opensrc: a cacheable dependency source path for a coding assistant

Who it's for

opensrc is for people who need a coding assistant to read dependency source: you want the implementation of a package on npm, PyPI, crates.io, or GitHub, without cloning the repository by hand. The capability it offers is this: let the assistant reach any package’s source, and pull that source down through the command line and cache it.

More specifically, the main path is one CLI. After install, point opensrc path at a package name: the first run fetches, later runs immediately return the cached local path. You can hand that path to later read-only commands, for example searching a PyPI package directory by filename.

It is not a package manager or a publishing tool. The repository docs stop at “fetch and cache source, return a path.” They do not say how to edit a package, how to publish, or that it will change your project files automatically. If you only want to install dependencies into the current project, keep using your existing package manager; do not treat opensrc as an installer.

First try in 3 minutes

The only official install command is npm install -g opensrc. The repository is https://github.com/vercel-labs/opensrc Follow only that page. The docs do not give other installers or marketplace commands; do not invent them.

Prerequisites: this machine already has a working npm, and you are allowed to install a CLI globally. Install location is a global CLI named opensrc. After install, first run opensrc in a terminal or view help to confirm the command is found; this step does not write files into your project directory.

Low-risk first task: pick a public package you would already inspect read-only. Do not point at a private or unauthorized repository. In a terminal run opensrc path plus that package name. Per the repository docs, the first run fetches and caches source, then returns a local path. Success signal: the command prints a local directory path, and running the same command again immediately does not wait for a fetch the way the first run did — it returns the same path at once.

If you will use the returned path next, echo the path first, then decide whether to run a read-only search. The repository’s example is find $(opensrc path pypi:requests) -name "*.py": it first resolves the cache path for pypi:requests, then lists Python files inside it. Before you run find, confirm you are only looking at filenames, not deleting or rewriting. The docs do not state the default cache directory location or a cache-cleanup command, so the first try can stop at “got a path and can list files.”

Use cases

Case 1: Give a coding assistant a reusable local source directory. The workflow is opensrc path: first fetch, later return the cached path. This fits when you are reading a dependency’s implementation and need to open the same directory again and again. The docs do not list every supported package-name spelling; they only stress first fetch, then an immediate path. If the command fails, go back to https://github.com/vercel-labs/opensrc and check whether install finished, instead of switching to an undocumented install method.

Case 2: Inspect source files across registries. The CLI says it can fetch and cache source from npm, PyPI, crates.io, and GitHub. The repository’s concrete example is find ... -name "*.py" on pypi:requests, to list Python files in that package. This fits when you already know the registry prefix and only want to see which files are in the source tree. The docs do not expand equivalent command forms for GitHub or crates.io, and they do not describe private-package auth; those directions stop at “the CLI claims these sources.” Do not invent prefixes.

Limits

Install limit: official docs only write npm install -g opensrc; do not use an installer that is not recorded. Capability limit: the docs are about giving a coding assistant access to any package source, and caching source from npm, PyPI, crates.io, and GitHub; they do not say it will modify those packages, or that it can replace a language package manager. Operation limit: the concrete commands you can check are opensrc path and find $(opensrc path pypi:requests) -name "*.py". Cache behavior is written as “first fetch, later return the path immediately”; there is no expiry policy or cleanup method. Four registries appear, but the text does not say those are the only ones, and it gives no private-repository credential steps.