Opensrc
Pull npm, PyPI, crates.io, or GitHub dependency source into a local cache so your coding agent can read real implementations—not just types and READMEs—while you build or debug.
Install
npx skills add https://github.com/vercel-labs/opensrc --skill opensrcWhat is this skill?
- Resolves cached source paths via `opensrc path <pkg>` with auto-fetch on miss and global store at `~/.opensrc/`
- Supports npm packages, `pypi:`, `crates:`, and `owner/repo` GitHub repos, including version pins (`@3.22.0`, `@v1.0.0`)
- Batch fetch multiple packages in one invocation for parallel agent research
- Stdout prints paths only (stderr for progress) so `$(opensrc path zod)` composes with `rg`, `cat`, and `find`
- Documented workflows for tracing symbols, reading tests, and comparing dependency versions from cached trees
Adoption & trust: 460 installs on skills.sh; 2.5k GitHub stars; 2/3 security scanners passed (skills.sh audits).
Recommended Skills
Microsoft Foundrymicrosoft/azure-skills
Azure Aimicrosoft/azure-skills
Azure Hosted Copilot Sdkmicrosoft/azure-skills
Lark Eventlarksuite/cli
Running Claude Code Via Litellm Copilotxixu-me/skills
Setup Matt Pocock Skillsmattpocock/skills
Journey fit
Primary fit
Dependency internals matter most while you are wiring libraries into the product; build/integrations is where agents repeatedly need source-level answers without leaving the repo. opensrc targets package ecosystems and version-pinned clones—the classic integration work of choosing, importing, and reasoning about third-party code.
Common Questions / FAQ
Is Opensrc safe to install?
skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.
SKILL.md
READMESKILL.md - Opensrc
# Source Code Fetching with opensrc Fetches dependency source code so agents can read implementations, not just types. Clones repositories at the correct version tag and caches them globally at `~/.opensrc/`. ## Core Pattern ```bash rg "parse" $(opensrc path zod) cat $(opensrc path zod)/src/types.ts find $(opensrc path zod) -name "*.test.ts" ``` `opensrc path <pkg>` prints the absolute path to cached source. If not cached, it fetches automatically. Progress goes to stderr, path to stdout, so `$(opensrc path ...)` works in subshells. ## Fetching Source Code ```bash opensrc path zod opensrc path pypi:requests opensrc path crates:serde opensrc path facebook/react # Multiple packages at once opensrc path zod react next opensrc path pypi:requests pypi:flask opensrc path crates:serde crates:tokio # Specific versions opensrc path zod@3.22.0 opensrc path pypi:flask@3.0.0 opensrc path owner/repo@v1.0.0 opensrc path owner/repo#main ``` ### Version Resolution For npm packages, opensrc auto-detects the installed version from lockfiles (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`). Use `--cwd` to resolve from a different project: ```bash opensrc path zod --cwd /path/to/project ``` For PyPI and crates.io, explicit versions or latest are used. For repos, use `@ref` or `#ref` to pin a branch, tag, or commit. ## Managing the Cache Source is cached globally at `~/.opensrc/` (override with `OPENSRC_HOME`). ```bash opensrc list # show all cached sources opensrc list --json # JSON output opensrc remove zod # remove a package opensrc remove facebook/react # remove a repo opensrc clean # remove everything opensrc clean --npm # only npm packages opensrc clean --pypi # only PyPI packages opensrc clean --crates # only crates.io packages opensrc clean --packages # all packages, keep repos opensrc clean --repos # all repos, keep packages ``` ## When to Fetch Source Fetch source when you need to: - Understand internal behavior that types don't reveal - Debug unexpected library behavior - Learn patterns from well-known implementations - Verify how a function handles edge cases Don't fetch source for simple API usage questions that docs or types can answer.