Does AgentGuard bound Goose?

Yes, as an MCP extension.

Goose runs tools well and runs them fast. What it does not give you is a hard ceiling on what a tool run is allowed to spend or do. AgentGuard adds that ceiling as a Goose MCP extension, so the agent asks before it acts and every answer is a signed receipt. No fork of Goose, no patch.

The gap

Goose can call any MCP tool you give it, chain them, and keep going. That is the point. But a capable agent with a payment tool and a loop is one bad plan away from draining a budget or reaching for an action it was never meant to take. Goose does not carry a spend cap or a capability tier that fails closed. That is the bound AgentGuard adds.

Setup (about ten minutes)

AgentGuard ships an MCP server on npm. Add it to Goose as a command-line (stdio) extension.

# 1. add AgentGuard as a Goose MCP extension
goose configure
# Add Extension → Command-line Extension
# command: npx -y @agentguard-run/mcp

# or add it directly to ~/.config/goose/config.yaml
extensions:
  agentguard:
    type: stdio
    cmd: npx
    args: ["-y", "@agentguard-run/mcp"]
    enabled: true

Set the policy the extension enforces: a five dollar per-day cap and a read-only capability ceiling. Anything the agent proposes that would cross either line is refused before it runs.

Three runs

Point Goose at three tasks. These are the exact decisions the published SDK returns, captured from a real run.

ALLOWED · summarize this thread
within budget (call ~$0.02), capability sufficient · receipt seq 0 signed
REFUSED · buy $400 of OpenAI credits
Cap 'per_day=500c' exceeded (spent=0c, +call=2000c, total=2000c) · receipt seq 1
REFUSED · wire $9,000 to a vendor
Capability 'read_only' below required 'payment_execute' · receipt seq 2

Raise the cap and the first refusal turns into an allow. That is the point: the bound is a policy you set, and the verdict follows it every time.

Verify it yourself

Every decision above signed a receipt into a hash-linked chain. Verify the whole chain offline, then flip one field and watch it break at that exact entry.

$ npx @agentguard-run/spend verify --trace latest
✓ full chain valid ✓ signatures match ✓ no sequence gaps

Tamper with a single entry (turn a refusal into an allow) and verification fails at that sequence. The record cannot be quietly rewritten.

What the agent carries out

Bounded by AgentGuardverified
agent
goose
cap
$5.00 / day
ceiling
read_only
receipts
seq 0 to 2, chain valid

Reproduce it: @agentguard-run/mcp and @agentguard-run/spend are on npm, open source. Try the same three actions in the homepage playground. Want a framework added to the list? [email protected].