Goose browser MCP

Give Goose a browser that survives the agent session.

Hronaut runs a separate visible Chromium application. Local Goose Desktop and CLI sessions connect over Streamable HTTP MCP while named workspaces, sign-ins, tabs, and debugging state remain available when a Goose session ends.

Connect Goose Download Hronaut Compare browser tools

Hronaut is an independent project and is not affiliated with or endorsed by the Goose project or the Agentic AI Foundation.

Local MCP endpoint

`http://127.0.0.1:47812/mcp`

Run Goose and Hronaut on the same computer. The endpoint is loopback-only; a remote Goose process, container without host access, or another machine cannot reach it.

Choose the browser owner

Goose supports browser choices; Hronaut adds a separate lifetime.

Goose can load MCP extensions and install Agent Skills, including browser integrations maintained outside Hronaut. Use those when their browser ownership and session model fit. Choose Hronaut when the browser should remain a separately visible desktop application with durable named workspaces and explicit human pause and takeover.

Goose session

Use task-owned browser tooling

Keep browser control within the current Goose workflow when a separate long-lived desktop profile is unnecessary.

Hronaut workspace

Keep browser state outside the task

Use a named Hronaut workspace when tabs and site state should remain available to later local Goose sessions or another compatible MCP client.

Local Streamable HTTP setup

Add Hronaut as a Goose extension.

Start Hronaut first. Goose calls this a Remote Extension (Streamable HTTP) because it uses a network transport; the Hronaut address below still stays on this computer.

Authentication disabled only

Install in Goose Desktop

Use the one-click installer only with a new or otherwise non-sensitive Hronaut profile whose MCP authentication is disabled.

Add Hronaut to Goose

The link contains only the fixed loopback endpoint and public metadata. It never contains an owner token. Goose will show the extension before saving it.

One-session CLI check

Connect without saving

goose session --with-streamable-http-extension "http://127.0.0.1:47812/mcp"

Goose documents this flag for temporary Streamable HTTP extensions. It intentionally contains no credential and therefore applies only while Hronaut authentication is disabled.

Persistent local configuration

`~/.config/goose/config.yaml`

extensions:
  hronaut:
    type: streamable_http
    name: hronaut
    enabled: true
    uri: "http://127.0.0.1:47812/mcp"
    headers: {}
    env_keys: []
    envs: {}
    timeout: 300

Authentication enabled

Reference a Goose-managed secret from the header

extensions:
  hronaut:
    type: streamable_http
    name: hronaut
    enabled: true
    uri: "http://127.0.0.1:47812/mcp"
    headers:
      Authorization: "Bearer ${HRONAUT_MCP_TOKEN}"
    env_keys:
      - HRONAUT_MCP_TOKEN
    envs: {}
    timeout: 300

Enable Require MCP authentication in Hronaut. Run goose configure, add Hronaut as a Remote Extension, and store HRONAUT_MCP_TOKEN as an extension secret; Goose resolves env_keys through the process environment or its secret store and substitutes it into the header. Prefer the operating-system keyring. On a headless system where Goose falls back to plaintext secrets.yaml, protect that file or launch Goose with the variable supplied by a trusted process. Never place the token directly in config.yaml, a custom-header value, URL, source control, chat, screenshots, or campaign data.

Observable verification

Confirm the extension, then prove browser behavior.

1 · Configuration

Inspect the saved extension

Open Extensions in Goose Desktop and confirm that hronaut is enabled before asking Goose to use it. Avoid copying verbose configuration output into chat because resolved headers can contain credentials.

2 · Runtime

Watch both applications

Start a local Goose session. Open Hronaut Home and confirm the Goose MCP client appears under Connections.

3 · Browser task

Create an isolated workspace

Ask: “Using Hronaut, create a workspace named first-check, open https://example.com inside it, and tell me the page title and workspace ID. Do not use my Default workspace.”

Expect a visible first-check workspace showing Example Domain. End the Goose session and start another one; the Hronaut workspace should remain.

Local authority and approval

Keep the endpoint local and review browser actions.

A new Hronaut profile starts without MCP authentication, so any process running as your operating-system user can control it. Enable authentication before using valuable signed-in sessions, and review the extension and its tools before granting broad approval.

Websites can contain prompt injection, and a persistent authenticated workspace carries the authority of every site signed in inside it. Pause MCP before entering passwords, security keys, payment details, or other human-only information.

Do not expose or tunnel Hronaut to make a remote Goose process reach 127.0.0.1. Hronaut is designed for a local coding client and validates a loopback security boundary.

Primary sources

Extension transport, configuration, and install-link evidence.

Official Goose extension guide — Streamable HTTP setup, custom headers, local configuration, and goose://extension links.
Official Goose configuration reference — streamable_http, uri, headers, and extension settings.
Official Goose CLI reference — goose info and temporary Streamable HTTP extension flags.
Official Goose browser-skill change — current first-party guidance for installing an external Browser Use skill.
Hronaut reference — loopback transport, authentication, workspace isolation, persistence, and human controls.

Keep the browser; change the session

Use a named Hronaut workspace for every durable browser job.

Named workspaces isolate cookies and storage from the human Default workspace while remaining available to the next local Goose session—or another compatible local MCP client.

Download Hronaut All client setup Safe login handoff