Was this page helpful?
Add Zephex as a Streamable HTTP remote extension — start with goose configure (CLI at top), then config.yaml. Remove old npx stdio extensions when migrating to hosted https://zephex.dev/mcp.
Official goose MCP documentation: goose extensions docs
HTTP and stdio setups both need a key from your Zephex dashboard. OAuth-only flows (ChatGPT, Claude.ai web) sign you in in the browser instead — skip this section for those.
goose is not in the setup.ts editor switch yet — use goose configure → Remote Extension (HTTP) or stdio extension; see Configuration below.
Add Extension → Remote (Streamable HTTP) or stdio per goose docs.
goose configureAfter CLI install, fully restart the app if tools do not appear. Manual JSON/TOML blocks below are equivalent — use them when CLI commands are unavailable.
Full comparison: HTTP vs stdio · npx zephex reference
Desktop: Extensions → Add custom extension → Remote (Streamable HTTP). CLI: goose configure → Add Extension → Remote Extension.
Replace mcp_sk_your_key_here with your key from Dashboard → API Keys. Copy the full key once at creation — paste into Authorization: Bearer … for HTTP configs, or into ZEPHEX_API_KEY for stdio/npx configs.
streamable_http extension with url and Authorization header — production setup.
extensions: zephex: name: Zephex type: streamable_http url: https://zephex.dev/mcp headers: Authorization: "Bearer mcp_sk_your_key_here" enabled: true timeout: 300Tip
Remove any old stdio zephex extension (npx -y zephex) to prevent duplicate servers.
Note
For Bearer on CLI-only setups, prefer config.yaml headers or Desktop custom extension env/header fields.
After saving your config, confirm Zephex is connected before you rely on it in real work.
You do not call tools yourself — ask your agent in plain language. Try these once Zephex is connected:
“goose session: check_package on npm package before enabling a new extension dependency.”
streamable_http extension calls hosted tools.
“get_project_context on the repo goose is running in.”
Aligns autonomous goose with actual manifests.
“scope_task: add retry logic to our data pipeline scripts.”
Scoped scripts and libs before goose edits.
“find_code Dockerfile stages that copy secrets incorrectly.”
Security-focused search prompt.
“keep_thinking on goose loop behavior — document ruled-out causes.”
Long autonomous runs stay debuggable.
“audit_package for our pinned terraform provider version bump.”
Infra repo upgrade intelligence.
Enable the Zephex streamable_http extension before starting goose session. Repo tools use the process working directory.
These situations usually mean the setup cannot work until you fix the underlying issue:
Extension blocked
Use official config paths; check goose security messages.
No tools
streamable_http + url in config.yaml.
Auth missing
Authorization Bearer under headers.
Duplicate servers
Disable stdio zephex extension.
Timeout
Raise extension timeout (e.g. 300s).
goose streamable_http extension — ten hosted tools:
get_project_context
Reads your project structure, dependencies, scripts, env vars, and framework markers in one call. Replaces manually opening package.json, tsconfig, and multiple config files at the start of every session.
read_code
AST-based code extraction: pass a symbol name and get the implementation without reading entire files. Supports symbol lookup, batched file reads, and structural outlines for large files.
find_code
Ranked search across the repo for definitions, usages, and patterns. Faster than blind grep when the agent does not know where a symbol lives.
check_package
Live registry lookup for npm, PyPI, Cargo, and Go modules. Surfaces typosquat risk, maintainer changes, and suspicious version jumps before you run install.
audit_package
Deep package intelligence: CVEs with severity, breaking changes between versions, migration notes, and peer-dependency conflicts.
explain_architecture
Generates Mermaid diagrams for auth flows, service boundaries, and module dependencies so the agent reasons about structure instead of guessing.
scope_task
Turns a task description into the smallest file set to read or edit, with risk ratings and caller impact notes.
audit_headers
Grades a deployed URL for CSP, HSTS, TLS, cookies, and redirects. Returns fix snippets for common hosts (Vercel, Cloudflare, Nginx).
keep_thinking
Structured multi-step debugging: tracks hypotheses and conclusions so long investigations do not loop.
Zephex_dev_info
Expert patterns for authentication, databases, frontend frameworks, deployment, and mobile stacks when the agent needs vetted guidance.