Clean up stale documentation audit findings - #10114
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Documentation preview deployed: https://pr-10114.goose-pr-previews-poc.pages.dev |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
goose/documentation/static/servers.json
Line 621 in d8c35f7
Use the Repomix MCP command from the linked project
I checked the linked Repomix npm/GitHub docs, and they document MCP mode as npx -y repomix --mcp, not npx -y repomix-mcp. With this catalog entry, the Extensions page and generated install link run a different/unavailable package, so users who install Repomix from the catalog will not get the intended MCP server.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| command="npx" | ||
| args={["-y", "reddit-mcp"]} |
There was a problem hiding this comment.
This section now generates a Desktop installer for npx -y reddit-mcp, but the same page's quick CLI block still uses uvx --from git+https://github.com/adhikasp/mcp-reddit.git mcp-reddit, and the linked adhikasp/mcp-reddit README's manual installation uses that uvx command. Users following the Desktop/configuration path will install a different server than the one documented and linked here.
Useful? React with 👍 / 👎.
|
|
||
| fs.writeFileSync(OUT_PATH, `${markdown(results)}\n`); | ||
| console.log(`Wrote ${OUT_PATH}`); | ||
| process.exit(0); |
There was a problem hiding this comment.
If any candidate fails, this script still exits with status 0 after writing the report, so using node scripts/mcp-smoke-check.js for validation or CI will silently pass a broken MCP catalog. Please exit non-zero when any results item has status === 'fail' so failures are actionable.
Useful? React with 👍 / 👎.
| ### 1. Use permissions to protect sensitive work | ||
|
|
||
| Goose supports [`.gooseignore`](https://goose-docs.ai/docs/guides/using-gooseignore) files. The concept is similar to `.gitignore` files for your AI agent. It defines which files and folders Goose should *not* read, modify, or interact with. | ||
| Use Goose's permission modes and tool permissions when you want more control over what Goose can run or modify. |
There was a problem hiding this comment.
documentation/AGENTS.md requires the product name to always be written as lowercase goose in documentation content. This newly edited sentence introduces Goose twice, so it violates the documented brand guideline for this directory.
Useful? React with 👍 / 👎.
angiejones
left a comment
angiejones
left a comment
There was a problem hiding this comment.
codex found valid issues
that's fine, but please don't hit [request changes] unless you really need it. assume that authors address all codex comments before merging |
|
Addressed the Codex Repomix feedback in 31defb0: updated the docs and catalog command to use |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31defb0f21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <Tabs groupId="interface"> | ||
| <TabItem value="ui" label="goose Desktop" default> | ||
| [Launch the installer](goose://extension?cmd=npx&arg=@browserbasehq/mcp&id=browserbase&name=Browserbase&description=Automate%20web%20browsing%20and%20data%20extraction&env=BROWSERBASE_PROJECT_ID%3DBrowserbase%20Project%20ID&env=BROWSERBASE_API_KEY%3DBrowserbase%20API%20Key) | ||
| [Launch the installer](goose://extension?cmd=npx&arg=-y&arg=%40browserbasehq%2Fmcp&id=browserbase-mcp&name=Browserbase&description=Automate%20web%20browsing%20and%20data%20extraction&env=BROWSERBASE_API_KEY%3DBrowserbase%20API%20Key) |
There was a problem hiding this comment.
The Browserbase stdio package config in the linked Browserbase README includes BROWSERBASE_PROJECT_ID alongside BROWSERBASE_API_KEY for npx @browserbasehq/mcp, but this updated installer URL only prompts for the API key. Users installing from this page will save an extension without the project ID that the local Browserbase server needs to create sessions, so the extension fails once they try to use it; keep BROWSERBASE_PROJECT_ID in the quick link and matching installer instructions.
Useful? React with 👍 / 👎.
|
Addressed the remaining Codex inline findings in 9493651:
Validation: re-ran |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9493651770
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "name": "Browserbase", | ||
| "description": "Browser automation and web scraping", | ||
| "command": "npx -y @browserbasehq/mcp-server-browserbase", | ||
| "command": "npx -y @browserbasehq/mcp", |
There was a problem hiding this comment.
After switching the catalog to the local npx -y @browserbasehq/mcp package, the required configuration needs to change with it: Browserbase's setup docs for the NPM/STDIO install show a GEMINI_API_KEY env entry, and the server defaults to a Gemini Stagehand model. The catalog installer generated from this entry only prompts for Browserbase credentials, so users installing from /extensions can save an extension that lacks the model key and then fails when browser actions/extraction invoke the default model; add GEMINI_API_KEY here and mirror it in the Browserbase doc installer, or use the hosted endpoint that only needs a Browserbase API key. See https://docs.browserbase.com/integrations/mcp/setup.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
that seems extremely niche knowledge, impressive if true!
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4bad6461f3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| nip: 61 | ||
|
|
||
| </details> | ||
| ::: |
There was a problem hiding this comment.
This new ::: closes the only :::note CLI block immediately after the tool-call details, but the original closing marker at the bottom of the page is still present. That leaves the Nostrbook doc with two closing admonition markers for one opener, so the MDX/Docusaurus parser will reject the page or render a stray delimiter; either keep the output inside the note or remove the final close.
Useful? React with 👍 / 👎.
| extensionId="reddit-mcp" | ||
| extensionName="Reddit" | ||
| description="Fetch and analyze Reddit content" | ||
| command="uvx" |
There was a problem hiding this comment.
When users follow this Configuration section instead of the quick-install link, GooseDesktopInstaller builds its own deeplink from these props; this call still lacks envVars, while the quick-install URL above now adds REDDIT_CLIENT_ID and REDDIT_CLIENT_SECRET and the catalog marks them required. Those users can install a Reddit extension without being prompted for the credentials it needs, so mirror the env vars here (and in the CLI instructions) as the Browserbase page does.
Useful? React with 👍 / 👎.
# Conflicts: # documentation/blog/2025-04-08-vibe-code-responsibly/index.md # documentation/docs/guides/codebase-analysis.md # documentation/docs/guides/tips.md # documentation/docs/mcp/developer-mcp.md
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f084995e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ``` | ||
|
|
||
| :::warning | ||
| Set `GOOSE_SERVER__SECRET_KEY` before exposing `goose serve` beyond local trusted clients. If this environment variable is not set, the ACP endpoint accepts unauthenticated connections. |
There was a problem hiding this comment.
When users follow these goose serve examples with GOOSE_SERVER__SECRET_KEY unset, the server does not start: handle_serve_command bails unless that env var is present or --dangerously-unauthenticated is passed (crates/goose-cli/src/cli.rs:1444-1447). This warning says the endpoint accepts unauthenticated connections when the env var is missing, so users will omit both and hit an immediate error; document setting the env var for the examples or include the explicit unauthenticated flag for local-only use.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
goose/documentation/static/servers.json
Lines 596 to 598 in 8234660
Do not require Reddit credentials for this server
For users installing this catalog entry from /extensions, marking these variables as required sends the deeplink through the env-var modal, and the Desktop form will not submit while the generated values are empty. I checked the current adhikasp/mcp-reddit README for this exact uvx --from git+https://github.com/adhikasp/mcp-reddit.git mcp-reddit command, and its manual config uses "env": {} (https://github.com/adhikasp/mcp-reddit#manual-installation), so users without Reddit app credentials are blocked from installing a server that is documented upstream as not needing them; remove these required env vars or make them optional and avoid prompting in the matching doc deeplink.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
* origin/main: (24 commits) fix(session): create inventory tables atomically with schema version (#10586) fix(providers): rewrite oneOf to anyOf in tool schemas for OpenAI-compatible backends (#10571) fix(evals): report cache-aware Harbor costs (#10430) fix(acp): allow custom model as default for non-local providers (#10438) fix(config): require absolute goose path roots (#10454) chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#10541) fix(permissions): scope smart approval by request (#10457) fix(summon): preserve fixed subrecipe values (#10452) chore(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /documentation (#10506) fix(flatpak): bundle git so hermit can clone its package registry (#10511) feat(hooks): pass working_dir to the Stop hook context (#10296) chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 (#10540) chore(deps): bump actions/setup-node from 6 to 7 (#10539) chore(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 (#10542) chore(deps): bump gradle/actions/setup-gradle from 4.4.3 to 6.2.0 (#10543) Add declarative Sakana AI provider for the OpenAI-compatible Fugu API (#10357) fix(developer): expose AGENT_SESSION_ID to shell commands (#10428) Clean up stale documentation audit findings (#10114) Restore model interactions viewer (#10205) fix(acp): forward image content chunks to client during live session (#10485) ... # Conflicts: # crates/goose/src/session/session_manager.rs
4 participants
Summary
Validation
npm run buildfromdocumentationnode scripts/mcp-smoke-check.jsfor no-secret catalog-backed stdio MCP servers: 22 checked, 22 passedNotes
docs-audit-findings.mdtracks remaining follow-up items from the broader audit.