diff --git a/docs/SMOKE.md b/docs/SMOKE.md
index 682b791..4035634 100644
--- a/docs/SMOKE.md
+++ b/docs/SMOKE.md
@@ -106,8 +106,9 @@ each run keeps a copy next to its output as `<case>.<run>.mcp-stderr`.
   output but still deletes every copied agent config.
 - Tools are auto-approved for the run (Claude `dontAsk` with
   `mcp__idx__*`, Codex `default_tools_approval_mode="approve"`); Claude and pi
-  also get no built-in tools, and Hermes only the `idx` toolset, so they
-  can only answer through MCP.
+  also get no built-in tools, Hermes only the `idx` toolset, and opencode a
+  permission that denies everything but `idx_*`, so they can only answer
+  through MCP.
 - `IDX_AGENT_MODEL_<AGENT>` picks a model (for example
   `IDX_AGENT_MODEL_CLAUDE=sonnet`). `IDX_AGENT_EXEC_PREFIX` prefixes every
   agent command, for hosts that inject API keys through a wrapper.
diff --git a/tests/agents/agent-smoke.sh b/tests/agents/agent-smoke.sh
index 7fca924..55472f6 100755
--- a/tests/agents/agent-smoke.sh
+++ b/tests/agents/agent-smoke.sh
@@ -276,7 +276,8 @@ setup_opencode() {
     mkdir -p "$work/opencode/cwd"
     jq -n --argjson s "$server_json" \
         '{"$schema": "https://opencode.ai/config.json",
-          mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}}}' \
+          mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}},
+          permission: {"*": "deny", "idx_*": "allow"}}' \
         > "$work/opencode/cwd/opencode.json"
 }
 run_opencode() {