Suede AI · Agent directory

goose agent evidence

A local general-purpose agent with a terminal edition for code and workflows. Review its edition-specific evidence and permissions.

Agentic AI Foundation · Official product · Rating methodology

Ratings measure documentation and evidence coverage. They do not measure agent capability or security.

CLI

local

Reviewed 2026-10-27 by Codex editorial source review.

Documentation: Incomplete
Repository evidence: Incomplete
Hosted disclosures: Not applicable

Requirements

Compatible local operating system and a configured model provider.

Permissions and data

Runs actions on the local machine. Publisher warns about prompt injection and recommends isolation and confirmation for significant actions.

Costs

Apache-2.0 source; model-provider access or usage can carry separate costs.

Official access / setup

Source: aaif-goose/goose at 2c6812a358db1b11953b9fafc05c6126eb818788. Apache-2.0 license · Official distribution.

Source inspection does not prove an installed binary or hosted deployment matches this revision.

Performance: Not tested

No task-success, reliability, latency or cost benchmark has been run by this directory.

Security: Not assessed

No independent security assessment has been performed. Documentation points do not establish safety.

No findings recorded in this intake. This does not mean no vulnerabilities exist.

Documentation — 7/10 checks reviewed

Check	Review	Evidence and reason
Intended tasks	supported	Overview names concrete local agent tasks. [source]
Boundaries	supported	Security policy warns about untrusted content and sensitive information. [source]
Setup instructions	supported	Get started identifies the official CLI install route. [source]
Prerequisites	supported	Overview identifies supported desktop operating systems and provider access requirements. [source]
Model requirements	supported	Overview names providers and API-key/subscription access. [source]
Worked example	unknown	Not reviewed in this intake; no point or failing score is inferred.
Tools and integrations	supported	Overview identifies MCP extensions. [source]
Permission description	unknown	Not reviewed in this intake; no point or failing score is inferred.
Failure and recovery	unknown	Not reviewed in this intake; no point or failing score is inferred.
Support route	supported	Need help links diagnostics and known issues. [source]

Repository evidence — 9/10 checks reviewed

Check	Review	Evidence and reason
License text	supported	Apache 2.0 terms are present. [source]
Attribution	supported	Block copyright notice is present. [source]
Pinned source	supported	README retrieved and hashed at the exact commit. [source]
Distribution relationship	supported	README identifies its official release installer. [source]
Dependency manifest	supported	Workspace manifest supplies dependency constraints. [source]
Resolved dependencies	supported	Cargo lockfile records resolved versions and checksums. [source]
Test sources	supported	Substantive CLI roaming test sources were read, not run. [source]
CI definition	supported	CI defines CLI checks; run outcomes were not assessed. [source]
Change history	unknown	Not reviewed in this intake; no point or failing score is inferred.
Security reporting	supported	Private disclosure and escalation are specified. [source]

Source receipts

Product overview; Get started; Quick links; Need help
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Describes a local general-purpose agent with a CLI, desktop and API. This listing reviews the CLI only.
- Names coding, research, writing, automation and data analysis; lists model providers and API-key or subscription access.
- Links the official CLI release installer and diagnostics/known-issues documentation; names MCP integrations.
Receipt integrity
Receipt SHA-256 81cb0009f38952d5533d7fdbc55a22be36d0a0ec355223a66bf8feccee858c1f
File SHA-256 0f1df85a0c457caf1f3c4e1c0370f2da3887fffa588d207862cfc298c1d39755; Git blob 44c960f0193de1ccd3a13721cfe2daf5e7707ac5
Download receipt
Risk notice and vulnerability reporting
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Warns that local code execution and actions create risk and that embedded instructions in untrusted content may be followed.
- Recommends isolation, review of generated code and tests, avoiding sensitive information, and human confirmation for significant changes.
- Specifies private reporting through the repository Security tab and an escalation contact. These are publisher disclosures, not an independent security assessment.
Receipt integrity
Receipt SHA-256 95e802bdb54a179774ad911b2245d3877b4aacb8f2a007114ad4f398967767f3
File SHA-256 e9b24f0a2ab5e6e1655cd178266d1afcb8f7b4e213f460cd643a1b986922e120; Git blob 42eca542be2860380447795671f652097adf5771
Download receipt
Apache 2.0 terms and copyright notice
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Contains Apache 2.0 license terms and a 2024 Block, Inc. copyright notice.
Receipt integrity
Receipt SHA-256 cec31bcfc8f9f29720ce0862cd7f89d891f32438b5df76bd44aacb8385fd3e16
File SHA-256 44459b86c2e96fdbfd8a6b5c33d30d4b04b5293fcb2ec96fe4dcc4e0f90b8962; Git blob c83043d4494071fbd93ef245a14e573c5a8280c4
Download receipt
workspace members, package and dependencies
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- The workspace includes crates/* and lists Rust build requirements and dependency constraints.
Receipt integrity
Receipt SHA-256 0d3134a63fab8d7270bfaefe837c929b7ecd294b40b9350a6f093f57f1fd9746
File SHA-256 c763358fd5bc581f5a87832482bd9e8ed78fc042ea127b79166de24bec2e916e; Git blob 65ca757afbac50eea2aa191d822f616ba6d7bc1d
Download receipt
Resolved package records
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Version 4 lockfile records exact dependency versions, registries and checksums. No dependency audit was performed.
Receipt integrity
Receipt SHA-256 177d6a452ce3346c135904a7e3db3554e4b37537d05cd92ebad9d015457746e7
File SHA-256 8d397ac09ca3b46fd38f7bba6edbbb2c91897184b19a4d04eddb4eacc18d71bf; Git blob ac3dcb2824dd1c7f9f80699587eba19a25d73657
Download receipt
CLI roaming ACP test source
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Contains CLI client session-listing and delegation test code with a stub ACP agent and loopback transport. Tests were read, not executed.
Receipt integrity
Receipt SHA-256 fe412e5a16bdb7d451964af85e3b624a69866a8df0912d6e7ab53e69e2c19cf1
File SHA-256 b73fcc3c772583661b878f003c1fab6e69573c320a9928d5e27aeb8dcc829860; Git blob 5c83a0bcb1df24615532e3e84ab51bca6738109b
Download receipt
rust-build-and-test and rust-build-and-test-roaming
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Defines locked Cargo test and CLI roaming build/test commands. Presence is not a CI success or runtime reliability claim.
Receipt integrity
Receipt SHA-256 51d2eba2ce8619c4744e09456cd32a4e97d215b5143860adf80f47e31c50cf09
File SHA-256 7319bed1c57b62e70079db50053920d20c457ca40bc04c47151d10c6105b0f5a; Git blob 23070bdaa2e91740dc4896c9e4d75a1d4e96483d
Download receipt
0.1.0-alpha.13 and alpha.12
Pinned source inspection · 2026-10-27T05:02:48Z · Codex editorial source review
- Records dated changes to the shared goose-agent crate. CLI release coverage has not been established, so this does not award the CLI change-history point.
Receipt integrity
Receipt SHA-256 9669150e1c8492062968cf47f7f93858074843a660e78056582e22428eb8d04d
File SHA-256 1080e8a2093420e993d12017fba0c8fb3fd6870bbabf363af2f16725c859b022; Git blob 8854b376a0195c800eff4a9b046038a4e826716d
Download receipt

Download full report · Report version 28dbde6f907a · Request a recheck or correction