agent/goose
Block goose agent policy: LLM APIs and GitHub, with Anthropic and OpenAI secret bindings.
| Reference | Kind | Latest | Architecture | Size | Publisher |
|---|---|---|---|---|---|
agent/goose |
policy | 1.0.0 |
— | — | tinylabscom/mvm-packs (official) |
mvmctl pull agent/goosemvmctl pull agent/goose@1.0.0This pack is a policy and is not runnable: it has no kernel, root filesystem or entrypoint.
Versions
Section titled “Versions”| Version | Manifest SHA-256 | Revoked |
|---|---|---|
1.0.0 |
043fe83720bd8dc25aa1c11c298993957a1b4ec23a71d0a7d2343b0b13024506 |
no |
Policy declarations (1.0.0)
Section titled “Policy declarations (1.0.0)”Included groups name other policies; they do not describe every effective permission.
| Declaration | Value |
|---|---|
| Included group | llm-apis |
| Included group | github |
Secret bindings
Section titled “Secret bindings”Binding names and allowed hosts only; a binding is not proof that a secret is required, and no secret values are stored here.
| Binding | Allowed hosts |
|---|---|
anthropic |
api.anthropic.com |
openai |
api.openai.com |
Publisher
Section titled “Publisher”Each manifest is signed keyless; manifest.sigstore.json binds it to a workflow identity (issuer https://token.actions.githubusercontent.com). Identities each version can be verified under:
1.0.0:https://github.com/tinylabscom/mvm-packs/.github/workflows/publish.yml@refs/heads/main