Does AgentGuard bound Goose?

Advisory, as an MCP extension.

The MCP extension gives Goose local spend decisions and signed receipts. It does not sit in Goose's call path, so Goose must choose to consult it. The result is useful decision support, not an unavoidable hard bound.

Correction, July 26, 2026: the runs below prove real SDK verdicts and receipts. They do not prove that every Goose tool dispatch was intercepted. MCP alone does not force the host to ask before it acts.

The gap

Goose can call any MCP tool you give it, chain them, and keep going. AgentGuard's MCP server can return a spend decision for metadata Goose submits, but that consultation is not an unavoidable bound on the host's other actions.

Setup

The supplied local MCP tree implements a command-line (stdio) server. Add that server to Goose as an extension.

# 1. add AgentGuard as a Goose MCP extension
goose configure
# Add Extension → Command-line Extension
# command: npx -y @agentguard-run/mcp

# or add it directly to ~/.config/goose/config.yaml
extensions:
  agentguard:
    type: stdio
    cmd: npx
    args: ["-y", "@agentguard-run/mcp"]
    enabled: true

The MCP server can apply a configured five dollar per-day cap to calls submitted through spend_decide. The current tool does not accept a capability claim or required-capability field, and Goose is not forced to call it before acting.

Three SDK reference decisions

These captured Spend SDK decisions demonstrate the underlying policy engine. They are not evidence that Goose dispatched the tasks through MCP.

ALLOWED · summarize this thread
within budget (call ~$0.02), capability sufficient · receipt seq 0 signed
REFUSED · buy $400 of OpenAI credits
Cap 'per_day=500c' exceeded (spent=0c, +call=2000c, total=2000c) · receipt seq 1
REFUSED · wire $9,000 to a vendor
Capability 'read_only' below required 'payment_execute' · receipt seq 2

With the same SDK inputs, raising the configured cap changes the spend refusal to an allow. The capability example belongs to the SDK policy path, not the current MCP input schema.

Verify it yourself

The configured SDK reference run signed each displayed decision into a hash-linked chain. Verify that chain offline, then flip one signed field and watch verification fail at that entry.

$ npx @agentguard-run/spend verify
✓ full chain valid ✓ signatures match ✓ no sequence gaps

Tamper with a single entry (turn a refusal into an allow) and verification fails at that sequence. The record cannot be quietly rewritten.

What the reference chain records

SDK decision chainverified
source
Spend SDK reference run
cap
$5.00 / day
ceiling
read_only in SDK policy
receipts
seq 0 to 2, chain valid

Reproduce it with the supplied local Spend and MCP trees, whose source is provided under the checked-in Alpha License. Start with the local test and setup paths, or try the same three actions in the homepage playground. Want a framework added to the list? [email protected].