Give Goose a browser that survives the agent session.

Authentication off only

Install in Goose Desktop

Use the one-click installer only with a new or otherwise non-sensitive Hronaut profile whose MCP authentication is off.

The link contains only the fixed loopback endpoint and public metadata, never an owner token. Goose shows the extension before saving it.

Authentication off · manual

~/.config/goose/config.yaml

extensions:
  hronaut:
    type: streamable_http
    name: hronaut
    enabled: true
    uri: "http://127.0.0.1:47812/mcp"
    headers: {}
    env_keys: []
    envs: {}
    timeout: 300

Authentication on

Reference a Goose-managed secret from the header

extensions:
  hronaut:
    type: streamable_http
    name: hronaut
    enabled: true
    uri: "http://127.0.0.1:47812/mcp"
    headers:
      Authorization: "Bearer ${HRONAUT_MCP_TOKEN}"
    env_keys:
      - HRONAUT_MCP_TOKEN
    envs: {}
    timeout: 300

Turn on Require MCP authentication in Hronaut. Run goose configure, add Hronaut as a Remote Extension, and store HRONAUT_MCP_TOKEN as an extension secret. Goose resolves env_keys from the process environment or its secret store and substitutes the value into the header.

Prefer the operating-system keyring. On a headless system where Goose falls back to plaintext secrets.yaml, protect that file or launch Goose with the variable supplied by a trusted process. Never put the token directly in config.yaml, a custom-header value, URL, source control, chat, screenshots or campaign data.