "CNVD漏洞挖掘总规，负责授权边界、任务拆解、agent调度和最终决策。",
      "prompt": "{file:./opencode-cnvd/prompts/cnvd-chief.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      }
    },
    "scope-governor": {
      "mode": "subagent",
      "model": "sub2apapi/gpt-5.5",
      "description": "授权范围与操作边界审查员，判断目标、动作和证据是否合规。",
      "prompt": "{file:./opencode-cnvd/prompts/scope-governor.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "tools": {
        "redteam*": false,
        "bash": false,
        "write": false,
        "edit": false,
        "patch": false
      }
    },
    "asset-collector": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-flash",
      "description": "资产收集工程师，负责被动信息收集、资产归类和攻击面梳理。",
      "prompt": "{file:./opencode-cnvd/prompts/asset-collector.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      }
    },
    "attack-surface-analyst": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-pro",
      "description": "攻击面分析工程师，负责从资产、技术栈和入口点推导测试路径。",
      "prompt": "{file:./opencode-cnvd/prompts/attack-surface-analyst.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      }
    },
    "cve-researcher": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-flash",
      "description": "CVE与CNVD线索研究员，负责组件版本、历史漏洞、公开通告和可验证影响面分析。",
      "prompt": "{file:./opencode-cnvd/prompts/cve-researcher.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      }
    },
    "mcp-cnvd-operator": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-pro",
      "description": "漏洞检测 MCP 操作员，负责选择低风险 MCP 工具、整理结果并转交验证。",
      "prompt": "{file:./opencode-cnvd/prompts/mcp-cnvd-operator.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "tools": {
        "redteam_vuln_scan": true,
        "redteam_ext_tools_status": true,
        "redteam_post_exploit*": false,
        "redteam_persistence*": false,
        "redteam_lateral*": false,
        "redteam_credential*": false
      }
    },
    "campaign-monitor": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-flash",
      "description": "长期任务巡检员，负责检查campaign阶段、缺失证据、未完成任务和待审批风险。",
      "prompt": "{file:./opencode-cnvd/prompts/campaign-monitor.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      }
    },
    "pentest-engineer-1": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-pro",
      "description": "渗透测试工程师 1，负责授权范围内的非破坏性探测与漏洞假设验证，可配置独立模型。",
      "prompt": "{file:./opencode-cnvd/prompts/pentest-engineer.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      },
      "tools": {
        "redteam_vuln_scan": true,
        "redteam_ext_tools_status": true
      }
    },
    "pentest-engineer-2": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-flash",
      "description": "渗透测试工程师 2，负责授权范围内的非破坏性探测与漏洞假设验证，可配置独立模型。",
      "prompt": "{file:./opencode-cnvd/prompts/pentest-engineer.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      },
      "tools": {
        "redteam_vuln_scan": true,
        "redteam_ext_tools_status": true
      }
    },
    "pentest-engineer-3": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-pro",
      "description": "渗透测试工程师 3，负责授权范围内的非破坏性探测与漏洞假设验证，可配置独立模型。",
      "prompt": "{file:./opencode-cnvd/prompts/pentest-engineer.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      },
      "tools": {
        "redteam_vuln_scan": true,
        "redteam_ext_tools_status": true
      }
    },
    "vuln-validator": {
      "mode": "subagent",
      "model": "deepseek/deepseek-v4-pro",
      "description": "漏洞验证工程师，负责复现链、误报排除、影响评估和最小化证明。",
      "prompt": "{file:./opencode-cnvd/prompts/vuln-validator.md}",
      "permission": {
        "edit": "deny",
        "bash": "allow"
      },
      "tools": {
        "redteam_vuln_scan": true
      }
    },
    "audit-engineer": {
      "mode": "subagent",
      "model": "sub2apapi/gpt-5.4",
      "description": "操作审计工程师，负责记录每次目标、工具、参数、结果和风险决策。",
      "prompt": "{file:./opencode-cnvd/prompts/audit-engineer.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "tools": {
        "redteam*": false,
        "bash": false,
        "write": false,
        "edit": false,
        "patch": false
      }
    },
    "report-engineer": {
      "mode": "subagent",
      "model": "sub2apapi/gpt-5.5",
      "description": "报告整理输出工程师，负责CNVD提交材料、复现步骤和修复建议。",
      "prompt": "{file:./opencode-cnvd/prompts/report-engineer.md}",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "tools": {
        "redteam*": false,
        "bash": false,
        "write": false,
        "edit": false,
        "patch": false
      }
    }
  }
}