Read dependency source code with opensrc before your agent patches a library it has never opened. Your developers already know the pattern: the agent sounds certain, the fix looks reasonable, and production still rejects the same input. Docs lag. README samples skip the edge cases. The bug sits in the package source nobody pulled up.
I install this habit first when I work with a team, because it costs one CLI and changes how every later skill behaves. An agent with the real source on disk stops arguing from memory.
What opensrc does
The vercel-labs/opensrc CLI resolves a package to its repository, detects the version when it can, shallow-clones that tag, and caches the tree. One command carries the whole idea:
rg "parse" $(opensrc path zod)
Progress goes to stderr. The path goes to stdout. Subshells stay clean. The CLI readme shows the same pattern for PyPI, crates.io, and git hosts. npm is the default registry, and prefixes cover the rest: pypi:requests, crates:serde, vercel/next.js.
Agents already grep, read files, and follow imports. They fail when the source is missing from disk. opensrc removes that gap without teaching anyone a new research language.
Why agents guess
Coding agents overweight README examples and generated API summaries. Those skip private helpers, error branches, and version drift. Your lockfile pins [email protected] while the model remembers a newer public story, so the agent patches your app against a library that does not exist on your machine.
Open the installed version and the gap closes. The agent reads the same code your runtime loads. Edge-case behavior stops being folklore, and your pull requests start carrying citations that point at files.
Install once, then teach the stop rule
Global install covers most teams:
npm install -g opensrc
Add the agent skill so the tool surfaces when a task needs implementation context. The opensrc repo ships one that tells agents when to fetch and when to stay on docs. Name the folder after the job, read-dependency-source rather than opensrc-helpers, following the same convention in name AI agent skills after the job.
Keep the skill short. Name the trigger: surprising library behavior, missing edge-case docs, or a question about how a helper handles nulls. Name the method: run opensrc path <package>, search, read, quote file paths in the answer. Name the stop rule: no fetching for trivial public API questions.
The loop that survives review
1. State the package and the question in one sentence. 2. Resolve the local path with opensrc. 3. Search for the symbol or the error string. 4. Read the implementing file, not only the type declaration. 5. Cite the path and the behavior before touching product code.
That loop turns "the library probably validates emails" into "in src/types.ts on the pinned tag, the parser coerces before it validates." Reviewers verify it in ten seconds. The next agent replays the same steps.
Version truth beats latest truth
Latest docs describe latest packages. Your lockfile describes what you ship. opensrc reads package-lock.json, pnpm-lock.yaml, or yarn.lock so the clone matches production. Debugging a customer on an older release, pin it: opensrc path [email protected]. Working inside a monorepo package, pass --cwd to the app that owns the lockfile.
Pre-fetch the hot dependencies during onboarding with opensrc fetch when first-hit latency annoys people. Otherwise let it stay lazy and fetch on cache miss.
Where it earns its keep
Framework sequencing bugs come first. Next.js routing, auth middleware order, ORM transaction boundaries. These look like application mistakes and resolve as framework behavior, and source reading ends the argument faster than another blog post.
Validation libraries come second. Schema packages hide coercion rules inside helpers, so agents that read only the type signature invent transforms that never run.
Polyglot services come third. A TypeScript backend calling a Python worker needs truth on both sides, and one CLI covering npm and PyPI keeps the habit identical across the stack.
Failure modes to coach against
Agents over-fetch when you reward curiosity without a stop rule. Nobody needs the React source to answer a useState question. Put the boundary in the skill body.
Agents also paste entire modules into chat. Require a summary with file citations instead, and keep the raw file in the editor where it belongs.
Cache growth is real. Teach opensrc list and opensrc clean as routine hygiene, the same way your team prunes Docker images.
When two packages share a symbol name, pass the full package id and search inside that tree only. A broad grep across ~/.opensrc mixes versions and burns a session.
A session that paid for the install
An agent once "fixed" a signup form by loosening a client schema after a user report. Types looked fine. The docs showed a happy example. Production kept rejecting a subset of emails. We ran opensrc path zod, searched the email path, and found the coercion order the README never stressed. The real fix was a two-line preprocess. Without the source, that agent was one turn away from writing a parallel validator nobody would maintain.
Ship the habit this week
Pick one recurring bug class that smells like a dependency. Install opensrc, add a skill that requires a source read before the code edit, and run the loop on the next incident. Keep the citation in the pull request. After three clean wins, make it your default research step.
Source reading covers the libraries you already depend on. Tip 2 covers everything outside the repo, where you scrape websites for AI agent research for changelogs, pricing pages, and docs that changed last night. Different jobs, both worth installing.
If you want opensrc wired into your Cursor or Claude Code kit with job-named skills and review checklists, book a call. More practitioner notes live under tips.
Sources
Want this research habit installed across your agent skills?
Book a callFAQ
Does opensrc match my lockfile version?
For npm packages it detects the installed version from package-lock.json, pnpm-lock.yaml, or yarn.lock. Pass --cwd when the agent works outside the app root, and pin with package@version when you need an explicit tag.
Where does the cache live?
Under ~/.opensrc/ by default, overridable with OPENSRC_HOME. The first fetch shallow-clones, and later opensrc path calls return the cached directory.
When should the agent skip opensrc?
Skip it for public API usage that types and official docs already cover. Fetch source for internals, edge cases, and mismatches between docs and runtime.
Can I use opensrc outside JavaScript?
Yes. Prefix PyPI with pypi:, crates with crates:, and pass owner/repo for GitHub. The path composition works the same across registries.