Connect LiquidLM in OpenCode
OpenCode setup: native OAuth first, CLI-managed OAuth second, PAT only as a last fallback.
Native OAuth — default
Check opencode --version. OpenCode 1.x uses mcp.liquidlm; OpenCode 2.x uses mcp.servers.liquidlm. The following configurations show each version in that order. Use only the layout for your installed version.
{
"mcp": {
"liquidlm": {
"type": "remote",
"url": "https://mcp.liquidlm.com/v1/mcp"
}
}
}{
"mcp": {
"servers": {
"liquidlm": {
"type": "remote",
"url": "https://mcp.liquidlm.com/v1/mcp"
}
}
}
}opencode mcp auth liquidlmCLI-managed OAuth — preferred fallback
If native refresh is unreliable, let the LiquidLM CLI own OAuth instead. Sign in on the OpenCode host and use the local configuration below (1.x, then 2.x). The client starts liquidlm mcp serve; do not run a separate background HTTP service.
npm install -g @liquidlm/cli@latest
unset LIQUIDLM_API_TOKEN LIQUIDLM_TOKEN
liquidlm login
liquidlm whoami{
"mcp": {
"liquidlm": {
"type": "local",
"command": [
"liquidlm",
"mcp",
"serve"
]
}
}
}{
"mcp": {
"servers": {
"liquidlm": {
"type": "local",
"command": [
"liquidlm",
"mcp",
"serve"
]
}
}
}
}PAT — last fallback
Use a PAT only when native OAuth and CLI-managed OAuth are unsuitable. Create a token in LiquidLM with only the required actions and vaults, and inject LIQUIDLM_API_TOKEN through your secret manager or process launcher. Keep the actual value out of config files and shell history.
Disable OAuth only for this PAT connection. OpenCode expands {env:NAME}. Configurations below are for 1.x, then 2.x. CLI 0.1.5 mcp install --client opencode --pat generates the 1.x layout only.
{
"mcp": {
"liquidlm": {
"type": "remote",
"url": "https://mcp.liquidlm.com/v1/mcp",
"oauth": false,
"headers": {
"Authorization": "Bearer {env:LIQUIDLM_API_TOKEN}"
}
}
}
}{
"mcp": {
"servers": {
"liquidlm": {
"type": "remote",
"url": "https://mcp.liquidlm.com/v1/mcp",
"oauth": false,
"headers": {
"Authorization": "Bearer {env:LIQUIDLM_API_TOKEN}"
}
}
}
}
}OAuth refresh status
Refresh-token reuse was observed in production. These instructions do not claim the external OpenCode refresh implementation is fixed. Reauthorize once; use CLI-managed OAuth if the problem recurs. Keep Keycloak token rotation enabled.
Verify and recover
Search for a distinctive item in your vault, then call get_knowledge with include_content: true. Check indexing_status and chunks_stale before judging search freshness.
For a failed OAuth refresh, reauthorize once. If failures recur, use CLI-managed OAuth next. Upgrade to CLI 0.1.5 or newer and log in again if an older version lost its refresh token. PAT is the last fallback.
Select one connection mode. Replace the existing liquidlm server entry when switching, preserving unrelated servers. Do not register duplicate connections.