Goose

Goose is Block’s open-source, extensible AI agent for the terminal (and desktop). It is MCP-native and works with many LLM providers. Use varlock to inject provider API keys at runtime so they never sit in a plain text .env or shell history.

For install, schema setup, and shared patterns, see the AI Tools overview.

Launch commands: goose (interactive), goose session, goose run (see CLI commands)

Environment variables (see environment variables and providers):

Provider keys such as ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, GOOGLE_API_KEY
Optional: GOOSE_PROVIDER and GOOSE_MODEL to select provider/model without goose configure

You can also store credentials via goose configure. Env injection is a better fit for shared machines, CI, and keeping secrets out of goose’s local secret store.

In a project

Add to .env.schema:

# @sensitive @required
ANTHROPIC_API_KEY=op(op://api-local/anthropic/api-key)

# @sensitive
OPENAI_API_KEY=op(op://api-local/openai/api-key)

# @type=string
GOOSE_PROVIDER=anthropic

# @type=string
GOOSE_MODEL=claude-sonnet-4-5-20250929

varlock run -- goose

# one-shot task
varlock run -- goose run -t "summarize recent git changes"

From any directory

Personal schema at ~/.env.goose:

# @sensitive @required
ANTHROPIC_API_KEY=op(op://api-local/anthropic/api-key)

# @type=string
GOOSE_PROVIDER=anthropic

# @type=string
GOOSE_MODEL=claude-sonnet-4-5-20250929

varlock run -p ~/.env.goose -- goose

Shell alias (optional)

alias vgoose='varlock run -p ~/.env.goose --no-redact-stdout -- goose'

--no-redact-stdout keeps Goose’s own terminal output unredacted while secrets stay out of your shell history.

See the Goose docs for install, extensions/MCP, and recipes. Pair with the MCP guide when wiring secret-backed MCP servers.