Michael Neale
86e0ced494
The ACP transport (/acp) is served on loopback and, in CLI mode, is unauthenticated while being able to spawn shells via the default `developer` builtin. Its CORS layer used `allow_origin(Any)`, returning `Access-Control-Allow-Origin: *` to any origin. This let a malicious website the victim visits drive the agent from the browser (CSRF -> RCE). See CWE-942. Replace the wildcard with an origin predicate that only permits origins legitimate local clients use: - `null` (Electron file:// renderer) - loopback origins (localhost, 127.0.0.1, ::1) on any scheme/port Arbitrary web origins, including look-alikes like localhost.evil.example, are rejected. Also gate the test-only `clear_env` builder behind the `aws-providers` feature (its only call sites), fixing a dead-code clippy warning that blocked `cargo clippy --all-targets -- -D warnings`. Fixes project-loupe/audit-goose#2
🦆 goose has moved! This project has moved from
block/gooseto the Agentic AI Foundation (AAIF) at the Linux Foundation. Some links and references are still being updated — please bear with us during the transition.
goose
your native open source AI agent — desktop app, CLI, and API — for code, workflows, and everything in between
goose is a general-purpose AI agent that runs on your machine. Not just for code — use it for research, writing, automation, data analysis, or anything you need to get done.
A native desktop app for macOS, Linux, and Windows. A full CLI for terminal workflows. An API to embed it anywhere. Built in Rust for performance and portability.
goose works with 15+ providers — Anthropic, OpenAI, Google, Ollama, OpenRouter, Azure, Bedrock, and more. Use API keys or your existing Claude, ChatGPT, or Gemini subscriptions via ACP. Connect to 70+ extensions via the Model Context Protocol open standard.
goose is part of the Agentic AI Foundation (AAIF) at the Linux Foundation.
Get started
Download the desktop app for macOS, Linux, and Windows.
Or install the CLI:
curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash
Quick links
- Quickstart
- Installation
- Tutorials
- Documentation
- Governance
- Custom Distributions — build your own goose distro with preconfigured providers, extensions, and branding
Need help?
a little goose humor 🪿
Why did the developer choose goose as their AI agent?
Because it always helps them "migrate" their code to production! 🚀