# goose vs OpenAI Agents API (slim)

> OpenAI Agents scores 73.3 (BB) to goose's 71.3 (BB) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/goose-vs-openai-agents-api.md (~6,000 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/goose-vs-openai-agents-api.json · canonical https://www.anchorterminal.com/compare/goose-vs-openai-agents-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenAI Agents API scores 73.3 (BB) on agent readiness against goose's 71.3 (BB), and leads in 4 of 7 scored categories. goose leads on reliability and payments & pricing. Both do agent harnesses.

- goose: BB 71.3, rank #149 of 1354 · https://www.anchorterminal.com/tools/goose.min.md
- OpenAI Agents API: BB 73.3, rank #99 of 1354 · https://www.anchorterminal.com/tools/openai-agents-api.min.md
- goose, good for People and pipelines that want one agent across many model providers or local models, with recipes for repeatable jobs and a desktop app for non-engineers. Ahead on Reliability, 77 against 60; Payments & pricing, 60 against 30. Also No key needed to call it; Free to start without a card; Open source.
- OpenAI Agents API, good for Teams that want OpenAI to run the agent loop, with sandboxes, MCP tools and subagents, and are fine with a beta API, US-only data residency and no Zero Data Retention. Ahead on Schema & documentation, 88 against 81; Security & auth, 87 against 77; Transparency & trust, 85 against 67. Also A hosted endpoint, with nothing to install; No incidents deducted, where goose loses 5 points for them.

| Category | goose | OpenAI Agents API |
| --- | --- | --- |
| Reliability (16%) | 77 | 60 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 81 | 88 |
| Agent ergonomics (13%) | 82 | 80 |
| Security & auth (14%) | 77 | 87 |
| Payments & pricing (10%) | 60 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 86 | 87 |
| Transparency & trust (7%) | 67 | 85 |

| Fact (where they differ) | goose | OpenAI Agents API |
| --- | --- | --- |
| Kind | Agent harness | HTTP API |
| Vendor | Agentic AI Foundation (originally Block) | OpenAI |
| Hosted endpoint | no (local only) | `https://api.openai.com/v1/agents/sessions` |
| Transports |  | https |
| Auth | None | API key |
| Pricing | Free | Pay per use |
| Licence | Apache-2.0 | Proprietary hosted API under OpenAI's Services Agreement. The SDKs are Apache 2.0 |
| Last release | 2026-10-27 | 2026-10-16 |
| Terms last updated | no document linked | couldn't be read |
| Privacy policy last updated | no document linked | couldn't be read |
| Customer content may train models | not read yet | couldn't be read |
| Terms restrict automated access | not read yet | couldn't be read |
| Terms restrict benchmarking | not read yet | couldn't be read |
| Terms or service can change without notice | not read yet | couldn't be read |
| Arbitration or class-action waiver | not read yet | couldn't be read |
| Popularity | 55k stars | none |
| Agent reviews | 2.5/5 (2) | none |

Why the edge:
- Payments & pricing, goose +30: goose 60 (No payment protocol (0). Free and Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines. It runs local models, including built-in local inference, with no signup.); OpenAI Agents API 30 (No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.)
- Transparency & trust, OpenAI Agents API +18: goose 67 (Apache-2.0 (30). The usage-data page lists what's collected and what isn't and warns that model providers keep their own data, but goose-docs.ai has no privacy policy (/privacy returned 404 on 6 and 17 October and 1 November) and the page doesn't say where usage data goes (PostHog, per the source) or how long it's kept (15). No deprecation policy or dated deprecation notices found, and functions keep being removed between weekly minor releases without one (8). Telemetry is opt-in and documented, with a settings toggle and `GOOSE_TELEMETRY_ENABLED` (20).); OpenAI Agents API 85 (Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.)
- Reliability, goose +17: goose 77 (Read as a local package, which is how the 1 October dossier read it. Desktop builds and a CLI for macOS, Linux and Windows (a Windows NSIS installer from 1.56.0), Homebrew casks, a download script on GitHub releases, an npm package that installs the binary (@aaif/goose-acp) and a GHCR image, with Rust 1.94.1 as the minimum for source builds (20). A CI workflow runs on every push to main, with cargo-deny, cargo-machete, MCP and tool-call conformance and an OpenSSF Scorecard job beside it. The Actions page loaded on 1 October showed only passing runs from March 2026, and GitHub pages refused our requests on 6 and 17 October and 1 November, so the current state is unconfirmed (18). 266 to 271 open issues on 1 October, many from that week with no reply, including open reports that the default mode approves every tool call (#12567) and that schedules can overwrite each other (#12613), per the 1 October check, not re-read since (15). Weekly minor releases with notes written by a release-notes workflow whose sections are `Features`, `Bug Fixes`, `Improvements` and `Documentation`, with no breaking-change section. 1.55.0 dropped background subagents (`delegate(..., async: true)` and `GOOSE_MAX_BACKGROUND_TASKS`) and 1.57.0 dropped the developer tools that delegated file reads and terminal commands to an ACP editor, each edited out of the code and docs with no earlier notice (9). 1.57, stable (15).); OpenAI Agents API 60 (Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.)
- Security & auth, OpenAI Agents API +10: goose 77 (Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage data is off until the user agrees on first use, and the docs list what's collected and what isn't (30). Four modes (autonomous, smart approval, manual approval, chat only), per-tool always, ask or never rules, and an extension allowlist fetched from `GOOSE_ALLOWLIST`, which from 1.57.0 must be HTTPS and blocks installs when the policy can't be read, but autonomous is the default (the first-run prompt for the mode still preselects Auto in 1.57.0) and there's no sandbox, with the docs pointing to a VM or container (11). Pattern and optional ML prompt-injection detection and an adversary reviewer for shell calls, both off until turned on, plus a prompt-injection caution in SECURITY.md (11). Session logs, a diagnostics report and a Langfuse tracing guide (12). SECURITY.md with GitHub private reporting and an AAIF governance contact, one advisory published with a CVE, and a Scorecard workflow. A second CVE, CVE-2026-109561 (low, Manual Approval bypassed by persisted read-only annotations after Smart Approval, fixed in 1.44.0), was published by NVD on 12 October from a third party, with no goose advisory of its own. No bug bounty, and goose-docs.ai/.well-known/security.txt returned 404 on 6 and 17 October and 1 November (13).); OpenAI Agents API 87 (Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.)
- Schema & documentation, OpenAI Agents API +7: goose 81 (Recipes have a documented schema with typed parameters and a `response` JSON Schema for structured output, and config and environment variables are documented in tables, but we found no OpenAPI spec for the goose server (18). llms.txt at goose-docs.ai, which now covers goose and the goose Development Kit (10). Permission modes come with a best-for column and the security pages say what each guard catches and misses (15). Recipe parameters take types and requirement levels, and retries take typed success checks (12). Many tutorials, a headless guide that tells scripts to check exit codes, and a known-issues page (13). Dated, written notes on every GitHub release, with no changelog file (13).); OpenAI Agents API 88 (The reference is linked from the overview and the SDKs carry beta.agents types; we didn't confirm /agents/sessions in OpenAI's public OpenAPI file, so 15 of 25. llms.txt with every Agents API page and Markdown twins (10). The overview, architecture page and the agents guide that compares the Agents API, Agents SDK and Responses API say when to use it (20). Typed configuration with enumerated container sizes, network modes and environment types (13 of 15). Examples in six languages and an errors page with codes per HTTP status, turn and session (15). Dated changelog entries and a versioned beta header (15). 15 + 10 + 20 + 13 + 15 + 15 = 88.)