awesome-bookmarks/goose
3
0
Fork 0
mirror of https://github.com/block/goose.git synced 2026-07-17 12:56:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: malware check for uvx and npx extensions (#4508)

Browse Source 
Co-authored-by: Angie Jones <jones.angie@gmail.com>
This commit is contained in:
dianed-square
2025-09-03 23:29:03 -07:00
committed by GitHub
parent bce046607c
commit 6552d89d6d
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/docs/getting-started/using-extensions.md
+3 -2
View File
@@ -12,11 +12,12 @@ Extensions are add-ons that provide a way to extend the functionality of Goose b
Extensions are based on the [Model Context Protocol (MCP)](https://github.com/modelcontextprotocol), so you can connect
Goose to a wide ecosystem of capabilities.
Goose automatically checks external extensions for known malware before activation. If a malicious package is detected, the [extension will be blocked](/docs/troubleshooting#malicious-package-detected) with a clear error message.
:::tip Tutorials
Check out the [step-by-step tutorials](/docs/category/mcp-servers) for adding and using several Goose Extensions
:::
## Built-in Extensions
Out of the box, Goose is installed with a few extensions but with only the `Developer` extension enabled by default.
@@ -664,4 +665,4 @@ goose session --with-streamable-http-extension "https://example.com/streamable"
Goose extensions are implemented with MCP, a standard protocol that allows AI models and agents to securely connect with local or remote resources. Learn how to build your own [extension as an MCP server](https://modelcontextprotocol.io/quickstart/server).
[extensions-directory]: https://block.github.io/goose/v1/extensions
[extensions-directory]: https://block.github.io/goose/extensions/
documentation/docs/troubleshooting.md
+20
View File
@@ -221,6 +221,25 @@ This creates a symbolic link that allows Goose to find Node.js in the expected l
---
### Malicious Package Detected
If you see an error about a "blocked malicious package" when trying to use an extension, it means the extension was blocked because malware was detected in a package used by the extension. The error message will contain details about the package, for example:
```
Blocked malicious package: package-name@1.0.0 (npm). OSV MAL advisories: MAL-2024-1234
```
Steps to resolve:
1. **Find an alternative**: Look for similar extensions in the [extensions directory][extensions-directory] or [PulseMCP](https://www.pulsemcp.com/servers)
2. **Optional verification**: Verify the source of the blocked extension or the package name/publisher
3. **Report false positives**: If you believe this is an error, please [open an issue](https://github.com/block/goose/issues)
This security check only applies to locally-executed external extensions that use PyPI (`uvx`) or NPM (`npx`). The check uses real-time data from the OSV database; if the security service is unavailable, extensions will still install normally.
As a best practice, only install extensions from trusted, official sources.
---
### macOS Permission Issues
If you encounter an issue where the Goose Desktop app shows no window on launch, it may be due to file and folder permissions. This typically happens because Goose needs read and write access to the `~/.config` directory to create its log directory and file.
@@ -351,3 +370,4 @@ If you have questions, run into issues, or just need to brainstorm ideas join th
[discord]: https://discord.gg/block-opensource
[goosehints]: /docs/guides/using-goosehints
[configure-llm-provider]: /docs/getting-started/providers
[extensions-directory]: https://block.github.io/goose/extensions/