navra

navra + Goose

Prerequisites

  • navra running (navra serve or systemd service)
  • A bearer token (generated by navra init or navra token create)
  • Goose installed

Configure Goose

Add navra as an extension in ~/.config/goose/config.yaml:

extensions:
  navra:
    type: sse
    uri: http://localhost:9315/mcp
    headers:
      Authorization: "Bearer mcd_your_token_here"

Goose uses the SSE transport variant of MCP. navra supports both Streamable HTTP and SSE on the same endpoint.

Verify the connection

  1. Start Goose: goose session
  2. Ask Goose to list available tools. navra's tools and any upstream tools should appear.
  3. Run a simple task: "Read the file README.md"

Check navra's audit log:

navra audit --limit 5 --detail

Using navra wrap with Goose

For quick experiments:

navra wrap -- npx @modelcontextprotocol/server-filesystem /tmp

Then configure Goose to point at the printed endpoint.

Multiple upstream servers

Goose can connect to navra as a single extension, while navra proxies multiple upstream MCP servers. This gives Goose access to all tools through one secured endpoint:

# config.toml
[[upstream]]
name = "filesystem"
transport = "stdio"
command = ["npx", "@modelcontextprotocol/server-filesystem", "/home/user"]

[[upstream]]
name = "github"
transport = "stdio"
command = ["npx", "@modelcontextprotocol/server-github"]

Goose sees all tools from both servers through navra, with unified auth, ACLs, and safety filters.

Troubleshooting

Goose cannot connect

  1. Verify navra is listening: curl -s http://localhost:9315/health
  2. Check the transport type is sse (not stdio)
  3. Confirm the token in the YAML matches one registered in navra

Tools appear but calls fail

Check the permission set for your agent. Goose may be calling tools that require approval:

navra audit --limit 10 --detail

If you see requires_approval denials, either pre-approve the tools or change the permission set to allow them.