🩺 Vitals
- 🟢 Last active: 2026-07-07
- 📦 Latest release: v1.41.0 (2026-07-03)
- 🐞 Open issues: 266
- 🌟 Stars: 50.8k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: goose-docs.ai
- Source: github.com/aaif-goose/goose
- License: Apache-2.0
- Deployment: Desktop · CLI · API
- Data Model: Local Files / YAML Recipes
- Jurisdiction: USA 🇺🇸 (Linux Foundation / AAIF)
- Compliance (SaaS): N/A (No SaaS offering)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single binary / desktop install
- Maintenance: Low (2/5) - Package manager / auto-updates
- Enterprise Ready: Medium (3/5) - Sandbox & prompt-injection guards; no central SSO/RBAC
1. The Executive Summary
What is it? Goose is a general-purpose AI agent that runs locally on a developer's machine as a desktop app, CLI, or API. It executes code, edits files, runs research, and automates multi-step workflows against any of 15+ LLM providers (including local Ollama), and extends its capabilities through 70+ Model Context Protocol (MCP) extensions. Originally built by Block, it now sits under the vendor-neutral Agentic AI Foundation (AAIF) at the Linux Foundation. Written in Rust, it ships as a single binary with no central control plane and no telemetry phone-home.
The Strategic Verdict:
- 🔴 For Teams Wanting Turnkey SaaS Governance: Caution. Goose is a per-developer local agent, not a managed console. There is no central SSO, RBAC, or audit dashboard; policy must be enforced per endpoint and per LLM provider, which raises the bar for fleet-wide governance.
- 🟢 For Engineering Orgs Standardizing on Model Freedom: Strong Buy. Foundation governance (500+ contributors) removes single-vendor abandonment risk, the agent runs against any model including fully local ones, and Apache-2.0 imposes no per-seat tax or embedding restriction.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | GitHub Copilot (SaaS) | Goose (Self-Hosted) |
|---|---|---|
| Seat Pricing | Per-seat (Business / Enterprise) | $0 (BYOK model tokens only) |
| Model Choice | Locked to vendor models | Any of 15+ providers + local |
| Code Exposure | Context sent to vendor cloud | 100% Local execution |
| Extensibility | Curated extension set | 70+ open MCP extensions |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Native installers for macOS, Linux, and Windows for the desktop app, a one-line install for the CLI, or the API for programmatic use. As a compiled Rust binary it has a light footprint and no server-side infrastructure to operate.
- Scalability: There is no central server to scale; "rollout" means distributing the agent across developer machines and standardizing the YAML Recipes and approved MCP extensions your team uses. Subagents allow parallel task delegation within a single session.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Foundation Governance (USA 🇺🇸): The Linux Foundation and AAIF are US-domiciled, but goose is a strictly local application with no control plane that phones home, so CLOUD Act and data-sovereignty exposure are structurally neutralized in normal use. The Foundation backing is a genuine governance strength here, not just a flag: it converts a single-company project into a vendor-neutral one, materially lowering the abandonment risk that shadows most AI agents.
- The Compliance Shift (Endpoint + LLM Provider): Because execution is local and bring-your-own-key, the compliance burden splits across two layers you control: the endpoint/host security, and the LLM API provider you point goose at. Any HIPAA, GDPR, or zero-data-retention obligation must be satisfied by your chosen provider's contract (Anthropic, Azure OpenAI, OpenRouter), not by goose itself.
- The Agent Trust Boundary (Apache-2.0): License risk is effectively nil. Apache-2.0 is permissive with no copyleft or SaaS-usage clause. The real caution is technical: goose autonomously runs commands and edits files. Sandbox mode and prompt-injection detection ship in-box, but enterprises must enforce sandboxing and least-privilege before granting an autonomous agent shell access to sensitive systems.
4. Market Landscape
🏢 Proprietary Incumbents
- GitHub Copilot: Microsoft's per-seat coding assistant; organizations evaluate goose to escape per-seat pricing, gain model choice, and keep code execution on local machines.
- Cursor: The AI-native IDE sold as a per-seat subscription; teams weigh goose when they want a model-agnostic, editor-independent agent without proprietary IDE lock-in.
🤝 Open Source Ecosystem
- OpenCode: The closest peer — an MIT-licensed terminal, desktop, and IDE agent that is also model-agnostic and BYOK. Goose differs with Linux Foundation governance and a desktop-first native surface.
- OpenHands: An MIT-core autonomous software engineer that resolves whole issues in a sandboxed runtime — more hands-off than Goose's interactive, desktop-first sessions.