Goose

Goose calls MCP servers extensions. Add one interactively or by editing YAML.

Add it

Interactive

goose configure

Choose Add Extension → Remote Extension (Streaming HTTP), then:

Prompt	Answer
Name	`vulnetix`
Endpoint URL	`https://mcp.vulnetix.com/mcp`
Timeout	`60`
Add custom headers?	Yes
Header name	`Authorization`
Header value	`ApiKey <orgId>:<hex>`

config.yaml

Edit ~/.config/goose/config.yaml:

extensions:
  vulnetix:
    enabled: true
    name: vulnetix
    type: streamable_http
    uri: https://mcp.vulnetix.com/mcp
    timeout: 60
    headers:
      Authorization: "ApiKey <orgId>:<hex>"

Note Note the YAML spelling: type: streamable_http with an underscore, and uri rather than url. Goose differs from the JSON clients on both.

Confirm it works

goose session

Then:

Which CVEs were added to the CISA KEV catalogue most recently?

Or check the extension list:

goose info

Worth knowing

Timeout matters. The database sits behind a CDN in front of AWS, and a first uncached call for a large advisory can take several seconds. The default Goose timeout is short enough to cut one off, so set it to 60 seconds.

Goose Desktop has the same options under Settings → Extensions → Add custom extension.

Per-session enable. goose session --with-extension vulnetix loads it for one session without changing your config.

Troubleshooting

Extension fails to start. Check type is streamable_http and the key is uri.

Timeouts on first call. Raise timeout; subsequent identical calls hit the edge cache and return immediately.

401 in results. Both halves of the key. In YAML, quote the value so the colon is not read as a mapping separator. Write "ApiKey abc:def", with the quotes.