What security features does goose provide?

Updated

goose ships with four named security capabilities: prompt injection detection, tool permission controls, sandbox mode, and an adversary reviewer that watches for unsafe actions. These matter most if you run goose locally and want to keep data and execution on your own machine while still giving the agent access to real tools.

The four security features

Feature What it does Why it matters
Prompt injection detection Flags attempts to hijack the agent through malicious content in files, web pages, or tool output The agent reads untrusted input; this catches manipulation attempts before they steer actions
Tool permission controls Lets you decide which tools and extensions the agent may invoke Limits blast radius — an agent can't call a tool you haven't allowed
Sandbox mode Constrains execution to an isolated environment Useful when running code or commands you don't fully trust
Adversary reviewer A separate reviewer that watches for unsafe actions Adds a second check on what the agent is about to do

Why this fits local-first use

goose is a general-purpose AI agent that runs on your machine — a native desktop app for macOS, Linux, and Windows, plus a CLI and an API. Because it runs locally and connects outward to tools, the security model is about controlling what the agent can reach and do, not about trusting a remote service with your data.

That combination is the practical answer for people who care about local execution and data control: the agent stays on your machine, and the permission and sandbox layers decide how far it can go.

How this connects to extensions and models

Security controls sit alongside goose's extensibility. It connects to 70+ extensions — databases, APIs, browsers, GitHub, Google Drive, and more — through the Model Context Protocol (MCP) open standard, and works with 15+ model providers including Anthropic, OpenAI, Google, Ollama, OpenRouter, Azure, and Bedrock.

Each of those connections is a potential path for the agent to act, which is exactly why tool permission controls and prompt injection detection exist: more reach means more need for guardrails.

What to check before relying on it

  • Confirm the defaults. The page lists these features but doesn't state which are on by default. Verify in your own install before assuming protection is active.
  • Decide your permission scope. Tool permission controls only help if you actually restrict tools rather than allowing everything.
  • Treat detection as a layer, not a guarantee. Prompt injection detection reduces risk; it doesn't eliminate the need to review what the agent does with sensitive systems.
  • Match sandbox use to the task. Sandbox mode is most valuable for untrusted code or commands; for routine local work you may not need it.

For teams, the same controls apply whether you run the desktop app, the CLI, or embed the API — so security posture can stay consistent across how people use goose.