goose: An Open-Source AI Agent for Desktop and Terminal (GitHub, Scanned)

goose is an AI agent that runs on your machine and does the work rather than suggesting it. Ask for something and it plans the steps, runs shell commands, reads and edits files, installs dependencies and runs tests, checking the results as it goes. It is not limited to code: the same agent handles research, writing, data analysis and automation, and recipes let you save a workflow and run it again.

It comes as a desktop app for macOS, Windows and Linux, a CLI, and an API for embedding it elsewhere. It works with more than 15 providers, including Anthropic, OpenAI, Google, OpenRouter, Azure, Bedrock and local models through Ollama, and can use an existing Claude, ChatGPT or Gemini subscription through ACP. Its abilities come from extensions built on the Model Context Protocol, more than 70 of them.

goose was created at Block, the company behind Square and Cash App, is written in Rust, and is now part of the Agentic AI Foundation at the Linux Foundation. It is Apache-2.0 licensed, has about 55,000 stars, and releases often: version 1.53 shipped on October 2, 2026.

• Repository: github.com/aaif-goose/goose
• Licence: Apache-2.0 (Apache License 2.0)
• Language: Rust. Stars: 54.9K. Forks: 6,352. Last push: Oct 2, 2026.
• Scan: safe, Oct 2, 2026, commit 591edd4

Who it is for

Developers who want an autonomous agent that is not tied to one model vendor or editor, and non-developers who want an assistant that can operate their computer through a desktop app, with the model of their choice.

Getting started

1. Desktop app on macOS with Homebrew (Windows and Linux downloads are on goose-docs.ai)

brew install --cask block-goose

2. Or install the CLI on macOS or Linux (brew install block-goose-cli also works)

curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash

3. Choose a model provider and enter its key

goose configure

4. Start a session

goose session

The CLI installer is a shell script from the project's GitHub releases, run as is, and it offers to add ~/.local/bin to your shell profile; Homebrew is the alternative. goose runs commands with your user's permissions, so check its permission mode before handing it a broad task. The official quickstart suggests Tetrate's Agent Router as a provider, with $10 of starting credit; any other provider key works instead.

Safety scan

We cloned aaif-goose/goose at commit 591edd4 on Oct 2, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No committed binaries across 2,494 files and about 620,000 lines, half of it Rust. The 13 secret hits are not keys: comments and tests in crates/goose-providers/src/api_client.rs and gcpauth.rs that name PEM formats while converting client certificates, and a ghp_xxxx placeholder in the GitHub MCP docs. The bare-IP URL is a test redirect to the 192.0.2.1 documentation address.
• Most pattern hits come from goose's own command-safety scanner, crates/goose/src/security, whose tests contain dangerous commands such as nc -e /bin/bash on purpose. The rest are install hints for Amp and jbang, documentation Dockerfiles installing Node, uv and jbang, and the installer's own usage comment.
• download_cli.sh fetches the release archive from GitHub, installs to ~/.local/bin, and offers to add that folder to your shell profile; it does not use sudo. Usage data is opt-in: goose asks on first use and sends only counts, versions, provider and model names, never conversations or code.
• ui/pnpm-lock.yaml, the desktop app, pins 1,412 packages with 120 advisories (1 critical, 59 high). The critical is a tar denial-of-service in build tooling; the highs include Electron 43.4.0 sandbox and protocol-handler issues, which do ship in the app, plus xmldom and minimatch. Cargo.lock (1,319 crates) has 10, two of them high in rmcp, the MCP SDK. The documentation site accounts for another 30.
• 43 workflows. The three flagged for pull_request_target do not run PR code: in code-review.yml the trigger is commented out and it runs only on manual dispatch from the base branch, and the other two handle Dependabot auto-merge and test quarantine. All 78 third-party actions are pinned to commits. Security policy, Dependabot, CodeQL, licence, contributing guide and code of conduct present; OpenSSF Scorecard 5.9.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Rust 302.8K, TypeScript 109.8K, JSON 104.1K, Markdown 60.6K, YAML 16.7K, Python 6,699.

Questions

Is goose free?

Yes. goose is Apache-2.0 licensed and free on every platform, with no account. The model is the cost: hosted providers bill your API key, an existing Claude, ChatGPT or Gemini subscription can be used through ACP, and local models through Ollama cost nothing beyond the hardware.

Is goose safe to let loose on my computer?

It acts with your user's permissions, so treat it like any agent that runs shell commands. goose has permission modes ranging from fully autonomous to asking before each tool call, and running it inside a project folder or a container limits what a mistake can touch.

How is goose different from Claude Code or Codex?

Those are built around their vendors' models and focused on coding. goose works with any provider, including local models, ships a desktop app as well as a CLI, and is meant for general tasks as well as code. It is also governed by a foundation rather than a single company.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.