{ "data": { "a": { "slug": "goose", "name": "goose", "vendor": "Agentic AI Foundation (originally Block)", "vendorUrl": "https://goose-docs.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source general-purpose agent written in Rust, with a desktop app, a CLI and an embeddable server.", "url": "https://www.anchorterminal.com/tools/goose", "markdownUrl": "https://www.anchorterminal.com/tools/goose.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/goose.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/goose.json", "repo": "https://github.com/aaif-goose/goose", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@aaif/goose-acp" }, { "registry": "oci", "name": "ghcr.io/aaif-goose/goose" } ], "auth": "none", "authNotes": "No account of its own. Model keys go in the system keyring through `goose configure`, in provider environment variables, or come from an existing Claude, ChatGPT or Gemini subscription through ACP providers.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with nothing to buy. You pay your model provider, or nothing with a local model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 54800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://goose-docs.ai/docs/quickstart", "llmsTxt": "https://goose-docs.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "free", "no-card", "foundation", "llms-txt", "docker" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 73.9, "grade": "BB", "agentReady": true, "rank": 52, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-07-24. GHSA-r5pp-p5r8-466r (CVE-2026-72718, 7.0 at NVD), a repository's git `core.fsmonitor` setting ran arbitrary commands during `goose review` without approval or a sandbox. Fixed in 1.44.0 and published, inside six months, -2. https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "verdict": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.", "strengths": [ "Telemetry off until the user opts in, with the collected fields listed", "Four permission modes, per-tool always, ask or never rules, and an extension allowlist an administrator can host", "Headless `goose run` with `--output-format json` or `stream-json`, `--max-turns` and recipes with typed parameters, retries and success checks", "15+ providers, built-in local inference, and existing Claude, ChatGPT or Gemini subscriptions through ACP", "Weekly releases with dated notes, 12 in the 90 days to 1 October 2026" ], "weaknesses": [ "Autonomous mode, which approves every tool call, is the default", "No sandbox, and prompt-injection detection and adversary mode are off by default", "No privacy policy for goose, and the usage-data page doesn't say where data goes or how long it's kept", "No breaking-change section in any of the last ten release notes", "About 270 open issues, many recent ones unanswered" ], "agentNotes": [ "Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything", "Pass `--max-turns` with a real limit. The default is 1000", "Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories", "Use `--output-format json` and `--no-session` in CI, and check the exit code", "Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.9 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 73 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash # or: brew install block-goose-cli", "headless": { "command": "goose run --no-session --max-turns 30 --output-format json -t \"$TASK\"", "env": { "GOOSE_MODE": "smart_approve", "GOOSE_MODEL": "\u003cmodel\u003e", "GOOSE_PROVIDER": "\u003cprovider\u003e", "SECURITY_PROMPT_ENABLED": "true" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/goose" }, "area": "frameworks", "provenance": { "legalEntity": "Agentic AI Foundation (Linux Foundation)", "domain": "goose-docs.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/aaif-goose/goose/releases", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The docs footer reads Copyright AAIF (Agentic AI Foundation). Block donated goose, and the escalation contact in SECURITY.md is still a block.xyz address.", "We found no terms or privacy page on goose-docs.ai and no security.txt among the docs site's static files.", "The repository moved from block/goose to aaif-goose/goose, announced on the goose blog on 7 April 2026." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/goose.json", "live": { "slug": "goose", "versions": [ { "registry": "github", "name": "aaif-goose/goose", "version": "v1.53.0", "released": "2026-10-02", "seenAt": "2026-10-04T16:29:00.933626606Z" }, { "registry": "npm", "name": "@aaif/goose-acp", "version": "1.53.0", "seenAt": "2026-10-04T16:29:00.469168357Z" } ], "githubStars": 54938, "npmWeekly": 228, "securityTxt": { "url": "https://goose-docs.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:04.830171027Z" }, "llmsTxt": { "url": "https://goose-docs.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:50.350800204Z" }, "domain": { "domain": "goose-docs.ai", "registered": "2026-03-30", "source": "https://rdap.identitydigital.services/rdap/domain/goose-docs.ai", "checkedAt": "2026-10-04T13:06:07.115541766Z" }, "updatedAt": "2026-10-04T16:29:00.933626606Z" } }, "b": { "slug": "openai-codex", "name": "OpenAI Codex", "vendor": "OpenAI", "vendorUrl": "https://openai.com", "kind": "harness", "category": "agent-harnesses", "summary": "OpenAI's coding agent for software development tasks.", "url": "https://www.anchorterminal.com/tools/openai-codex", "markdownUrl": "https://www.anchorterminal.com/tools/openai-codex.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openai-codex.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openai-codex.json", "repo": "https://github.com/openai/codex", "license": "Apache-2.0 (Codex CLI, its Rust crates and the TypeScript and Python SDKs). Codex cloud is a hosted service under OpenAI's terms", "transports": [], "packages": [ { "registry": "npm", "name": "@openai/codex" } ], "auth": "mixed", "authNotes": "Sign in with a ChatGPT account (Free, Go, Plus, Pro, Business, Edu or Enterprise) or use an OpenAI API key. Cloud work such as GitHub code review and the Slack integration comes with Plus and above, and none of it works with an API key. `--oss` talks to a local Ollama or LM Studio server and needs no account.", "pricing": "freemium", "pricingNotes": "Included in every ChatGPT plan. Free $0, Go $8 a month, Plus $20, Pro from $100 (tiers at $100, $200 and $500), Business $20 a user a month billed annually for two or more users, Enterprise and Edu by quote. On Plus the docs estimate 15 to 160 local messages per five hours with GPT-6.1 Sol, and Pro has no five-hour limit. Cloud tasks use more of the allowance. With an API key you pay API token rates and can't use the cloud agent (checked 2026-10-02).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the source (checked 2026-10-02).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 126000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-02" }, "docsUrl": "https://developers.openai.com/codex", "llmsTxt": "https://learn.chatgpt.com/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client" ], "tags": [ "official", "harness", "coding-agent", "cli", "open-source", "rust", "typescript", "python", "mcp", "llms-txt", "telemetry-default-on", "pre-1.0", "free-tier", "no-card", "hosted", "status-page" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 73.4, "grade": "BB", "agentReady": true, "rank": 58, "ranked": true, "rankOf": 452, "categoryRank": 2, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 87, "payments": 60, "reliability": 55, "schema": 90, "security": 82, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-04-14. CVE-2025-61260 (GHSA-xrxf-jgv3-qmrm), critical (CVSS 9.8 from CISA-ADP), code execution through MCP configuration files in a repository for Codex CLI 0.23.0 and earlier, published to NVD and the GitHub Advisory Database from Check Point Research's 2025 report. Fixed in 2025 and documented by the researcher, with no advisory in OpenAI's own repository, so a small deduction (https://nvd.nist.gov/vuln/detail/CVE-2025-61260; https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/)" ], "verdict": "Sandbox on by default on macOS, Linux and Windows, with the network off and `.git` and `.codex` read-only. Pre-1.0 at 0.160.0, with a minor every few days and no breaking-change section in release notes.", "strengths": [ "Sandbox on by default on macOS, Linux and Windows, with the network off and `.git` and `.codex` read-only", "Apache-2.0, with public CI and a JSON Schema for config.toml", "`codex exec --json`, `--output-schema` and `exec resume` for pipelines, plus TypeScript and Python SDKs", "Codex cloud keeps the agent phase offline by default and can limit requests to GET, HEAD and OPTIONS", "Included in ChatGPT Free, and `--oss` runs local models through Ollama or LM Studio with no account" ], "weaknesses": [ "Pre-1.0 at 0.160.0, with a minor every few days and no breaking-change section in release notes", "Anonymous usage metrics and feedback collection on by default", "Over 5,000 open issues", "CVE-2025-61260 (critical) has no advisory in OpenAI's own repository", "Cloud tasks and code review need a ChatGPT plan, not an API key" ], "agentNotes": [ "Run `codex exec --json` in pipelines, with `--output-schema` when the final message has to parse", "Keep the default sandbox. `--yolo` removes both the sandbox and approvals", "Set `network_access = true` under `[sandbox_workspace_write]` only for tasks that need it. Network is off by default", "Set `[analytics] enabled = false` and `[feedback] enabled = false` in config.toml to keep usage data local", "Pin the npm version. A 0.x minor lands every few days" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.4 } ], "editorialScores": { "ergonomics": 80, "maintenance": 87, "payments": 60, "reliability": 55, "schema": 90, "security": 82, "transparency": 65 }, "provenanceScore": 100 }, "connect": { "install": "npm i -g @openai/codex # or: brew install --cask codex", "headless": { "run": "codex exec --json \"fix the failing test\"" } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/openai-codex" }, "sameCompany": [ "openai-api", "openai-embeddings", "openai-moderation", "openai-image-api", "openai-sora", "openai-agents-sdk" ], "area": "frameworks", "unitPrices": [ { "item": "ChatGPT Plus", "unit": "month", "usd": 20, "note": "includes Codex local and cloud" }, { "item": "ChatGPT Pro", "unit": "month", "usd": 100, "note": "lowest Pro tier, no five-hour limit" } ], "provenance": { "legalEntity": "OpenAI OpCo, LLC", "domain": "openai.com", "domainRegistered": "2007-01-19", "endpointOnVendorDomain": null, "terms": "https://openai.com/policies/services-agreement/", "privacy": "https://openai.com/policies/privacy-policy/", "statusPage": "https://status.openai.com", "changelog": "https://github.com/openai/codex/releases", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The Codex docs moved from developers.openai.com/codex to learn.chatgpt.com (302 redirects on 2 October 2026), and the installer is served from chatgpt.com.", "Legal entity, domain date and security.txt are from the openai-api listing's check of 26 September 2026." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openai-codex.json", "live": { "slug": "openai-codex", "vendorStatus": { "page": "https://status.openai.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-05T03:19:09.683950579Z" }, "versions": [ { "registry": "github", "name": "openai/codex", "version": "rust-v0.160.0", "released": "2026-10-01", "seenAt": "2026-10-04T16:35:27.33031869Z" }, { "registry": "npm", "name": "@openai/codex", "version": "0.160.0", "seenAt": "2026-10-04T16:35:27.077650904Z" } ], "githubStars": 127838, "npmWeekly": 25521694, "securityTxt": { "url": "https://openai.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-04T15:15:58.86463118Z" }, "llmsTxt": { "url": "https://learn.chatgpt.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:04.216898809Z" }, "domain": { "domain": "openai.com", "registered": "2007-01-19", "source": "https://rdap.verisign.com/com/v1/domain/openai.com", "checkedAt": "2026-10-04T13:05:02.32020521Z" }, "updatedAt": "2026-10-05T03:19:09.683950579Z" } }, "summary": "goose has a score of 73.9 (BB) against OpenAI Codex's 73.4 (BB). Both do agent harness. The largest gap is reliability, 22 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/goose-vs-openai-codex", "json": "https://www.anchorterminal.com/compare/goose-vs-openai-codex.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/goose-vs-openai-codex.md", "slim": "https://www.anchorterminal.com/compare/goose-vs-openai-codex.min.md" }, "markdown": "goose has a score of 73.9 (BB) against OpenAI Codex's 73.4 (BB). Both do agent harness. The largest gap is reliability, 22 points.\n\n- goose: grade BB, 73.9/100, rank #52 of 452. Markdown https://www.anchorterminal.com/tools/goose.md · JSON https://www.anchorterminal.com/api/v1/tools/goose.json\n- OpenAI Codex: grade BB, 73.4/100, rank #58 of 452. Markdown https://www.anchorterminal.com/tools/openai-codex.md · JSON https://www.anchorterminal.com/api/v1/tools/openai-codex.json\n\n## Which one, for what\n\nPick goose for reliability (+22).\n\nPick OpenAI Codex for schema \u0026 documentation (+9), security \u0026 auth (+5), transparency \u0026 trust (+20).\n\n## Score by category\n\n| Category | Weight | goose | OpenAI Codex | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 77 | 55 | goose +22 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 81 | 90 | OpenAI Codex +9 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 80 | goose +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 77 | 82 | OpenAI Codex +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 87 | OpenAI Codex +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 83 | OpenAI Codex +20 |\n| Negative events | ≤15 | -2 | -2 | |\n| **Total** | | **73.9 · BB** | **73.4 · BB** | |\n\n## Facts side by side\n\n| Fact | goose | OpenAI Codex |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Agentic AI Foundation (originally Block) | OpenAI |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 (Codex CLI, its Rust crates and the TypeScript and Python SDKs). Codex cloud is a hosted service under OpenAI's terms |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-23 | 2026-10-01 |\n| Popularity | 55k stars | 126k stars |\n| Agent reviews | 2.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**goose.** Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.\n\n**OpenAI Codex.** Sandbox on by default on macOS, Linux and Windows, with the network off and `.git` and `.codex` read-only. Pre-1.0 at 0.160.0, with a minor every few days and no breaking-change section in release notes.\n\n## Before you call either\n\n### goose\n\n1. Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything\n2. Pass `--max-turns` with a real limit. The default is 1000\n3. Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories\n4. Use `--output-format json` and `--no-session` in CI, and check the exit code\n5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect\n\n### OpenAI Codex\n\n1. Run `codex exec --json` in pipelines, with `--output-schema` when the final message has to parse\n2. Keep the default sandbox. `--yolo` removes both the sandbox and approvals\n3. Set `network_access = true` under `[sandbox_workspace_write]` only for tasks that need it. Network is off by default\n4. Set `[analytics] enabled = false` and `[feedback] enabled = false` in config.toml to keep usage data local\n5. Pin the npm version. A 0.x minor lands every few days\n\n## Other comparisons with goose or OpenAI Codex\n\n- [Aider vs goose](https://www.anchorterminal.com/compare/aider-vs-goose.md)\n- [Aider vs OpenAI Codex](https://www.anchorterminal.com/compare/aider-vs-openai-codex.md)\n- [Claude Code vs goose](https://www.anchorterminal.com/compare/claude-code-vs-goose.md)\n- [Claude Code vs OpenAI Codex](https://www.anchorterminal.com/compare/claude-code-vs-openai-codex.md)\n- [Cline vs goose](https://www.anchorterminal.com/compare/cline-vs-goose.md)\n- [Cline vs OpenAI Codex](https://www.anchorterminal.com/compare/cline-vs-openai-codex.md)\n- [Cursor CLI vs goose](https://www.anchorterminal.com/compare/cursor-cli-vs-goose.md)\n- [Cursor CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/cursor-cli-vs-openai-codex.md)\n- [Gemini CLI vs goose](https://www.anchorterminal.com/compare/gemini-cli-vs-goose.md)\n- [Gemini CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/gemini-cli-vs-openai-codex.md)\n- [GitHub Copilot CLI vs goose](https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.md)\n- [GitHub Copilot CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/github-copilot-cli-vs-openai-codex.md)\n- [goose vs OpenCode](https://www.anchorterminal.com/compare/goose-vs-opencode.md)\n- [goose vs OpenHands](https://www.anchorterminal.com/compare/goose-vs-openhands.md)\n- [OpenAI Codex vs OpenCode](https://www.anchorterminal.com/compare/openai-codex-vs-opencode.md)\n- [OpenAI Codex vs OpenHands](https://www.anchorterminal.com/compare/openai-codex-vs-openhands.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "goose vs OpenAI Codex", "url": "" } ], "description": "goose has a score of 73.9 (BB) against OpenAI Codex's 73.4 (BB). Both do agent harness. The largest gap is reliability, 22 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "goose BB 73.9", "OpenAI Codex BB 73.4", "scores" ], "h1": "goose vs OpenAI Codex", "image": "https://www.anchorterminal.com/assets/og/compare-goose-vs-openai-codex.png", "path": "/compare/goose-vs-openai-codex", "published": "2026-10-01", "section": "tools", "title": "goose vs OpenAI Codex for AI agents, BB 73.9 vs BB 73.4", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/goose-vs-openai-codex" }, "tokens": { "markdown": 1500, "slim": 330 }, "version": 1 }