opensrc CLI
CLI and skill from Vercel Labs: takes a package from npm, PyPI, crates.io or GitHub, clones its source at the right version and gives the agent the path
- 3,027 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The tool reaches registries and repositories over the network and clones third-party code to your disk
- Downloaded source lives in ~/.opensrc and the agent can read and run files from it, so do not execute third-party code unchecked
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/opensrcDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The tool reaches registries and repositories over the network and clones third-party code to your disk
- Downloaded source lives in ~/.opensrc and the agent can read and run files from it, so do not execute third-party code unchecked
This is third-party code. Review the repository files before installing.
What it does
opensrc fetches the source code of a dependency so the agent can read the implementation rather than only types and docs. The `opensrc path zod` command finds the package in a registry, makes a shallow clone at the right version tag, caches it under ~/.opensrc and prints the absolute path. Progress goes to stderr and the path to stdout, so the result drops straight into other commands: `rg "parse" $(opensrc path zod)` or `cat $(opensrc path zod)/src/types.ts`. It supports npm (the default), PyPI, crates.io, plus GitHub, GitLab and Bitbucket repositories. For npm packages the tool reads versions from the project lockfiles, for other registries you can pin a version with @, and for a repository a branch or commit with # or @. Besides path there are fetch for pre-loading, list, remove and clean with registry filters. The repository also holds an opensrc skill with triggers like read the source and how does this work internally.
Who it is for. For developers whose agents stumble on library behavior that types and docs do not reveal.
Good fit when
- You need to understand how a library handles an edge case that is not in the docs
- The agent is guessing how a function works and you can check it against the code of the right dependency version
- You want tests or examples from someone else's repository as a model for your own code
- You need to find an implementation in a Python or Rust package, for example `opensrc path pypi:requests`
- You want one command to fetch the source of several packages at once, for example zod, react and next
Not a fit when
- The docs or types answer the question: the skill advises against pulling source for simple API usage
- You need code search inside GitHub without downloading: the tool clones the repository to disk
- There is no disk space for the cache or no network access to registries and GitHub
- You need package security scanning: the tool only downloads source and analyzes nothing
Example request
Fetch the zod source with opensrc and find where ZodError builds the issues listLimitations
The tool ships as a native Rust binary installed globally through npm. The project is marked as a Vercel Labs experiment, so commands and behavior may change. Source is downloaded from registries and from GitHub, GitLab and Bitbucket, so you need network access to them. The cache lives in ~/.opensrc, the OPENSRC_HOME variable changes the path, and the cache grows with the number of packages. The skill allows the agent only `opensrc` commands.
How to disable. Remove the tool with `npm uninstall -g opensrc` and clear the cache with `opensrc clean` beforehand, or delete the ~/.opensrc directory by hand. Remove the skill from the agent skills directory.
FAQ
How do I install opensrc?
Run `npm install -g opensrc`. A global install gives you the native Rust binary with no Node.js overhead on each run. The skill sits in the skills/opensrc folder of the repository.
Where does opensrc get a package version from?
For npm it detects the installed version from package-lock.json, pnpm-lock.yaml or yarn.lock. The `--cwd` option points at another project. For PyPI and crates.io the latest version is used unless you set one, for example `pypi:flask@3.0.0`.
Which registries does opensrc support?
npm with no prefix or npm:, PyPI with pypi:, pip: or python:, crates.io with crates:, cargo: or rust:. GitHub repositories as owner/repo are also accepted, along with GitLab and Bitbucket with prefixes.
Where is the downloaded source stored?
In ~/.opensrc, and OPENSRC_HOME changes the path. `opensrc list` shows the contents, `opensrc remove` and `opensrc clean` delete them, and the latter has --npm, --pypi, --crates, --packages and --repos filters.
What is the opensrc skill for?
It teaches the agent to call `opensrc path` on requests like show the package source and how does this work internally. The skill is limited to opensrc commands and reminds the agent not to fetch code when the docs are enough.
Discussion
No questions or reviews yet.
Related
CLI toolsAn MCP server and CLI for code research: search and understand your project and all of GitHub with fewer tokens
A code-review CLI and plugin for agents: reads a git diff and writes line-level comments with context
Gives the agent an understanding of your repository: it indexes the code and answers questions about it in Claude Code, Cursor, Codex, Windsurf and more
A skill that searches GitHub for an already proven path to an engineering problem and adapts it to your code with a minimal change
A Rust CLI for TypeScript and JavaScript: dead code, duplicates, cycles, complexity and architecture boundaries from one graph, plus MCP and skills
Rust coding agent for the terminal and CI built around DeepSeek models that reads code, edits files and runs commands
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| opensrc (this entry) | yes | 3,027 | ||
| Context7 | yes | API key | 63,873 | gives the agent up-to-date library documentation rather than source code |
| Context Hub | no | 13,986 | a CLI with vetted API documentation by version and language |
README in short
The root description states the goal in one phrase: give agents access to any package source. The quick start shows installation and three examples of searching source. A table splits the repository into the CLI and the documentation site, and the development section describes a Turborepo monorepo with a Rust CLI and a Next.js site.
README badge
Original SKILL.md
--- name: opensrc description: Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, fetch implementation details for a dependency, or explore how an npm/PyPI/crates.io package is built. Triggers include "fetch source for", "read the source of", "how does X work internally", "get the implementation of", "opensrc path", or any task requiring access to dependency source code beyond types and docs. allowed-tools: Bash(opensrc:*) --- # Source Code Fetching with opensrc Fetches dependency source code so agents can read implementations, not just types. Clones repositories at the correct version tag and caches them globally at `~/.opensrc/`. ## Core Pattern ```bash rg "parse" $(opensrc path zod) cat $(opensrc path zod)/src/types.ts find $(opensrc path zod) -name "*.test.ts" ``` `opensrc path <pkg>` prints the absolute path to cached source. If not cached, it fetches automatically. Progress goes to stderr, path to stdout, so `$(opensrc path ...)` works in subshells. ## Fetching Source Code ```bash opensrc path zod opensrc path pypi:requests opensrc path crates:serde opensrc path facebook/react # Multiple packages at once opensrc path zod react next opensrc path pypi:requests pypi:flask opensrc path crates:serde crates:tokio # Specific versions opensrc path zod@3.22.0 opensrc path pypi:flask@3.0.0 opensrc path owner/repo@v1.0.0 opensrc path owner/repo#main ``` ### Version Resolution For npm packages, opensrc auto-detects the installed version from lockfiles (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`). Use `--cwd` to resolve from a different project: ```bash