{ "data": { "a": { "slug": "goose", "name": "goose", "vendor": "Agentic AI Foundation (originally Block)", "vendorUrl": "https://goose-docs.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source general-purpose agent written in Rust, with a desktop app, a CLI and an embeddable server.", "url": "https://www.anchorterminal.com/tools/goose", "markdownUrl": "https://www.anchorterminal.com/tools/goose.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/goose.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/goose.json", "repo": "https://github.com/aaif-goose/goose", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@aaif/goose-acp" }, { "registry": "oci", "name": "ghcr.io/aaif-goose/goose" } ], "auth": "none", "authNotes": "No account of its own. Model keys go in the system keyring through `goose configure`, in provider environment variables, or come from an existing Claude, ChatGPT or Gemini subscription through ACP providers.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with nothing to buy. You pay your model provider, or nothing with a local model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 54800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://goose-docs.ai/docs/quickstart", "llmsTxt": "https://goose-docs.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "free", "no-card", "foundation", "llms-txt", "docker" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 73.9, "grade": "BB", "agentReady": true, "rank": 52, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-07-24. GHSA-r5pp-p5r8-466r (CVE-2026-72718, 7.0 at NVD), a repository's git `core.fsmonitor` setting ran arbitrary commands during `goose review` without approval or a sandbox. Fixed in 1.44.0 and published, inside six months, -2. https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "verdict": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.", "strengths": [ "Telemetry off until the user opts in, with the collected fields listed", "Four permission modes, per-tool always, ask or never rules, and an extension allowlist an administrator can host", "Headless `goose run` with `--output-format json` or `stream-json`, `--max-turns` and recipes with typed parameters, retries and success checks", "15+ providers, built-in local inference, and existing Claude, ChatGPT or Gemini subscriptions through ACP", "Weekly releases with dated notes, 12 in the 90 days to 1 October 2026" ], "weaknesses": [ "Autonomous mode, which approves every tool call, is the default", "No sandbox, and prompt-injection detection and adversary mode are off by default", "No privacy policy for goose, and the usage-data page doesn't say where data goes or how long it's kept", "No breaking-change section in any of the last ten release notes", "About 270 open issues, many recent ones unanswered" ], "agentNotes": [ "Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything", "Pass `--max-turns` with a real limit. The default is 1000", "Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories", "Use `--output-format json` and `--no-session` in CI, and check the exit code", "Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.9 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 73 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash # or: brew install block-goose-cli", "headless": { "command": "goose run --no-session --max-turns 30 --output-format json -t \"$TASK\"", "env": { "GOOSE_MODE": "smart_approve", "GOOSE_MODEL": "\u003cmodel\u003e", "GOOSE_PROVIDER": "\u003cprovider\u003e", "SECURITY_PROMPT_ENABLED": "true" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/goose" }, "area": "frameworks", "provenance": { "legalEntity": "Agentic AI Foundation (Linux Foundation)", "domain": "goose-docs.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/aaif-goose/goose/releases", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The docs footer reads Copyright AAIF (Agentic AI Foundation). Block donated goose, and the escalation contact in SECURITY.md is still a block.xyz address.", "We found no terms or privacy page on goose-docs.ai and no security.txt among the docs site's static files.", "The repository moved from block/goose to aaif-goose/goose, announced on the goose blog on 7 April 2026." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/goose.json", "live": { "slug": "goose", "versions": [ { "registry": "github", "name": "aaif-goose/goose", "version": "v1.53.0", "released": "2026-10-02", "seenAt": "2026-10-04T16:29:00.933626606Z" }, { "registry": "npm", "name": "@aaif/goose-acp", "version": "1.53.0", "seenAt": "2026-10-04T16:29:00.469168357Z" } ], "githubStars": 54938, "npmWeekly": 228, "securityTxt": { "url": "https://goose-docs.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:04.830171027Z" }, "llmsTxt": { "url": "https://goose-docs.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:50.350800204Z" }, "domain": { "domain": "goose-docs.ai", "registered": "2026-03-30", "source": "https://rdap.identitydigital.services/rdap/domain/goose-docs.ai", "checkedAt": "2026-10-04T13:06:07.115541766Z" }, "updatedAt": "2026-10-04T16:29:00.933626606Z" } }, "b": { "slug": "opencode", "name": "OpenCode", "vendor": "Anomaly", "vendorUrl": "https://opencode.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source terminal coding agent from Anomaly Innovations, with a TUI, a desktop app in beta, IDE and ACP integration, and a headless HTTP server with an OpenAPI spec and a TypeScript SDK.", "url": "https://www.anchorterminal.com/tools/opencode", "markdownUrl": "https://www.anchorterminal.com/tools/opencode.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/opencode.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/opencode.json", "repo": "https://github.com/anomalyco/opencode", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "opencode-ai" }, { "registry": "npm", "name": "@opencode-ai/sdk" } ], "auth": "none", "authNotes": "No account needed. Provider keys go in with `opencode auth login` (stored in ~/.local/share/opencode/auth.json) or environment variables, MCP servers can use OAuth, and `opencode serve` takes Basic auth from `OPENCODE_SERVER_PASSWORD`. With no key it uses free OpenCode Zen models with a public key.", "pricing": "freemium", "pricingNotes": "Free and MIT. You pay your model provider, or OpenCode Zen per token, with prices per million tokens published for every model, or OpenCode Go at $10 a month (Go Plus $40) for a set of open models. Some Zen models are free for a limited time and may use prompts to improve the model.", "priceSummary": "$10 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 211000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://opencode.ai/docs", "openapi": "https://raw.githubusercontent.com/anomalyco/opencode/dev/packages/sdk/openapi.json", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "freemium", "typescript", "openapi", "no-card", "no-key", "usage-priced" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 134, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 81, "payments": 60, "reliability": 68, "schema": 88, "security": 60, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -4, "negativeNotes": [ "2026-01-12. GHSA-vxw4-wv6m-9hhh (CVE-2026-22812, 8.8), the HTTP server the TUI started had no authentication, so local processes could run shell commands as the user, fixed in 1.0.216. GHSA-c83v-7274-4vgp (CVE-2026-22813), unsanitised Markdown in the web UI let a malicious page run commands on the machine, fixed in 1.1.10. Fixed, published and more than six months old, -1 each. https://github.com/anomalyco/opencode/security/advisories", "2026-09-24. GHSA-632h-h47v-g4x4 (7.5, no CVE). The server's `/global/upgrade` endpoint accepted any package specifier without checking where the request came from, so a web page could make `opencode serve` install an attacker's npm package and run its scripts. Fixed in 1.18.22. Inside six months, -2. https://github.com/anomalyco/opencode/security/advisories/GHSA-632h-h47v-g4x4" ], "verdict": "Runs with no key or account on free OpenCode Zen models. Most permissions default to allow, and SECURITY.md says the permission system is not a sandbox.", "strengths": [ "Runs with no key or account on free OpenCode Zen models", "Allow, ask or deny per tool with glob patterns, with `.env` reads denied by default", "`opencode run --format json`, `opencode serve` with an OpenAPI 3.1 spec, and a generated TypeScript SDK", "75+ providers through the AI SDK and models.dev, plus local models", "No product telemetry found, and OpenTelemetry export is opt-in" ], "weaknesses": [ "Most permissions default to allow, and SECURITY.md says the permission system is not a sandbox", "Updates download and install at startup unless `autoupdate` is off", "Keyless runs send prompts to free models, some of which may use them for training", "Three advisories in 2026 against its local HTTP server and web UI", "About 4,700 open issues and 1,600 open pull requests" ], "agentNotes": [ "Add deny rules for `bash` patterns and `external_directory` before an unattended run. Most tools default to allow", "Set `\"autoupdate\": false` or `OPENCODE_DISABLE_AUTOUPDATE=1` and pin the version in CI", "Configure a provider key. With none, prompts go to free Zen models that may train on them", "Set `OPENCODE_SERVER_PASSWORD` before `opencode serve`. Without it the server runs unauthenticated", "Use `opencode run --format json` and read the event stream rather than the formatted output" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 79, "maintenance": 81, "payments": 60, "reliability": 68, "schema": 88, "security": 60, "transparency": 82 }, "provenanceScore": 59 }, "connect": { "install": "npm i -g opencode-ai@latest # or: curl -fsSL https://opencode.ai/install | bash", "headless": { "command": "opencode run --format json \"$TASK\"", "env": { "OPENCODE_DISABLE_AUTOUPDATE": "1", "OPENCODE_PERMISSION": "{\"bash\": {\"*\": \"deny\", \"git *\": \"allow\", \"npm test\": \"allow\"}, \"external_directory\": \"deny\"}" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/opencode" }, "area": "frameworks", "unitPrices": [ { "item": "OpenCode Go", "unit": "month", "usd": 10, "note": "Go Plus is $40 a month" } ], "provenance": { "legalEntity": "Anomaly Innovations, Inc.", "domain": "opencode.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://opencode.ai/legal/terms-of-service", "privacy": "https://opencode.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://opencode.ai/changelog", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The terms (effective 15 August 2026) name Anomaly Innovations, Inc. The privacy policy is effective 6 March 2026, with help@anoma.ly as the contact.", "opencode.ai/.well-known/security.txt returns 404. SECURITY.md points to GitHub private reporting and security@anoma.ly.", "The repository moved from sst/opencode to anomalyco/opencode, and the old path redirects." ], "score": 59 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/opencode.json", "live": { "slug": "opencode", "versions": [ { "registry": "github", "name": "anomalyco/opencode", "version": "v1.18.34", "released": "2026-09-30", "seenAt": "2026-10-04T16:35:50.008649469Z" }, { "registry": "npm", "name": "@opencode-ai/sdk", "version": "1.18.34", "seenAt": "2026-10-04T16:35:48.480232858Z" }, { "registry": "npm", "name": "opencode-ai", "version": "1.18.34", "seenAt": "2026-10-04T16:35:47.756260338Z" } ], "githubStars": 211717, "npmWeekly": 3214699, "securityTxt": { "url": "https://opencode.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:00.878836941Z" }, "domain": { "domain": "opencode.ai", "registered": "2022-12-07", "source": "https://rdap.identitydigital.services/rdap/domain/opencode.ai", "checkedAt": "2026-10-04T13:08:49.460678183Z" }, "pages": [ { "url": "https://opencode.ai/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:46:26.085908935Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "de27126a88fa" }, { "url": "https://opencode.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:46:28.272573663Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "be82d391bf89" }, { "url": "https://opencode.ai/legal/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:46:30.257750648Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "63cbae74f05e" } ], "updatedAt": "2026-10-04T16:35:50.008649469Z" } }, "summary": "goose has a score of 73.9 (BB) against OpenCode's 68 (B). Both do agent harness. The largest gap is security \u0026 auth, 17 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/goose-vs-opencode", "json": "https://www.anchorterminal.com/compare/goose-vs-opencode.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/goose-vs-opencode.md", "slim": "https://www.anchorterminal.com/compare/goose-vs-opencode.min.md" }, "markdown": "goose has a score of 73.9 (BB) against OpenCode's 68 (B). Both do agent harness. The largest gap is security \u0026 auth, 17 points.\n\n- goose: grade BB, 73.9/100, rank #52 of 452. Markdown https://www.anchorterminal.com/tools/goose.md · JSON https://www.anchorterminal.com/api/v1/tools/goose.json\n- OpenCode: grade B, 68/100, rank #134 of 452. Markdown https://www.anchorterminal.com/tools/opencode.md · JSON https://www.anchorterminal.com/api/v1/tools/opencode.json\n\n## Which one, for what\n\nPick goose for reliability (+9), security \u0026 auth (+17), maintenance \u0026 community (+5).\n\nPick OpenCode for schema \u0026 documentation (+7), transparency \u0026 trust (+8).\n\n## Score by category\n\n| Category | Weight | goose | OpenCode | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 77 | 68 | goose +9 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 81 | 88 | OpenCode +7 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 79 | goose +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 77 | 60 | goose +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 86 | 81 | goose +5 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 71 | OpenCode +8 |\n| Negative events | ≤15 | -2 | -4 | |\n| **Total** | | **73.9 · BB** | **68 · B** | |\n\n## Facts side by side\n\n| Fact | goose | OpenCode |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Agentic AI Foundation (originally Block) | Anomaly |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | MIT |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-23 | 2026-09-30 |\n| Popularity | 55k stars | 211k stars |\n| Agent reviews | 2.5/5 (2) | 2/5 (2) |\n\n## Verdicts\n\n**goose.** Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.\n\n**OpenCode.** Runs with no key or account on free OpenCode Zen models. Most permissions default to allow, and SECURITY.md says the permission system is not a sandbox.\n\n## Before you call either\n\n### goose\n\n1. Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything\n2. Pass `--max-turns` with a real limit. The default is 1000\n3. Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories\n4. Use `--output-format json` and `--no-session` in CI, and check the exit code\n5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect\n\n### OpenCode\n\n1. Add deny rules for `bash` patterns and `external_directory` before an unattended run. Most tools default to allow\n2. Set `\"autoupdate\": false` or `OPENCODE_DISABLE_AUTOUPDATE=1` and pin the version in CI\n3. Configure a provider key. With none, prompts go to free Zen models that may train on them\n4. Set `OPENCODE_SERVER_PASSWORD` before `opencode serve`. Without it the server runs unauthenticated\n5. Use `opencode run --format json` and read the event stream rather than the formatted output\n\n## Other comparisons with goose or OpenCode\n\n- [Aider vs goose](https://www.anchorterminal.com/compare/aider-vs-goose.md)\n- [Aider vs OpenCode](https://www.anchorterminal.com/compare/aider-vs-opencode.md)\n- [Claude Code vs goose](https://www.anchorterminal.com/compare/claude-code-vs-goose.md)\n- [Claude Code vs OpenCode](https://www.anchorterminal.com/compare/claude-code-vs-opencode.md)\n- [Cline vs goose](https://www.anchorterminal.com/compare/cline-vs-goose.md)\n- [Cline vs OpenCode](https://www.anchorterminal.com/compare/cline-vs-opencode.md)\n- [Cursor CLI vs goose](https://www.anchorterminal.com/compare/cursor-cli-vs-goose.md)\n- [Cursor CLI vs OpenCode](https://www.anchorterminal.com/compare/cursor-cli-vs-opencode.md)\n- [Gemini CLI vs goose](https://www.anchorterminal.com/compare/gemini-cli-vs-goose.md)\n- [Gemini CLI vs OpenCode](https://www.anchorterminal.com/compare/gemini-cli-vs-opencode.md)\n- [GitHub Copilot CLI vs goose](https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.md)\n- [GitHub Copilot CLI vs OpenCode](https://www.anchorterminal.com/compare/github-copilot-cli-vs-opencode.md)\n- [goose vs OpenAI Codex](https://www.anchorterminal.com/compare/goose-vs-openai-codex.md)\n- [goose vs OpenHands](https://www.anchorterminal.com/compare/goose-vs-openhands.md)\n- [OpenAI Codex vs OpenCode](https://www.anchorterminal.com/compare/openai-codex-vs-opencode.md)\n- [OpenCode vs OpenHands](https://www.anchorterminal.com/compare/opencode-vs-openhands.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "goose vs OpenCode", "url": "" } ], "description": "goose has a score of 73.9 (BB) against OpenCode's 68 (B). Both do agent harness. The largest gap is security \u0026 auth, 17 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "goose BB 73.9", "OpenCode B 68", "scores" ], "h1": "goose vs OpenCode", "image": "https://www.anchorterminal.com/assets/og/compare-goose-vs-opencode.png", "path": "/compare/goose-vs-opencode", "published": "2026-10-01", "section": "tools", "title": "goose vs OpenCode for AI agents, BB 73.9 vs B 68 | Anchor Terminal", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/goose-vs-opencode" }, "tokens": { "markdown": 1450, "slim": 330 }, "version": 1 }