How OpenCode handles this
OpenCode keeps its permissions in config, with three answers for each tool: ask, allow or deny. Most permissions default to allow, so this job needs rules before the first run. The tools are named with the server first, such as xspeedhub_optimize_site, and the last matching rule wins. You put an ask rule on xspeedhub_* first, then allow rules for the get_ and list_ reads, so list_sites and list_modules run freely and optimize_site stays on ask. Then you type the goal, such as raising the score on the client site, and OpenCode calls list_sites and optimize_site with dry_run on. The ask rule stops it at the preview, you approve, and you get the plan with nothing changed on the site.
Read it, then tell OpenCode to apply the plan. The permission prompt appears again, and this is the call that changes the site. The pass applies each setting one at a time, checks the page after every change, and undoes anything that breaks it, for up to two minutes per site. You get the applied list, the undone list with reasons, and the unfixable list.
Two habits help. First, ask for the level in the prompt: safe, standard or aggressive, with aggressive reserved for a staging copy because it includes settings known to break some themes. Second, take the verify step seriously. The Hub gives OpenCode a list of verify_urls and tells it to look at the pages before saying the pass went well. The plugin cannot run JavaScript, so open those pages in a browser with the console visible.
Set up OpenCode once
Already connected? Skip to the prompts. Alternatives and troubleshooting are on the OpenCode guide.
1Put your sites in xSpeed Hub
Sign in at app.xspeedcache.com with Google or email; the Hub is free and has no site cap. Then connect each WordPress site from its own dashboard: click Connect Hub in the xSpeed Cache top bar, then Connect via xSpeed Hub. Each site needs the free xSpeed Cache plugin.
2Add xSpeed Hub to your config
Put this block in your global config, or in opencode.json at a project root to scope it to that project. OpenCode reads both JSON and JSONC. No other field is needed: when the Hub answers 401, OpenCode starts the OAuth flow and registers itself through dynamic client registration.
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xspeedhub": {
"type": "remote",
"url": "https://app.xspeedcache.com/xspeed/mcp"
}
}
} 3Sign in with opencode mcp auth
Run this once. It opens a browser page on xSpeed Hub where you sign in and approve access. There is no token to paste; OpenCode stores the credentials it receives. Run opencode mcp list to see the server and its auth status, and opencode mcp debug xspeedhub if the connection fails.
opencode mcp auth xspeedhub
Full OpenCode setup, sign-in options and FAQ
Before you send a prompt that changes something
Reads change nothing on your sites, though contact_support emails xSpeed support. Writes run once your connection allows them, so your client's approval prompt and a read-only connection (the token's Read-only everywhere switch, or a Viewer sign-in) are the gates that matter. OpenCode checks MCP tools against its permission rules under the prefixed name, such as xspeedhub_purge_cache, and most permissions default to allow. With no rule of yours in place, a Hub write tool runs without a prompt. Add rules to change that: "xspeedhub_*": "ask" first, then "xspeedhub_get_*": "allow" and "xspeedhub_list_*": "allow", because the last matching rule wins. A deny rule holds even under opencode --auto, which approves everything that is not denied. The Hub itself has no confirmation step, so these rules and read-only access are the gates. For read-only access, send the connection token with Read-only everywhere on, or sign in as a Viewer member.
What do I ask?
Three prompts written for OpenCode. More for this job are below.
Using xSpeed Hub, preview an optimization for the client site at the standard level and stop after the plan.
Use xSpeed Hub to apply the plan to client at the safe level, then give me the verify URLs.
Use only xSpeed Hub read tools to tell me which modules the client site has and whether Critical CSS is available.
What happens, step by step
optimize_site is the Hub tool for "make my site faster". It measures the site, applies the recommended xSpeed settings one at a time, checks the page still renders after each change, undoes anything that breaks it, and reports what it applied, what it undid and what it could not fix. It reaches caching and asset delivery only. Page weight, images hosted on another domain and heavy video are outside it, and the report says so instead of claiming a win.
01
See where the site stands
The agent reads get_score_history for the last stored scores and list_modules for which modules exist on that site and what state they are in. Neither changes anything.
02
Preview with dry_run
optimize_site with dry_run: true returns the plan: each change and its tier, what would be skipped (already on, or needing a higher aggressiveness) and what it cannot fix. Nothing is applied. The tool description tells the agent to prefer this before the first real run on a site you have not optimized before.
03
Apply it
optimize_site without dry_run applies the plan. aggressiveness is safe (removals and server-side changes only), standard (the default) or aggressive, which includes settings known to break some themes and should be opted into deliberately. A run can take up to about 2 minutes per site.
04
Look at the site afterwards
When changes were applied, the result carries verify_urls and a note. The site checks its own HTML and reverts anything that breaks it, but it cannot run JavaScript, so verified: true does not prove the page works in a browser. The Hub tells the agent to open those URLs and check the page renders and the console is clean, or to tell you which URLs to check.
05
Reach for a number only if you named one
target_score (1 to 100, Pro sites only) turns one pass into repeated rounds toward that score, up to max_rounds, with 3 as the most per site. Each round is a real PageSpeed measurement and up to about 2 minutes. The result says why it stopped, and diminishing returns means what is left is outside what caching can reach.
06
Critical CSS on Pro sites
generate_critical_css generates above-the-fold CSS so the first screen can paint without waiting for the full stylesheets. It needs the Pro Critical CSS module on that site, and the site answers with an unknown-tool error without it. Pages are rebuilt with it on their next build, so the agent purges the cache afterwards.
Reference
| Main tool | optimize_site (write): measure, apply one setting at a time, verify, undo what breaks, re-measure |
|---|---|
| Preview | dry_run: true returns the plan and changes nothing |
| aggressiveness | safe, standard (default) or aggressive |
| Every site at once | site: "all" or a list of handles, one result per site, sites run one after another; the Hub's confirm-once instruction does not name optimize_site, so your client's prompt is the gate |
| Time | Up to about 2 minutes per site |
| target_score | 1 to 100; needs Pro on the site; without it the site runs one pass and says so |
| max_rounds | Up to 3 per site; only sent along with target_score; 12 rounds in total per call |
| Wide fan-out with a target | Each site gets fewer rounds, and the result carries a note saying so |
| Result fields | applied, skipped, reverted, unfixable, score, verified, rounds; verify_urls after a run that changed something |
| Already tuned site | Returns "everything is already on" plus what it cannot fix; that is an answer, not a failure |
| Critical CSS | generate_critical_css (write), Pro Critical CSS module required; purge_cache afterwards |
| Read-only connection | optimize_site and generate_critical_css are refused; dry_run is still a write call, so it is refused too. Applies to the connection token with Read-only everywhere on and to a Viewer sign-in, not to other OAuth sign-ins |
Rules worth keeping
- Run dry_run first. optimize_site changes live site settings as soon as your connection allows writes. The tool description tells the agent to preview first on a site that has not been optimized, but that is guidance, so your client's approval prompt and a read-only connection (the connection token with Read-only everywhere on, or a Viewer sign-in) are the real gates.
- Keep aggressive for a deliberate choice. It includes settings known to break some themes, and the agent should say so before using it.
- After a run that changed something, open the pages in verify_urls. The HTML checks cannot run JavaScript, so a page can pass them and still be broken in a browser. Do not call a run safe because verified is true.
- Relay the unfixable list. When a site is already tuned, the honest answer is that caching is done and the rest is page weight, hotlinked images or DOM size. The agent should not retry the tool or claim a gain it did not make.
- Only ask for target_score when you want the site driven to a number. Each round costs a real PageSpeed measurement, and a plain "make it faster" is one pass.
Good to know with OpenCode
OpenCode starts from permissive defaults, so with no rule of yours the preview and the real pass both run without a prompt, and the Hub runs a write as soon as your connection allows it. Put the ask rule on xspeedhub_* before the allow rules for the reads, because the last matching rule wins. An allow rule on optimize_site skips the prompt for the preview and the real pass alike. If you only want to look in a given session, set optimize_site to deny, which holds even under opencode --auto, or use a read-only connection (the connection token with Read-only everywhere on, or a Viewer sign-in), which makes the Hub refuse the preview as well.
More prompts for this job
They work in any client connected to xSpeed Hub.
Ask xSpeed Hub to preview what optimize_site would change on shop with a safe pass. Do not apply anything.
Use xSpeed Hub to optimize the blog site with the standard pass, then give me the pages to check by hand.
With xSpeed Hub, get docs to a mobile PageSpeed score of 90 if you can, and tell me why it stopped if it does not get there.
Use xSpeed Hub to show me what optimize_site would do on every site, as a dry run, and list which sites have the most left to change.
Use xSpeed Hub to generate critical CSS for shop, then purge the cache so the pages are rebuilt with it.
With xSpeed Hub, optimize shop, then compare the new PageSpeed score with the last stored one.
Using xSpeed Hub, what could optimize_site not fix on the shop site?
Frequently asked questions
Keep going
Raise the PageSpeed score with other agents
More with OpenCode
Documentation
- How to generate Critical CSS
- Performance recommendations
- How to run a speed test
- Free vs Pro: what is included
- How to write prompts for xSpeed Hub
- OpenCode + xSpeed
- Every AI agent that works with xSpeed
From the blog