> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Goose CLI & Desktop

> Connect StackOne MCP to the Goose AI assistant with OAuth.

## Overview

[Goose](https://goose-docs.ai) is an on-machine AI agent (CLI and Desktop) from Block with MCP support. It connects to remote servers over streamable HTTP as an extension.

## Prerequisites

* Goose installed ([installation guide](https://goose-docs.ai/docs/getting-started/installation)).

- A StackOne [project](/gateway/concepts/organizations-and-projects) you are a member of.
- A [connector profile](/gateway/concepts/connector-profiles) in the project for each provider the client should reach, with the actions you want exposed enabled.
- (Optional) A [linked account](/gateway/concepts/linked-accounts) for each provider. Accounts can also be linked during the consent flow.

## Setup

### Interactive configuration

Run the configuration wizard:

```bash theme={null}
goose configure
```

<Steps>
  <Step title="Select 'Add Extension'">
    When prompted, choose **Add Extension** from the menu.
  </Step>

  <Step title="Choose extension type">
    Select **Remote Extension (Streamable HTTP)**.
  </Step>

  <Step title="Name your extension">
    Enter `stackone` (or any name you prefer).
  </Step>

  <Step title="Enter the server URL">
    Paste `https://mcp.stackone.com/mcp`.
  </Step>

  <Step title="Approve the browser prompt">
    Goose opens StackOne in your browser.

    Sign in, pick the project and the [linked accounts](/gateway/concepts/linked-accounts) the connector should reach, then **Authorize**.

    <Accordion title="Walk through the consent screen">
      1. **Sign in to StackOne.** If you are already signed in to the dashboard you skip straight to the next step.
      2. **Select a project.** Select the project you would like to associate the connection with.
      3. **Select accounts and actions.** Existing linked accounts are shown. New accounts can be linked by clicking **+ Link Account**. You can either select the whole account (all actions will be granted) or refine by toggling individual actions.
      4. **(Optional) Load tools when needed.** On by default, and the toggle that puts the connection into [Advanced Tool Search](/optimize/advanced-tool-search). Leave it on for large action sets. Turn it off to hand the agent every selected action up front.
      5. **Authorize.** Completes the connection; you can return to your client.

      <Columns cols={3}>
        <Frame caption="Select a project">
          <img src="https://mintcdn.com/stackone-60/09ChgExN01gpADnF/images/mcp/oauth-consent-select-project.png?fit=max&auto=format&n=09ChgExN01gpADnF&q=85&s=de028c13efd3deb163e7e6df2d5d5a22" alt="StackOne authorization screen listing organizations, with a project selected inside one of them" style={{ width: '100%', aspectRatio: '780 / 877', objectFit: 'cover' }} width="1294" height="924" data-path="images/mcp/oauth-consent-select-project.png" />
        </Frame>

        <Frame caption="Select accounts">
          <img src="https://mintcdn.com/stackone-60/0prlrmjeswzs-fZr/images/mcp/oauth-consent-select-accounts.png?fit=max&auto=format&n=0prlrmjeswzs-fZr&q=85&s=cdcf3d79600332d06113ed75c55c0225" alt="StackOne authorization screen showing two linked accounts, Linear and Open-Meteo, both selected, above the Load tools when needed toggle" width="1560" height="1754" data-path="images/mcp/oauth-consent-select-accounts.png" />
        </Frame>

        <Frame caption="Toggle actions">
          <img src="https://mintcdn.com/stackone-60/0prlrmjeswzs-fZr/images/mcp/oauth-consent-select-actions.png?fit=max&auto=format&n=0prlrmjeswzs-fZr&q=85&s=9f1246d1991b50c33cbd161b07d5ca77" alt="An expanded linked account showing individual actions with toggles, descriptions, and category tags" width="1560" height="1754" data-path="images/mcp/oauth-consent-select-actions.png" />
        </Frame>
      </Columns>

      <Note>
        If you see a sentence where the **Load tools when needed** toggle should be, an admin has already settled it for the whole project. See [project settings](/optimize/advanced-tool-search#setting-it-for-a-whole-project).
      </Note>
    </Accordion>
  </Step>
</Steps>

### Manual YAML configuration

Find your Goose config file:

* **Linux/Mac**: `~/.config/goose/config.yaml`
* **Windows**: `%APPDATA%\goose\config.yaml`

Add the following under `extensions`:

```yaml theme={null}
extensions:
  stackone:
    name: stackone
    type: streamable_http
    url: https://mcp.stackone.com/mcp
    enabled: true
    timeout: 300
```

Goose prompts for authorization the first time the extension loads. If it does not, use a session token URL instead.

One grant covers every account you approved, so a single `stackone` extension is usually all you need. To revoke it, use **Connected Apps** in the StackOne dashboard.

## Verify installation

Start a Goose session and check available tools:

```bash theme={null}
goose session
```

Then ask:

```text theme={null}
what tools do you have?
```

You should see StackOne operations for the accounts you approved.

## Desktop application

If using Goose Desktop, open **Settings → Extensions**. Your StackOne extension appears in the list, where you can toggle it on and off.

<Accordion title="Connecting with a session token instead" icon="key">
  A session token URL carries its own credential, so it covers the cases OAuth can't: a shared server, a scheduled job, or anywhere nobody is present to approve a consent screen.

  Generate one from **Connectors**, open a connector, then **Use in Agent**. Pick a linked account, set the expiry (one year by default), and copy the URL:

  ```
  https://api.stackone.com/mcp?token={session_token}
  ```

  One URL covers one linked account, and anyone holding it has that access until it expires, so treat it like a password. See [Choosing a connection method](/connect/ai-platforms/overview#choosing-a-connection-method) for the comparison with OAuth.

  There is no consent screen to set [Advanced Tool Search](/optimize/advanced-tool-search) on, so add the `tool-mode` query parameter instead:

  ```
  https://api.stackone.com/mcp?token={session_token}&tool-mode=search_execute
  ```

  Put the token URL in the same `url` field, one extension per linked account:

  ```yaml theme={null}
  extensions:
    stackone:
      name: stackone
      type: streamable_http
      url: https://api.stackone.com/mcp?token=<session_token>
      enabled: true
      timeout: 300
  ```

  <Accordion title="Multiple accounts">
    Add separate entries for each account:

    ```yaml theme={null}
    extensions:
      salesforce:
        name: salesforce
        type: streamable_http
        url: https://api.stackone.com/mcp?token=<salesforce_session_token>
        enabled: true
        timeout: 300

      slack:
        name: slack
        type: streamable_http
        url: https://api.stackone.com/mcp?token=<slack_session_token>
        enabled: true
        timeout: 300
    ```
  </Accordion>

  <Accordion title="Alternative: manual API key setup">
    To authenticate with your API key and account ID directly:

    ```yaml theme={null}
    extensions:
      stackone:
        name: stackone
        type: streamable_http
        url: https://api.stackone.com/mcp
        enabled: true
        timeout: 300
        headers:
          Authorization: "Basic <YOUR_BASE64_TOKEN>"
          x-account-id: "<YOUR_ACCOUNT_ID>"
    ```

    To generate the base64 token:

    ```bash theme={null}
    echo -n "<stackone_api_key>:" | base64
    ```

    Environment variables work too:

    ```yaml theme={null}
    headers:
      Authorization: "Basic ${STACKONE_AUTH_TOKEN}"
      x-account-id: "${STACKONE_ACCOUNT_ID}"
    ```

    See [Authentication & Security](/embed/call-actions/mcp#calling-actions) for details.
  </Accordion>
</Accordion>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Extension not loading">
    **Symptoms:** StackOne tools don't appear when asked "what tools do you have?"

    1. Verify config file location: `goose info -v`
    2. Check YAML syntax (indentation matters)
    3. Ensure the extension is marked `enabled: true`
    4. Restart Goose after config changes
    5. Check logs: `goose logs`
  </Accordion>

  <Accordion title="Authentication errors">
    **Symptoms:** "401 Unauthorized" or "403 Forbidden"

    If you connected with OAuth, re-run `goose configure` to authorize again, and check the grant still exists under **Connected Apps** in the StackOne dashboard.

    If using a dashboard token, regenerate it from the MCP tile in the dashboard.

    If using manual API key auth:

    1. Verify base64 encoding includes the trailing colon: `echo -n "your_api_key:" | base64`
    2. Confirm the account ID matches your linked account
    3. Check the API key is valid in [StackOne Dashboard](https://app.stackone.com)
  </Accordion>

  <Accordion title="Connection timeout">
    Increase the timeout in your config:

    ```yaml theme={null}
    timeout: 600  # 10 minutes
    ```
  </Accordion>

  <Accordion title="No tools available">
    1. Confirm you approved at least one account on the consent screen
    2. Check that actions are enabled on the account's [connector profile](/gateway/concepts/connector-profiles)
    3. Review [StackOne Playground](https://app.stackone.com/playground) to see expected tools
  </Accordion>

  <Accordion title="YAML configuration errors">
    1. Validate YAML syntax at [yamllint.com](https://www.yamllint.com/)
    2. Check indentation (use spaces, not tabs)
    3. Ensure quotes around header values
    4. Run `goose info -v` to see config parsing errors
  </Accordion>
</AccordionGroup>

## Optimize and secure

With your agent connected, use StackOne's platform features to optimize performance and secure every call.

<CardGroup cols={2}>
  <Card title="Advanced Tool Search" icon="magnifying-glass" href="/optimize/advanced-tool-search">
    Reduce context and save tokens.
  </Card>

  <Card title="Deep Query" icon="magnifying-glass-chart" href="/optimize/deep-query">
    Search synced records for a fraction of the tokens.
  </Card>

  <Card title="Defender" icon="shield-halved" href="/secure/defender">
    Block prompt injections before they reach your agent.
  </Card>
</CardGroup>