Gemini CLI: Google's Coding Agent for the Terminal (GitHub, Scanned)

Gemini CLI is Google's open-source coding agent for the terminal: it reads and edits your code, runs shell commands, fetches web pages, grounds answers in Google Search, and connects to MCP servers, all driven by Gemini models with a context window of up to a million tokens. It runs interactively or headless with JSON output for scripts, keeps project instructions in GEMINI.md files, and has a GitHub Action for reviews and issue triage.

The context around it has changed. In May 2026 Google announced that personal use moves to a new, separate Antigravity CLI, and since June 18, 2026 Gemini CLI no longer serves the free tier or Google AI Pro and Ultra subscribers. It still works with paid Gemini API keys, Vertex AI, and Gemini Code Assist Standard or Enterprise licences, and the repository is still active, with weekly releases under Apache-2.0. The README's free-tier section predates the change.

• Repository: github.com/google-gemini/gemini-cli
• Licence: Apache-2.0 (Apache License 2.0)
• Language: TypeScript. Stars: 107.2K. Forks: 14.6K. Last push: Sep 26, 2026.
• Scan: safe, Sep 25, 2026, commit 2fe7c2d

Who it is for

Teams on Google Cloud or a Gemini Code Assist licence who want an open-source agent in the terminal or in CI, and developers with a paid Gemini API key who want to read and control the agent they run.

Getting started

1. Install with npm (or brew install gemini-cli; npx @google/gemini-cli runs it without installing)

npm install -g @google/gemini-cli

2. Give it a paid Gemini API key, or sign in with a Code Assist licence or Vertex AI

export GEMINI_API_KEY="YOUR_API_KEY"

3. Start it in a project

cd your-project && gemini

Since June 18, 2026 personal Google accounts, the free tier and AI Pro and Ultra plans no longer work here; Google points those users to Antigravity CLI. A paid API key, Vertex AI or a Code Assist Standard or Enterprise licence still does.

Safety scan

We cloned google-gemini/gemini-cli at commit 2fe7c2d on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets: all 29 candidates are fake tokens and keys in tests, most of them in the tests for the environment sanitizer that strips real credentials before the agent runs commands. The bare IPs are test cases for its private-address check (CGNAT and benchmark ranges, 8.8.8.8).
• The pattern hits are the Antigravity banner, which prints Google's curl | bash install command for the Antigravity CLI and does not run it, and a comment in shell-utils.ts about passing the CLI's own parser script to PowerShell with -EncodedCommand.
• Five committed binaries: ripgrep builds for macOS, Linux and Windows in packages/core/vendor/ripgrep, about 21 MB, used by the search tool. They carry ripgrep's own project strings, but they are prebuilt files you take on trust rather than code you can read. The one installer script deploys an internal maintenance agent to a Google-internal host.
• Known advisories: 135, 5 critical, all in the main lockfile. Two are runtime dependencies pinned in the CLI and core packages: simple-git 3.28.0 (an unsafe-operations guard bypass) and shell-quote 1.8.3 (newlines not escaped in quote()). Both need hostile input to reach; the other critical ones are Vitest and tar in the build tooling.
• 47 workflows. Three use pull_request_target; the eval job checks out the pull request only after manual approval through a protected environment, and the other two do not run PR code. All 31 third-party actions pinned to a commit. Security policy, Dependabot and CodeQL all present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 678.9K, Markdown 32.4K, JavaScript 13.1K, JSON 9,231, YAML 9,029, Python 5,905.

Questions

Is Gemini CLI free?

The software is Apache-2.0 and free, but free use of the model ended on June 18, 2026: Gemini CLI no longer serves the free tier, personal Google sign-in, or Google AI Pro and Ultra. It works with a paid Gemini API key billed per token, Vertex AI, or a Gemini Code Assist Standard or Enterprise licence.

What is Antigravity CLI, and is Gemini CLI going away?

Antigravity CLI is Google's new terminal agent, written in Go, which takes over personal and consumer-plan use. Gemini CLI remains for paid API keys, Vertex AI and enterprise Code Assist licences, and the repository is still releasing weekly. If you signed in with a personal Google account, you have to move to Antigravity CLI or a paid key.

Does Gemini CLI run commands without asking?

Not by default: it asks before shell commands and file changes, and a trusted-folders setting controls where it may act at all. A --yolo flag approves everything, and optional sandboxing runs tools in a container or under macOS Seatbelt. Either way, the files it reads are sent to Gemini as context.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.