(09 September, 2026 - 01:25 PM)Talmud Wrote: Show MoreCurrently, there is an abundance of "AI-as-a-Service" hype. I've been looking into the backends of hermres, fx.sh, and, most amusingly, OpenCode.ai, and let me tell you, these platforms are far from production-ready. They are leaking free inference like a sieve, and it is trivially simple to steal "AI compute".

This thread discusses OpenCode.ai and its public API endpoint. Everything here is based on what I observed in the wild. There are no opinions, just raw mechanics.

The endpoint URL is https://opencode.ai/zen/v1/responses. It responds to POST requests with a predefined set of headers and a JSON body. No API key means no sign-up. If you use the correct headers, you will get Muse model outputs.

The most powerful free models available in OpenCode are muse-spark-1.2-contributor-free and muse-spark-1.3-contributor-free. Others exist, but these two are the best for general use in my opinion.

The required headers are:

Code:

Code:

Authorization: Bearer public

Content-Type: application/json

User-Agent: opencode/1.18.29

x-opencode-session: ses_<12‑char hex><14 random alnum chars>

x-opencode-request: msg_<same format>

x-opencode-client: cli

The session and request IDs are generated locally. Here is how they are built: take the current timestamp in milliseconds, multiply by 4096, add a per‑millisecond counter, then mask to 48 bits. For the session ID, you invert that masked value; for the request ID, you keep it as is. Then format that as 12 hex digits, append 14 random characters from 0‑9A‑Za‑z, and prefix with "ses_" or "msg_". The server does not check if these are unique or tied to anything; it only checks the format.

The JSON payload looks like this:

Code:

Code:

{

  "model": "muse-spark-1.3-contributor-free",

  "input": "Your prompt here",

  "max_output_tokens": 1500,

  "reasoning": {"effort": "low"},

  "instructions": "Optional system prompt"

}

The model must be one of the two mentioned. max_output_tokens defaults to 1500 if omitted. reasoning.effort can be "low", "medium", or "high", but "low" is the default. instructions is optional.

When you get a response, it is JSON. To extract the generated text, look inside the "output" array for an item with "type": "message". Inside that, find the "content" array and grab any item with "type": "output_text" or "text", then concatenate their "text" fields. If that fails, fall back to the top‑level "output_text" field.

Here is the code lifted directly from the wild:

Code:

Code:

"""NIGGA HUB."""

import json

import secrets

import time

import urllib.error

import urllib.request

BASE = "https://opencode.ai/zen/v1"

USER_AGENT = "opencode/1.18.29"

MUSE_FREE = {

    "muse-spark-1.2-contributor-free",

    "muse-spark-1.3-contributor-free",

}

DEFAULT_MODEL = "muse-spark-1.3-contributor-free"

_counter_ms = 0

_counter_n = 0

_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"

def _make_id(invert, timestamp_ms=None):

    global _counter_ms, _counter_n

    if timestamp_ms is None:

        timestamp_ms = int(time.time() * 1000)

    if timestamp_ms != _counter_ms:

        _counter_ms = timestamp_ms

        _counter_n = 0

    _counter_n += 1

    value = timestamp_ms * 0x1000 + _counter_n

    mask = (1 << 48) - 1

    value = (mask ^ (value & mask)) if invert else (value & mask)

    suffix = "".join(_ALPHABET[b % 62] for b in secrets.token_bytes(14))

    return f"{value:012x}{suffix}"

_SESSION_ID = "ses_" + _make_id(True)

def _session_id():

    return _SESSION_ID

def _request_id():

    return "msg_" + _make_id(False)

def _headers():

    return {

        "Authorization": "Bearer public",

        "Content-Type": "application/json",

        "User-Agent": USER_AGENT,

        "x-opencode-session": _session_id(),

        "x-opencode-request": _request_id(),

        "x-opencode-client": "cli",

    }

def _extract_text(data):

    for output in data.get("output", []) or []:

        if output.get("type") == "message":

            parts = [

                item["text"]

                for item in output.get("content", []) or []

                if item.get("type") in ("output_text", "text") and item.get("text")

            ]

            if parts:

                return "".join(parts)

    return data.get("output_text", "") or ""

def muse(prompt, system=None, timeout=30, max_tokens=None, model=None):

    model = model or DEFAULT_MODEL

    if model not in MUSE_FREE:

        raise ValueError(f"Use {', '.join(sorted(MUSE_FREE))}")

    payload = {

        "model": model,

        "input": prompt,

        "max_output_tokens": max_tokens or 1500,

        "reasoning": {"effort": "low"},

    }

    if system:

        payload["instructions"] = system

    request = urllib.request.Request(

        f"{BASE}/responses",

        data=json.dumps(payload).encode(),

        headers=_headers(),

    )

    try:

        with urllib.request.urlopen(request, timeout=timeout) as response:

            data = json.load(response)

    except urllib.error.HTTPError as exc:

        try:

            detail = exc.read().decode()[:1500]

        except Exception:

            detail = ""

        raise RuntimeError(f"HTTP {exc.code}: {detail or exc.reason}") from exc

    return _extract_text(data)

def list_free_models():

    return sorted(MUSE_FREE)

if __name__ == "__main__":

    print(f"{USER_AGENT} {DEFAULT_MODEL}")

    for name in sorted(MUSE_FREE):

        started = time.time()

        reply = muse("Say hi in 5 words.", model=name)

        print(name, f"{time.time() - started:.1f}s", repr(reply))

That code sends requests and prints responses. There is rate limitation but its extremely high if you add proxy rotation it is a null issue, and no validation of the bearer token.

That is all. Only OpenCode is covered here, but the opening statement stands. Use this information however you want.

Click to expand...