Goose module

[bpmct]

A discussion dedicated to the Goose module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 25	10 / 20	0 / 20	8 / 10	54 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two major configuration examples: basic usage with all key options, and a comprehensive example with background tasks, task reporting, and custom prompts. Both show sensible defaults for provider/model selection.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	5	Documents Coder MCP integration for task reporting (Agent Firewall equivalent) via the coder extension in config. No mention of AI Gateway support for routing or policy enforcement. Half credit for one of two governance mechanisms.
Dashboard entry point	5	5	Module uses agentapi submodule which provides coder_app support. README shows the app is accessible via dashboard with configurable subdomain option.
Session continuity	5	5	README example explicitly shows GOOSE_SYSTEM_PROMPT instructing to "Run all long running tasks (e.g. npm run dev) in the background" and to "Periodically check in on background tasks", documenting background task management for session continuity.
Managed configuration	5	5	Documents managed MCP configuration via additional_extensions variable and shows how extensions are configured in config.yaml. Example demonstrates adding desktop-commander extension with full YAML structure.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The anthropic_api_key variable in README example is marked sensitive = true, but the example still shows it being passed inline as var.anthropic_api_key with a comment "or use a coder_parameter". This inline pattern caps the score at half.
Non-hardcoded auth path	4	2	README mentions "or use a coder_parameter" as an alternative to variable-based API keys, suggesting a non-hardcoded path, but doesn't provide a complete example of this approach. Half credit for partial documentation.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module variable overrides the Goose download URL. The install.sh script hardcodes https://github.com/block/goose/releases/download/stable/download_cli.sh. Version can be set via goose_version but this is not a URL override. AgentAPI uses a submodule which may have its own mirroring support, but this module itself provides no URL override for Goose.
Bring-your-own binary	10	0	The install_goose variable can disable installation, but README provides no documentation of this capability or how to use pre-installed Goose. The scripts check for existing goose command but this is undocumented behavior.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples and inferable from code (github.com for downloads, anthropic API) but not explicitly documented in a network/offline/air-gapped section.
Runs without sudo	2	0	Scripts in install.sh and start.sh do not invoke sudo directly. However, the install script calls an external download script (download_cli.sh) whose sudo requirements are unknown. Cannot verify the module runs without sudo for core functionality.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (goose_version = "stable", folder = "/home/coder", subdomain = false). No validation blocks present but types are appropriate and descriptions are comprehensive.
Test coverage	4	2	TypeScript tests in main.test.ts cover end-to-end behavior (installation, configuration, prompts, subdomain handling). No .tftest.hcl files present for Terraform-level business logic testing. Half credit for partial coverage.

Overall — 54 / 100

Raw 50 / 92 → round(50 / 92 × 100) = 54

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.