{ "data": { "a": { "slug": "clawboo", "name": "Clawboo", "vendor": "Sanreds", "vendorUrl": "https://www.claw.boo", "kind": "harness", "category": "agent-harnesses", "summary": "Clawboo is an open-source, self-hosted dashboard and server that runs a team of AI agents on one task board. A lead agent, Boo Zero, hands tasks to Claude Code, Codex, Hermes, OpenClaw or Clawboo's own built-in agents.", "url": "https://www.anchorterminal.com/tools/clawboo", "markdownUrl": "https://www.anchorterminal.com/tools/clawboo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/clawboo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/clawboo.json", "dns": "clawboo.grade.anchorterminal.com", "repo": "https://github.com/clawboo/clawboo", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "clawboo" } ], "auth": "none", "authNotes": "No Clawboo account. On the default loopback bind the API needs no credential. An optional shared token, `STUDIO_ACCESS_TOKEN`, puts every `/api/` route behind a `clawboo_access` cookie, with no users, roles or per-person revocation. Agents Clawboo starts reach its MCP servers through signed attach URLs.", "pricing": "free", "pricingNotes": "Free and MIT, self-hosted, with nothing to buy. The owner pays the model providers or plans each runtime uses, or runs a local Ollama model with no key. No hosted option is offered.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation (llms-full.txt), the README or the npm package metadata (checked 2026-11-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 100, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://docs.claw.boo", "llmsTxt": "https://docs.claw.boo/llms.txt", "capabilities": [ "agent.multi-agent", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "llms-txt", "mcp", "typescript" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 61.4, "grade": "C", "agentReady": false, "rank": 555, "ranked": true, "rankOf": 1251, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 51, "payments": 60, "reliability": 52, "schema": 83, "security": 70, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "Undated advisory on the security page, read 1 November 2026. On 0.5.0 (21 October 2026) and older, any request from 127.0.0.1 reaches `/api/mcp/` without the access cookie, so a reverse proxy on the same machine exposes the boards, memory, team chat, tools and signed attach URLs for any agent, even with `STUDIO_ACCESS_TOKEN` set. Published by the maintainer with a proxy rule to block it, fixed on main and not released, in a setup that isn't the default, -3. https://docs.claw.boo/operating/security", "Listed under Unreleased in the changelog, read 1 November 2026. On 0.5.0 and older, an access token containing a character outside letters, digits and `.`, `_`, `~`, `-` turned the access check off while the server kept running, leaving a proxied dashboard open. Fixed on main and not released, -1. https://docs.claw.boo/appendices/changelog" ], "verdict": "Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.", "bestFor": "One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.", "strengths": [ "One board, one team chat and one shared memory across Clawboo Native, Claude Code, Codex, Hermes and OpenClaw agents", "No telemetry per the docs, which list the three requests the server makes itself and the two the dashboard makes", "Loopback bind by default, a same-origin guard against browser and DNS-rebinding attacks, and a refusal to start on a network bind without a token", "About 120 documentation pages, served as Markdown with llms.txt and llms-full.txt, including a known-issues page and every built-in limit with its source line", "npm releases carry SLSA provenance from the repository's publish workflow, with CodeQL and Dependabot in the repository" ], "weaknesses": [ "Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox", "On 0.5.0 and older, a same-machine reverse proxy exposes `/api/mcp/` without the access cookie. The fix is on main and unreleased on 1 November 2026", "No access token by default, so any local program can call the API and answer approval cards", "Keys saved under Providers are also written in plain text to `~/.openclaw/.env` and each OpenClaw agent's `auth-profiles.json`", "Version 0.5.0, with two releases in the 90 days to 1 November 2026 and budgets that only warn unless set to a hard cap" ], "agentNotes": [ "Run `npx clawboo@latest`, not a bare `npx clawboo`, which can reuse an older cached build. Node.js 22.12 or newer is required", "On 0.5.0 behind nginx, Caddy or a Cloudflare Tunnel, deny `/api/mcp/` at the proxy and set `STUDIO_ACCESS_TOKEN` from `openssl rand -hex 24`", "Give Claude Code, Codex and Hermes teammates only work you would let run unattended, or run Clawboo under a separate user account or VM", "Create a hard-cap budget in Settings \u003e Insights \u003e Governance before long runs. A fresh install has no budget and new budgets only warn", "Install `@anthropic-ai/claude-agent-sdk` globally beside Clawboo for Claude Code teammates. A one-off `npx` run cannot load it" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.4 } ], "editorialScores": { "ergonomics": 75, "maintenance": 51, "payments": 60, "reliability": 52, "schema": 83, "security": 70, "transparency": 80 }, "provenanceScore": 36, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx clawboo@latest # Node.js 22.12 or newer", "http": "curl http://localhost:18790/api/health", "headless": { "command": "curl -X POST http://localhost:18790/api/teams/\u003cteam-id\u003e/chat -H 'Content-Type: application/json' -d '{\"message\":\"Plan the launch checklist.\"}'" } }, "letme": { "capability": "https://letme.dev/agent.multi-agent", "tool": "https://letme.dev/clawboo" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "claw.boo", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://docs.claw.boo/appendices/changelog", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "No legal entity is named in the repository, the docs or the npm package. The MIT licence reads Copyright (c) 2026 Sanreds, and the npm package's only maintainer is sanreds.", "www.claw.boo was not read. Its robots.txt disallows Claude-Web in Cloudflare's managed block and later allows ClaudeBot and anthropic-ai, so the site's terms and privacy pages, if any, are unchecked.", "docs.claw.boo/.well-known/security.txt answered 404 on 1 November 2026. SECURITY.md sends reports to GitHub private vulnerability reporting.", "The software is self-hosted, so there is no vendor endpoint or status page to check. The domain registration date was not looked up." ], "score": 36 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/clawboo.json" }, "answer": "goose scores 74.3 (BB) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories.", "b": { "slug": "goose", "name": "goose", "vendor": "Agentic AI Foundation (originally Block)", "vendorUrl": "https://goose-docs.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source general-purpose agent written in Rust, with a desktop app, a CLI and an embeddable server.", "url": "https://www.anchorterminal.com/tools/goose", "markdownUrl": "https://www.anchorterminal.com/tools/goose.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/goose.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/goose.json", "dns": "goose.grade.anchorterminal.com", "repo": "https://github.com/aaif-goose/goose", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@aaif/goose-acp" }, { "registry": "oci", "name": "ghcr.io/aaif-goose/goose" } ], "auth": "none", "authNotes": "No account of its own. Model keys go in the system keyring through `goose configure`, in provider environment variables, or come from an existing Claude, ChatGPT or Gemini subscription through ACP providers.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with nothing to buy. You pay your model provider, or nothing with a local model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 54800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://goose-docs.ai/docs/quickstart", "llmsTxt": "https://goose-docs.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "free", "no-card", "foundation", "llms-txt", "docker" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 74.3, "grade": "BB", "agentReady": true, "rank": 78, "ranked": true, "rankOf": 1251, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-17" }, "negative": -2, "negativeNotes": [ "2026-07-24. GHSA-r5pp-p5r8-466r (CVE-2026-72718, 7.0 at NVD), a repository's git `core.fsmonitor` setting ran arbitrary commands during `goose review` without approval or a sandbox. Fixed in 1.44.0 and published, inside six months, -2. https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "verdict": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.", "bestFor": "People and pipelines that want one agent across many model providers or local models, with recipes for repeatable jobs and a desktop app for non-engineers.", "strengths": [ "Telemetry off until the user opts in, with the collected fields listed", "Four permission modes, per-tool always, ask or never rules, and an extension allowlist an administrator can host", "Headless `goose run` with `--output-format json` or `stream-json`, `--max-turns` and recipes with typed parameters, retries and success checks", "15+ providers, built-in local inference, and existing Claude, ChatGPT or Gemini subscriptions through ACP", "Weekly releases with dated notes, 13 in the 90 days to 17 October 2026" ], "weaknesses": [ "Autonomous mode, which approves every tool call, is the default", "No sandbox, and prompt-injection detection and adversary mode are off by default", "No privacy policy on goose-docs.ai, and the usage-data page doesn't say where data goes or how long it's kept", "No breaking-change section in the ten release notes before 1 October", "About 270 open issues, many recent ones unanswered" ], "agentNotes": [ "Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything, and the first-run prompt preselects Auto", "Pass `--max-turns` with a real limit. The default is 1000", "Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories", "Use `--output-format json` and `--no-session` in CI, and check the exit code", "Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.3 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 73 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-10-17", "maintenance": "2026-10-17", "payments": "2026-10-17", "reliability": "2026-10-17", "schema": "2026-10-17", "security": "2026-10-17", "transparency": "2026-10-17" }, "last": "2026-10-17", "lastMoved": "2026-10-27", "oldest": "2026-10-17", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash # or: brew install block-goose-cli", "headless": { "command": "goose run --no-session --max-turns 30 --output-format json -t \"$TASK\"", "env": { "GOOSE_MODE": "smart_approve", "GOOSE_MODEL": "\u003cmodel\u003e", "GOOSE_PROVIDER": "\u003cprovider\u003e", "SECURITY_PROMPT_ENABLED": "true" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/goose" }, "area": "frameworks", "provenance": { "legalEntity": "Agentic AI Foundation (Linux Foundation)", "domain": "goose-docs.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/aaif-goose/goose/releases", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The docs footer reads Copyright AAIF (Agentic AI Foundation). Block donated goose, and the escalation contact in SECURITY.md is still a block.xyz address.", "We found no terms or privacy page on goose-docs.ai and no security.txt among the docs site's static files.", "The repository moved from block/goose to aaif-goose/goose, announced on the goose blog on 7 April 2026." ], "score": 61 }, "requirements": { "card": "no", "freeTier": true, "minutes": 5, "credential": "api-key", "hosting": [ "self-hosted" ], "euResidency": "unknown", "trainsOnData": "no", "zeroRetention": "unknown", "selfHost": "yes" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/goose.json", "live": { "slug": "goose", "versions": [ { "registry": "github", "name": "aaif-goose/goose", "version": "v1.57.0", "released": "2026-10-28", "seenAt": "2026-10-31T15:56:32.160551808Z" }, { "registry": "npm", "name": "@aaif/goose-acp", "version": "1.57.0", "seenAt": "2026-10-31T15:56:31.32584614Z" } ], "githubStars": 56041, "npmWeekly": 458, "securityTxt": { "url": "https://goose-docs.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-31T15:40:25.289862363Z" }, "llmsTxt": { "url": "https://goose-docs.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-31T15:10:53.013924468Z" }, "domain": { "domain": "goose-docs.ai", "registered": "2026-03-30", "source": "https://rdap.identitydigital.services/rdap/domain/goose-docs.ai", "checkedAt": "2026-10-25T13:56:12.834140613Z" }, "github": { "repo": "aaif-goose/goose", "checkedAt": "2026-10-26T07:06:51.952152564Z", "stars": 55727, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-26T06:07:12Z", "openIssues": 346, "openPRs": 168, "issuesOpened90d": 1082, "issuesClosed90d": 956, "prsMerged90d": 734, "ci": { "branch": "main", "runs": 50, "success": 43, "failure": 7, "other": 0, "latest": "success", "latestAt": "2026-10-26T06:07:18Z" }, "advisories": [ { "ghsa": "GHSA-r5pp-p5r8-466r", "cve": "CVE-2026-72718", "severity": "high", "published": "2026-07-24T13:01:25Z" } ], "replies": { "sampled": 21, "unanswered": 14, "medianDays": 3.6 } }, "updatedAt": "2026-10-31T15:56:32.160551808Z" } }, "edges": [ { "by": 35, "category": "maintenance", "leads": "goose", "name": "Maintenance \u0026 community", "reasons": { "a": "0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with `@composio/client` pinned to an alpha (8).", "b": "v1.55.0 published to npm on 2026-10-16 (30). 13 releases in the 90 days to 17 October, 1.44.0 to 1.55.0, about one a week (20). Issues move through a public board with Inbox and Ready columns and some new reports get a label within a day, but many of the week's reports had no reply on 1 October, and pull requests that don't implement a Ready issue are closed, per the 1 October check, not re-read on 6 or 17 October (15). Desktop, CLI, npm and GHCR builds ship from the same tag, and Python and Java SDK builds run in CI (13). cargo-deny, cargo-machete, Dependabot and Scorecard workflows, and every GitHub Action pinned to a commit SHA since 29 September, with the current CI state unconfirmed (8)." }, "scores": { "a": 51, "b": 86 } }, { "by": 25, "category": "reliability", "leads": "goose", "name": "Reliability", "reasons": { "a": "Read as local software. The official npm package `clawboo` states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). `ci.yml` runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and `publish.yml` reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).", "b": "Read as a local package, which is how the 1 October dossier read it. Desktop builds and a CLI for macOS, Linux and Windows, Homebrew casks, a download script on GitHub releases, an npm package that installs the binary (@aaif/goose-acp 1.55.0) and a GHCR image, with Rust 1.94.1 as the minimum for source builds (20). A CI workflow runs on every push to main, with cargo-deny and an OpenSSF Scorecard job beside it. The Actions page loaded on 1 October showed only passing runs from March 2026, and GitHub pages refused our requests on 6 and 17 October, so the current state is unconfirmed (18). 266 to 271 open issues on 1 October, many from that week with no reply, including open reports that the default mode approves every tool call (#12567) and that schedules can overwrite each other (#12613), per the 1 October check, not re-read on 6 or 17 October (15). Weekly minor releases with dated notes, but none of the ten before 1 October has a breaking-change section, and the 1.53.0 to 1.55.0 notes weren't readable on 6 or 17 October. 1.55.0 dropped background subagents (`delegate(..., async: true)` and `GOOSE_MAX_BACKGROUND_TASKS`), with the docs edited in the same commit (9). 1.55, stable (15)." }, "scores": { "a": 52, "b": 77 } }, { "by": 9, "category": "transparency", "leads": "goose", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).", "b": "Apache-2.0 (30). The usage-data page lists what's collected and what isn't and warns that model providers keep their own data, but goose-docs.ai has no privacy policy (/privacy returned 404 on 6 and 17 October) and the page doesn't say where usage data goes (PostHog, per the source) or how long it's kept (15). No deprecation policy or dated deprecation notices found (8). Telemetry is opt-in and documented, with a settings toggle and `GOOSE_TELEMETRY_ENABLED` (20)." }, "scores": { "a": 58, "b": 67 } }, { "by": 7, "category": "ergonomics", "leads": "goose", "name": "Agent ergonomics", "reasons": { "a": "Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one `{error}` shape, refused MCP calls return `denied:` with a reason prefix, and 429s carry `Retry-After` (16). `claim_task` and `assign_task` are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One `npx` command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).", "b": "Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. The built-in extensions are few, and Code Mode lets the model find MCP tools through code instead of loading every definition (23). `--max-turns` (default 1000), `GOOSE_MAX_TOKENS` and automatic context compaction, though 1000 turns is a high default for an unattended run (16). `goose run --output-format json` or `stream-json` for scripts (15). Recipes can retry with success checks and an `on_failure` command, and sessions resume (17). A Rust core with Python and Java SDK builds, and one command runs a task, but a provider has to be configured first and the default mode approves everything (11)." }, "scores": { "a": 75, "b": 82 } }, { "by": 7, "category": "security", "leads": "goose", "name": "Security \u0026 auth", "reasons": { "a": "Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for `clawboo`, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).", "b": "Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is off until the user agrees on first use, and the docs list what's collected and what isn't (30). Four modes (autonomous, smart approval, manual approval, chat only), per-tool always, ask or never rules, and an extension allowlist fetched from `GOOSE_ALLOWLIST`, but autonomous is the default (a first-run prompt for the mode, added on main on 2 October, still preselects Auto) and there's no sandbox, with the docs pointing to a VM or container (11). Pattern and optional ML prompt-injection detection and an adversary reviewer for shell calls, both off until turned on, plus a prompt-injection caution in SECURITY.md (11). Session logs, a diagnostics report and a Langfuse tracing guide (12). SECURITY.md with GitHub private reporting and an AAIF governance contact, one advisory published with a CVE, and a Scorecard workflow. No bug bounty, and goose-docs.ai/.well-known/security.txt returned 404 on 6 and 17 October (13)." }, "scores": { "a": 70, "b": 77 } } ], "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "Sanreds", "b": "Agentic AI Foundation (originally Block)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-21", "b": "2026-10-16", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "100 npm/wk", "b": "55k stars", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "goose scores 74.3 (BB) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Clawboo or goose?" }, { "answer": "Yes. Clawboo is open source (MIT). goose is open source (Apache-2.0).", "question": "Are Clawboo and goose open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.", "slug": "clawboo", "watchFor": "Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox" }, { "aheadOn": [ "Reliability, 77 against 52", "Agent ergonomics, 82 against 75", "Security \u0026 auth, 77 against 70", "Maintenance \u0026 community, 86 against 51", "Transparency \u0026 trust, 67 against 58" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "People and pipelines that want one agent across many model providers or local models, with recipes for repeatable jobs and a desktop app for non-engineers.", "slug": "goose", "watchFor": "Autonomous mode, which approves every tool call, is the default" } ], "history": { "clawboo": null, "goose": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.4, "from": 73.9, "fromGrade": "BB", "to": 74.3, "toGrade": "BB" } ] }, "job": { "capability": "agent.multi-agent", "name": "Multi-agent orchestration" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-goose.json", "title": "Agent Zero vs goose", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-goose.json", "title": "Aider vs goose", "url": "https://www.anchorterminal.com/compare/aider-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-goose.json", "title": "Amp vs goose", "url": "https://www.anchorterminal.com/compare/amp-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-goose.json", "title": "Antigravity CLI vs goose", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-goose.json", "title": "Auggie CLI vs goose", "url": "https://www.anchorterminal.com/compare/auggie-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-goose.json", "title": "Claude Code vs goose", "url": "https://www.anchorterminal.com/compare/claude-code-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-goose.json", "title": "Cline vs goose", "url": "https://www.anchorterminal.com/compare/cline-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-goose.json", "title": "Crush vs goose", "url": "https://www.anchorterminal.com/compare/crush-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-goose.json", "title": "Cursor CLI vs goose", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-goose.json", "title": "DeepSeek Harness (dsh) vs goose", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.json", "title": "dsh-superagent (DeepSeek) vs goose", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/devin-vs-goose.json", "title": "Devin vs goose", "url": "https://www.anchorterminal.com/compare/devin-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/droid-cli-vs-goose.json", "title": "Droid CLI vs goose", "url": "https://www.anchorterminal.com/compare/droid-cli-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/earendil-pi-vs-goose.json", "title": "Pi vs goose", "url": "https://www.anchorterminal.com/compare/earendil-pi-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose.json", "title": "Gemini CLI vs goose", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.json", "title": "GitHub Copilot CLI vs goose", "url": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-harness2.json", "title": "goose vs Harness²", "url": "https://www.anchorterminal.com/compare/goose-vs-harness2" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-harnessrouter.json", "title": "goose vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/goose-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-jules.json", "title": "goose vs Jules", "url": "https://www.anchorterminal.com/compare/goose-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-junie.json", "title": "goose vs Junie CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-kilo-code-cli.json", "title": "goose vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-kimi-code-cli.json", "title": "goose vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-kiro-cli.json", "title": "goose vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-mini-swe-agent.json", "title": "goose vs mini-swe-agent", "url": "https://www.anchorterminal.com/compare/goose-vs-mini-swe-agent" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-minimax-code.json", "title": "goose vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/goose-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.json", "title": "goose vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-muse-code.json", "title": "goose vs Muse Code", "url": "https://www.anchorterminal.com/compare/goose-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-openai-codex.json", "title": "goose vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/goose-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-opencode.json", "title": "goose vs OpenCode", "url": "https://www.anchorterminal.com/compare/goose-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-openhands.json", "title": "goose vs OpenHands", "url": "https://www.anchorterminal.com/compare/goose-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-openmausbot.json", "title": "goose vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/goose-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-prime-agent.json", "title": "goose vs Prime Agent", "url": "https://www.anchorterminal.com/compare/goose-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-qoder-cli.json", "title": "goose vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-qwen-code.json", "title": "goose vs Qwen Code", "url": "https://www.anchorterminal.com/compare/goose-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-reflection-mirror.json", "title": "goose vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-rovo-dev-cli.json", "title": "goose vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-unstoppable.json", "title": "goose vs Unstoppable", "url": "https://www.anchorterminal.com/compare/goose-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-vibe-trading.json", "title": "goose vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/goose-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-warp.json", "title": "goose vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/goose-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-clawboo.json", "title": "Amp vs Clawboo", "url": "https://www.anchorterminal.com/compare/amp-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo.json", "title": "Antigravity CLI vs Clawboo", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-clawboo.json", "title": "Auggie CLI vs Clawboo", "url": "https://www.anchorterminal.com/compare/auggie-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-clawboo.json", "title": "Claude Code vs Clawboo", "url": "https://www.anchorterminal.com/compare/claude-code-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-cli-manager.json", "title": "Clawboo vs CLI Manager", "url": "https://www.anchorterminal.com/compare/clawboo-vs-cli-manager" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-cline.json", "title": "Clawboo vs Cline", "url": "https://www.anchorterminal.com/compare/clawboo-vs-cline" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-crush.json", "title": "Clawboo vs Crush", "url": "https://www.anchorterminal.com/compare/clawboo-vs-crush" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness.json", "title": "Clawboo vs DeepSeek Harness (dsh)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.json", "title": "Clawboo vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-devin.json", "title": "Clawboo vs Devin", "url": "https://www.anchorterminal.com/compare/clawboo-vs-devin" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-droid-cli.json", "title": "Clawboo vs Droid CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-droid-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli.json", "title": "Clawboo vs Gemini CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli.json", "title": "Clawboo vs GitHub Copilot CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous.json", "title": "Clawboo vs Harness", "url": "https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter.json", "title": "Clawboo vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-jules.json", "title": "Clawboo vs Jules", "url": "https://www.anchorterminal.com/compare/clawboo-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-junie.json", "title": "Clawboo vs Junie CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli.json", "title": "Clawboo vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli.json", "title": "Clawboo vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli.json", "title": "Clawboo vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-minimax-code.json", "title": "Clawboo vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.json", "title": "Clawboo vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-muse-code.json", "title": "Clawboo vs Muse Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-opencode.json", "title": "Clawboo vs OpenCode", "url": "https://www.anchorterminal.com/compare/clawboo-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-openhands.json", "title": "Clawboo vs OpenHands", "url": "https://www.anchorterminal.com/compare/clawboo-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-openmausbot.json", "title": "Clawboo vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/clawboo-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-paperclip.json", "title": "Clawboo vs Paperclip", "url": "https://www.anchorterminal.com/compare/clawboo-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents.json", "title": "Clawboo vs Parallax", "url": "https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-prime-agent.json", "title": "Clawboo vs Prime Agent", "url": "https://www.anchorterminal.com/compare/clawboo-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.json", "title": "Clawboo vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-qwen-code.json", "title": "Clawboo vs Qwen Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror.json", "title": "Clawboo vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli.json", "title": "Clawboo vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-unstoppable.json", "title": "Clawboo vs Unstoppable", "url": "https://www.anchorterminal.com/compare/clawboo-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.json", "title": "Clawboo vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-warp.json", "title": "Clawboo vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-goose.json", "title": "CLI Manager vs goose", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-harness-autonomous.json", "title": "goose vs Harness", "url": "https://www.anchorterminal.com/compare/goose-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-paperclip.json", "title": "goose vs Paperclip", "url": "https://www.anchorterminal.com/compare/goose-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-parallax-agents.json", "title": "goose vs Parallax", "url": "https://www.anchorterminal.com/compare/goose-vs-parallax-agents" } ], "panel": null, "scores": [ { "by": 25, "clawboo": 52, "edge": "goose", "goose": 77, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "clawboo": 83, "edge": "clawboo", "goose": 81, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 7, "clawboo": 75, "edge": "goose", "goose": 82, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 7, "clawboo": 70, "edge": "goose", "goose": 77, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "clawboo": 60, "edge": "", "goose": 60, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 35, "clawboo": 51, "edge": "goose", "goose": 86, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 9, "clawboo": 58, "edge": "goose", "goose": 67, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "goose scores 74.3 (BB) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories. Both do multi-agent orchestration.", "tasks": null, "tutorials": [], "verdicts": { "clawboo": "Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.", "goose": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/clawboo-vs-goose", "json": "https://www.anchorterminal.com/compare/clawboo-vs-goose.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/clawboo-vs-goose.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/clawboo-vs-goose.min.md" }, "markdown": "goose scores 74.3 (BB) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories. Both do multi-agent orchestration.\n\n- Clawboo: grade C, 61.4/100, rank #555 of 1251. Markdown https://www.anchorterminal.com/tools/clawboo.md · JSON https://www.anchorterminal.com/api/v1/tools/clawboo.json\n- goose: grade BB, 74.3/100, rank #78 of 1251. Markdown https://www.anchorterminal.com/tools/goose.md · JSON https://www.anchorterminal.com/api/v1/tools/goose.json\n- Best agent harnesses and coding agents: https://www.anchorterminal.com/best/agent-harnesses/index.md\n- All 955 harnesses comparisons: https://www.anchorterminal.com/compare/agent-harnesses/index.md\n\n## Which one, for what\n\n### Clawboo (C)\n\nGood for: One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.\n\nWatch for: Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox\n\n### goose (BB)\n\nGood for: People and pipelines that want one agent across many model providers or local models, with recipes for repeatable jobs and a desktop app for non-engineers.\n\nAhead on:\n- Reliability, 77 against 52\n- Agent ergonomics, 82 against 75\n- Security \u0026 auth, 77 against 70\n- Maintenance \u0026 community, 86 against 51\n- Transparency \u0026 trust, 67 against 58\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Autonomous mode, which approves every tool call, is the default\n\n\n## Why the edge\n\n### Maintenance \u0026 community: goose +35\n\n- Clawboo (51): 0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with `@composio/client` pinned to an alpha (8).\n- goose (86): v1.55.0 published to npm on 2026-10-16 (30). 13 releases in the 90 days to 17 October, 1.44.0 to 1.55.0, about one a week (20). Issues move through a public board with Inbox and Ready columns and some new reports get a label within a day, but many of the week's reports had no reply on 1 October, and pull requests that don't implement a Ready issue are closed, per the 1 October check, not re-read on 6 or 17 October (15). Desktop, CLI, npm and GHCR builds ship from the same tag, and Python and Java SDK builds run in CI (13). cargo-deny, cargo-machete, Dependabot and Scorecard workflows, and every GitHub Action pinned to a commit SHA since 29 September, with the current CI state unconfirmed (8).\n\n### Reliability: goose +25\n\n- Clawboo (52): Read as local software. The official npm package `clawboo` states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). `ci.yml` runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and `publish.yml` reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).\n- goose (77): Read as a local package, which is how the 1 October dossier read it. Desktop builds and a CLI for macOS, Linux and Windows, Homebrew casks, a download script on GitHub releases, an npm package that installs the binary (@aaif/goose-acp 1.55.0) and a GHCR image, with Rust 1.94.1 as the minimum for source builds (20). A CI workflow runs on every push to main, with cargo-deny and an OpenSSF Scorecard job beside it. The Actions page loaded on 1 October showed only passing runs from March 2026, and GitHub pages refused our requests on 6 and 17 October, so the current state is unconfirmed (18). 266 to 271 open issues on 1 October, many from that week with no reply, including open reports that the default mode approves every tool call (#12567) and that schedules can overwrite each other (#12613), per the 1 October check, not re-read on 6 or 17 October (15). Weekly minor releases with dated notes, but none of the ten before 1 October has a breaking-change section, and the 1.53.0 to 1.55.0 notes weren't readable on 6 or 17 October. 1.55.0 dropped background subagents (`delegate(..., async: true)` and `GOOSE_MAX_BACKGROUND_TASKS`), with the docs edited in the same commit (9). 1.55, stable (15).\n\n### Transparency \u0026 trust: goose +9\n\n- Clawboo (58): MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).\n- goose (67): Apache-2.0 (30). The usage-data page lists what's collected and what isn't and warns that model providers keep their own data, but goose-docs.ai has no privacy policy (/privacy returned 404 on 6 and 17 October) and the page doesn't say where usage data goes (PostHog, per the source) or how long it's kept (15). No deprecation policy or dated deprecation notices found (8). Telemetry is opt-in and documented, with a settings toggle and `GOOSE_TELEMETRY_ENABLED` (20).\n\n### Agent ergonomics: goose +7\n\n- Clawboo (75): Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one `{error}` shape, refused MCP calls return `denied:` with a reason prefix, and 429s carry `Retry-After` (16). `claim_task` and `assign_task` are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One `npx` command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).\n- goose (82): Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. The built-in extensions are few, and Code Mode lets the model find MCP tools through code instead of loading every definition (23). `--max-turns` (default 1000), `GOOSE_MAX_TOKENS` and automatic context compaction, though 1000 turns is a high default for an unattended run (16). `goose run --output-format json` or `stream-json` for scripts (15). Recipes can retry with success checks and an `on_failure` command, and sessions resume (17). A Rust core with Python and Java SDK builds, and one command runs a task, but a provider has to be configured first and the default mode approves everything (11).\n\n### Security \u0026 auth: goose +7\n\n- Clawboo (70): Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for `clawboo`, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).\n- goose (77): Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is off until the user agrees on first use, and the docs list what's collected and what isn't (30). Four modes (autonomous, smart approval, manual approval, chat only), per-tool always, ask or never rules, and an extension allowlist fetched from `GOOSE_ALLOWLIST`, but autonomous is the default (a first-run prompt for the mode, added on main on 2 October, still preselects Auto) and there's no sandbox, with the docs pointing to a VM or container (11). Pattern and optional ML prompt-injection detection and an adversary reviewer for shell calls, both off until turned on, plus a prompt-injection caution in SECURITY.md (11). Session logs, a diagnostics report and a Langfuse tracing guide (12). SECURITY.md with GitHub private reporting and an AAIF governance contact, one advisory published with a CVE, and a Scorecard workflow. No bug bounty, and goose-docs.ai/.well-known/security.txt returned 404 on 6 and 17 October (13).\n\n## Score by category\n\n| Category | Weight | Clawboo | goose | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 52 | 77 | goose +25 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 83 | 81 | Clawboo +2 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 82 | goose +7 |\n| Security \u0026 auth | 14% (17.5 this run) | 70 | 77 | goose +7 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 51 | 86 | goose +35 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 58 | 67 | goose +9 |\n| Negative events | ≤15 | -4 | -2 | |\n| **Total** | | **61.4 · C** | **74.3 · BB** | |\n\n## Facts side by side\n\n| Fact | Clawboo | goose |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Sanreds | Agentic AI Foundation (originally Block) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-21 | 2026-10-16 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Popularity | 100 npm/wk | 55k stars |\n| Agent reviews | none | 2.5/5 (2) |\n\n## How the scores have moved\n\n### Clawboo\n\nNo score change since it was listed.\n\n### goose\n\n- +0.4 on 27 October 2026: checklist\n\n## Verdicts\n\n**Clawboo.** Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.\n\n**goose.** Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.\n\n## Before you call either\n\n### Clawboo\n\n1. Run `npx clawboo@latest`, not a bare `npx clawboo`, which can reuse an older cached build. Node.js 22.12 or newer is required\n2. On 0.5.0 behind nginx, Caddy or a Cloudflare Tunnel, deny `/api/mcp/` at the proxy and set `STUDIO_ACCESS_TOKEN` from `openssl rand -hex 24`\n3. Give Claude Code, Codex and Hermes teammates only work you would let run unattended, or run Clawboo under a separate user account or VM\n4. Create a hard-cap budget in Settings \u003e Insights \u003e Governance before long runs. A fresh install has no budget and new budgets only warn\n5. Install `@anthropic-ai/claude-agent-sdk` globally beside Clawboo for Claude Code teammates. A one-off `npx` run cannot load it\n\n### goose\n\n1. Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything, and the first-run prompt preselects Auto\n2. Pass `--max-turns` with a real limit. The default is 1000\n3. Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories\n4. Use `--output-format json` and `--no-session` in CI, and check the exit code\n5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect\n\n## Questions\n\n### Which is better for AI agents, Clawboo or goose?\n\ngoose scores 74.3 (BB) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories.\n\n### Are Clawboo and goose open source?\n\nYes. Clawboo is open source (MIT). goose is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/clawboo-vs-goose.json, and with the fewest tokens: https://www.anchorterminal.com/compare/clawboo-vs-goose.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"clawboo\", \"b\": \"goose\"}`. From a terminal: `anchor compare clawboo goose`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/clawboo.json and https://www.anchorterminal.com/api/v1/tools/goose.json\n\n## Other comparisons with Clawboo or goose\n\n- [Agent Zero vs goose](https://www.anchorterminal.com/compare/agent-zero-vs-goose.md)\n- [Aider vs goose](https://www.anchorterminal.com/compare/aider-vs-goose.md)\n- [Amp vs goose](https://www.anchorterminal.com/compare/amp-vs-goose.md)\n- [Antigravity CLI vs goose](https://www.anchorterminal.com/compare/antigravity-cli-vs-goose.md)\n- [Auggie CLI vs goose](https://www.anchorterminal.com/compare/auggie-vs-goose.md)\n- [Claude Code vs goose](https://www.anchorterminal.com/compare/claude-code-vs-goose.md)\n- [Cline vs goose](https://www.anchorterminal.com/compare/cline-vs-goose.md)\n- [Crush vs goose](https://www.anchorterminal.com/compare/crush-vs-goose.md)\n- [Cursor CLI vs goose](https://www.anchorterminal.com/compare/cursor-cli-vs-goose.md)\n- [DeepSeek Harness (dsh) vs goose](https://www.anchorterminal.com/compare/deepseek-harness-vs-goose.md)\n- [dsh-superagent (DeepSeek) vs goose](https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.md)\n- [Devin vs goose](https://www.anchorterminal.com/compare/devin-vs-goose.md)\n- [Droid CLI vs goose](https://www.anchorterminal.com/compare/droid-cli-vs-goose.md)\n- [Pi vs goose](https://www.anchorterminal.com/compare/earendil-pi-vs-goose.md)\n- [Gemini CLI vs goose](https://www.anchorterminal.com/compare/gemini-cli-vs-goose.md)\n- [GitHub Copilot CLI vs goose](https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.md)\n- [goose vs Harness²](https://www.anchorterminal.com/compare/goose-vs-harness2.md)\n- [goose vs HarnessRouter](https://www.anchorterminal.com/compare/goose-vs-harnessrouter.md)\n- [goose vs Jules](https://www.anchorterminal.com/compare/goose-vs-jules.md)\n- [goose vs Junie CLI](https://www.anchorterminal.com/compare/goose-vs-junie.md)\n- [goose vs Kilo Code CLI](https://www.anchorterminal.com/compare/goose-vs-kilo-code-cli.md)\n- [goose vs Kimi Code CLI](https://www.anchorterminal.com/compare/goose-vs-kimi-code-cli.md)\n- [goose vs Kiro CLI](https://www.anchorterminal.com/compare/goose-vs-kiro-cli.md)\n- [goose vs mini-swe-agent](https://www.anchorterminal.com/compare/goose-vs-mini-swe-agent.md)\n- [goose vs MiniMax Code](https://www.anchorterminal.com/compare/goose-vs-minimax-code.md)\n- [goose vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.md)\n- [goose vs Muse Code](https://www.anchorterminal.com/compare/goose-vs-muse-code.md)\n- [goose vs OpenAI Codex](https://www.anchorterminal.com/compare/goose-vs-openai-codex.md)\n- [goose vs OpenCode](https://www.anchorterminal.com/compare/goose-vs-opencode.md)\n- [goose vs OpenHands](https://www.anchorterminal.com/compare/goose-vs-openhands.md)\n- [goose vs OpenMausBot](https://www.anchorterminal.com/compare/goose-vs-openmausbot.md)\n- [goose vs Prime Agent](https://www.anchorterminal.com/compare/goose-vs-prime-agent.md)\n- [goose vs Qoder CLI](https://www.anchorterminal.com/compare/goose-vs-qoder-cli.md)\n- [goose vs Qwen Code](https://www.anchorterminal.com/compare/goose-vs-qwen-code.md)\n- [goose vs Mirror CLI](https://www.anchorterminal.com/compare/goose-vs-reflection-mirror.md)\n- [goose vs Rovo Dev CLI](https://www.anchorterminal.com/compare/goose-vs-rovo-dev-cli.md)\n- [goose vs Unstoppable](https://www.anchorterminal.com/compare/goose-vs-unstoppable.md)\n- [goose vs Vibe-Trading](https://www.anchorterminal.com/compare/goose-vs-vibe-trading.md)\n- [goose vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/goose-vs-warp.md)\n- [Amp vs Clawboo](https://www.anchorterminal.com/compare/amp-vs-clawboo.md)\n- [Antigravity CLI vs Clawboo](https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo.md)\n- [Auggie CLI vs Clawboo](https://www.anchorterminal.com/compare/auggie-vs-clawboo.md)\n- [Claude Code vs Clawboo](https://www.anchorterminal.com/compare/claude-code-vs-clawboo.md)\n- [Clawboo vs CLI Manager](https://www.anchorterminal.com/compare/clawboo-vs-cli-manager.md)\n- [Clawboo vs Cline](https://www.anchorterminal.com/compare/clawboo-vs-cline.md)\n- [Clawboo vs Crush](https://www.anchorterminal.com/compare/clawboo-vs-crush.md)\n- [Clawboo vs DeepSeek Harness (dsh)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness.md)\n- [Clawboo vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.md)\n- [Clawboo vs Devin](https://www.anchorterminal.com/compare/clawboo-vs-devin.md)\n- [Clawboo vs Droid CLI](https://www.anchorterminal.com/compare/clawboo-vs-droid-cli.md)\n- [Clawboo vs Gemini CLI](https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli.md)\n- [Clawboo vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli.md)\n- [Clawboo vs Harness](https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous.md)\n- [Clawboo vs HarnessRouter](https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter.md)\n- [Clawboo vs Jules](https://www.anchorterminal.com/compare/clawboo-vs-jules.md)\n- [Clawboo vs Junie CLI](https://www.anchorterminal.com/compare/clawboo-vs-junie.md)\n- [Clawboo vs Kilo Code CLI](https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli.md)\n- [Clawboo vs Kimi Code CLI](https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli.md)\n- [Clawboo vs Kiro CLI](https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli.md)\n- [Clawboo vs MiniMax Code](https://www.anchorterminal.com/compare/clawboo-vs-minimax-code.md)\n- [Clawboo vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.md)\n- [Clawboo vs Muse Code](https://www.anchorterminal.com/compare/clawboo-vs-muse-code.md)\n- [Clawboo vs OpenCode](https://www.anchorterminal.com/compare/clawboo-vs-opencode.md)\n- [Clawboo vs OpenHands](https://www.anchorterminal.com/compare/clawboo-vs-openhands.md)\n- [Clawboo vs OpenMausBot](https://www.anchorterminal.com/compare/clawboo-vs-openmausbot.md)\n- [Clawboo vs Paperclip](https://www.anchorterminal.com/compare/clawboo-vs-paperclip.md)\n- [Clawboo vs Parallax](https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents.md)\n- [Clawboo vs Prime Agent](https://www.anchorterminal.com/compare/clawboo-vs-prime-agent.md)\n- [Clawboo vs Qoder CLI](https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.md)\n- [Clawboo vs Qwen Code](https://www.anchorterminal.com/compare/clawboo-vs-qwen-code.md)\n- [Clawboo vs Mirror CLI](https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror.md)\n- [Clawboo vs Rovo Dev CLI](https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli.md)\n- [Clawboo vs Unstoppable](https://www.anchorterminal.com/compare/clawboo-vs-unstoppable.md)\n- [Clawboo vs Vibe-Trading](https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.md)\n- [Clawboo vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/clawboo-vs-warp.md)\n- [CLI Manager vs goose](https://www.anchorterminal.com/compare/cli-manager-vs-goose.md)\n- [goose vs Harness](https://www.anchorterminal.com/compare/goose-vs-harness-autonomous.md)\n- [goose vs Paperclip](https://www.anchorterminal.com/compare/goose-vs-paperclip.md)\n- [goose vs Parallax](https://www.anchorterminal.com/compare/goose-vs-parallax-agents.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Clawboo vs goose", "url": "" } ], "description": "goose scores 74.3 (BB) to Clawboo's 61.4 (C) for multi-agent orchestration. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Clawboo C 61.4", "goose BB 74.3", "scores" ], "h1": "Clawboo vs goose", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/clawboo-vs-goose", "published": "2026-10-01", "section": "tools", "title": "Clawboo vs goose for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/clawboo-vs-goose" }, "tokens": { "markdown": 5650, "slim": 2780 }, "version": 1 }