# Conductor vs goose (slim)

> goose scores 71.3 (BB) to Conductor's 41.3 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/conductor-vs-goose.md (~5,800 tokens) · this version ~2,380 tokens · JSON https://www.anchorterminal.com/compare/conductor-vs-goose.json · canonical https://www.anchorterminal.com/compare/conductor-vs-goose
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

goose scores 71.3 (BB) on agent readiness against Conductor's 41.3 (E), and leads in every scored category. Both do agent harnesses.

- Conductor: E 41.3, rank #1285 of 1486 · https://www.anchorterminal.com/tools/conductor.min.md
- goose: BB 71.3, rank #165 of 1486 · https://www.anchorterminal.com/tools/goose.min.md
- Conductor, good for Existing Conductor users planning their move before Cloud closes on 20 November 2026 and the local app winds down in early 2027. Also No incidents deducted, where goose loses 5 points for them.
- goose, good for People and pipelines that want one agent across many model providers or local models, with recipes for repeatable jobs and a desktop app for non-engineers. Ahead on Reliability, 77 against 25; Schema & documentation, 81 against 60; Agent ergonomics, 82 against 55; Security & auth, 77 against 45; Payments & pricing, 60 against 0; Maintenance & community, 86 against 58; Transparency & trust, 67 against 53. Also Agent-ready, a grade of BB or better; No key needed to call it; Free to start without a card; Open source.

| Category | Conductor | goose |
| --- | --- | --- |
| Reliability (16%) | 25 | 77 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 60 | 81 |
| Agent ergonomics (13%) | 55 | 82 |
| Security & auth (14%) | 45 | 77 |
| Payments & pricing (10%) | 0 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 58 | 86 |
| Transparency & trust (7%) | 53 | 67 |

| Fact (where they differ) | Conductor | goose |
| --- | --- | --- |
| Vendor | Conductor (joining Meta) | Agentic AI Foundation (originally Block) |
| Auth | OAuth or key | None |
| Pricing | Paid | Free |
| Licence | Proprietary. A closed-source Mac app and hosted Conductor Cloud under Conductor's terms | Apache-2.0 |
| llms.txt | no | yes |
| Last release | 2026-11-04 | 2026-10-27 |
| Terms last updated | not read yet | no document linked |
| Privacy policy last updated | not read yet | no document linked |
| Popularity | none | 55k stars |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Payments & pricing, goose +60: Conductor 0 (No new sign-ups since 4 November, free users can't upgrade, and no price is shown. No protocol, no published price, no open free tier, no onboarding (0).); goose 60 (No payment protocol (0). Free and Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines. It runs local models, including built-in local inference, with no signup.)
- Reliability, goose +52: Conductor 25 (Read as local software that is winding down. Installed from Conductor's own download, which stopped taking new users on 4 November 2026 (10). Closed source, so no public CI or issue tracker (0, 0). A dated changelog, newest 0.93.0 on 4 November (15). Version 0.93 (0). 10 + 0 + 0 + 15 + 0 = 25.); goose 77 (Read as a local package, which is how the 1 October dossier read it. Desktop builds and a CLI for macOS, Linux and Windows (a Windows NSIS installer from 1.56.0), Homebrew casks, a download script on GitHub releases, an npm package that installs the binary (@aaif/goose-acp) and a GHCR image, with Rust 1.94.1 as the minimum for source builds (20). A CI workflow runs on every push to main, with cargo-deny, cargo-machete, MCP and tool-call conformance and an OpenSSF Scorecard job beside it. The Actions page loaded on 1 October showed only passing runs from March 2026, and GitHub pages refused our requests on 6 and 17 October and 1 November, so the current state is unconfirmed (18). 266 to 271 open issues on 1 October, many from that week with no reply, including open reports that the default mode approves every tool call (#12567) and that schedules can overwrite each other (#12613), per the 1 October check, not re-read since (15). Weekly minor releases with notes written by a release-notes workflow whose sections are `Features`, `Bug Fixes`, `Improvements` and `Documentation`, with no breaking-change section. 1.55.0 dropped background subagents (`delegate(..., async: true)` and `GOOSE_MAX_BACKGROUND_TASKS`) and 1.57.0 dropped the developer tools that delegated file reads and terminal commands to an ACP editor, each edited out of the code and docs with no earlier notice (9). 1.57, stable (15).)
- Security & auth, goose +32: Conductor 45 (Closed app. Telemetry and data handling weren't read beyond the transition notice (10 of 30). A security and permissions page (10 of 20). No prompt-injection guidance found (5). No audit log found (5). SOC 2 Type II report at trust.conductor.build (15 of 20). 10 + 10 + 5 + 5 + 15 = 45.); goose 77 (Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is off until the user agrees on first use, and the docs list what's collected and what isn't (30). Four modes (autonomous, smart approval, manual approval, chat only), per-tool always, ask or never rules, and an extension allowlist fetched from `GOOSE_ALLOWLIST`, which from 1.57.0 must be HTTPS and blocks installs when the policy can't be read, but autonomous is the default (the first-run prompt for the mode still preselects Auto in 1.57.0) and there's no sandbox, with the docs pointing to a VM or container (11). Pattern and optional ML prompt-injection detection and an adversary reviewer for shell calls, both off until turned on, plus a prompt-injection caution in SECURITY.md (11). Session logs, a diagnostics report and a Langfuse tracing guide (12). SECURITY.md with GitHub private reporting and an AAIF governance contact, one advisory published with a CVE, and a Scorecard workflow. A second CVE, CVE-2026-109561 (low, Manual Approval bypassed by persisted read-only annotations after Smart Approval, fixed in 1.44.0), was published by NVD on 12 October from a third party, with no goose advisory of its own. No bug bounty, and goose-docs.ai/.well-known/security.txt returned 404 on 6 and 17 October and 1 November (13).)
- Maintenance & community, goose +28: Conductor 58 (0.93.0 on 4 November 2026 (30). Several dated releases in 90 days, per the changelog index (20). Discord, a subreddit and email for support (8). Closed app, no package or CI to read (0). 30 + 20 + 8 + 0 + 0 = 58. The local app gets new models and critical fixes only until early 2027.); goose 86 (v1.57.0 tagged on 27 October 2026, after v1.56.0 on 22 October (30). 13 releases in the 90 days from 3 August, 1.46.0 (11 August) to 1.57.0, about one a week, plus GDK alpha tags (20). Issues move through a public board with Inbox and Ready columns and some new reports get a label within a day, but many of the week's reports had no reply on 1 October, and pull requests that don't implement a Ready issue are closed, per the 1 October check, not re-read since (15). Desktop, CLI, npm and GHCR builds ship from the same tag, and Python and Java SDK builds run in CI (13). cargo-deny, cargo-machete, Dependabot and Scorecard workflows, every GitHub Action pinned to a commit SHA since 29 September, and jsonwebtoken removed on 26 October to stop ignoring its cargo-deny advisories, with the current CI state unconfirmed (8).)
- Agent ergonomics, goose +27: Conductor 55 (Harness reading. Each task gets a workspace, branch, terminal and diff, with pull requests and merges from the app, and an API for integrations; not re-read in detail (55).); goose 82 (Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. The built-in extensions are few, and Code Mode lets the model find MCP tools through code instead of loading every definition (23). `--max-turns` (default 1000), `GOOSE_MAX_TOKENS` and automatic context compaction, though 1000 turns is a high default for an unattended run (16). `goose run --output-format json` or `stream-json` for scripts (15). Recipes can retry with success checks and an `on_failure` command, and sessions resume (17). A Rust core with Python and Java SDK builds, and one command runs a task, but a provider has to be configured first and the default mode approves everything (11).)
- Schema & documentation, goose +21: Conductor 60 (Harness reading. Docs for workspaces, review and merge, a Conductor API reference page linked from the docs (not read), and security and permissions pages (60).); goose 81 (Recipes have a documented schema with typed parameters and a `response` JSON Schema for structured output, and config and environment variables are documented in tables, but we found no OpenAPI spec for the goose server (18). llms.txt at goose-docs.ai, which now covers goose and the goose Development Kit (10). Permission modes come with a best-for column and the security pages say what each guard catches and misses (15). Recipe parameters take types and requirement levels, and retries take typed success checks (12). Many tutorials, a headless guide that tells scripts to check exit codes, and a known-issues page (13). Dated, written notes on every GitHub release, with no changelog file (13).)