Gemini CLI gives the model real terminal tools
Gemini CLI is a coding agent that lives in a terminal rather than a chat page. It can inspect and edit files, execute shell commands, fetch web pages, and ground requests with Google Search. A developer can ask it to explain a codebase, fix a bug, or build an application from multimodal input. The tool can also run without an interactive interface and return plain text, JSON, or streamed JSON events for scripts.
That access is the reason to consider it and the reason to set boundaries. A model that can run commands and modify files can complete useful work, but mistakes reach the working tree. The documentation provides trusted-folder controls and several sandbox providers. Teams should enable the least permissive tool set that still completes the job and keep code review around generated changes.
Three authentication routes tie it to Google services
The README documents Google account sign-in, a Gemini API key, and Vertex AI. OAuth is aimed at individual developers and Code Assist license holders. API-key use suits explicit model selection and usage-based billing. Vertex AI adds Google Cloud project and billing configuration for enterprise workloads. All three ultimately call a remote Gemini service, so the open-source client is not a local-model runtime.
The advertised personal tier lists 60 requests per minute and 1,000 requests per day, while API-key quotas have their own terms. Quotas and model access can change outside the repository, so teams should verify the current account terms before budgeting automation. Credentials belong in environment or supported auth storage, never in repository settings or a GEMINI.md context file.
What happened when we ran it
Our sandbox installed 1,325 npm packages in 47 seconds, consuming 795 MB on disk. The build succeeded in 69 seconds. The source run used commit 5dd4919, Node 22, 3 CPUs, 8 GB of RAM, an unprivileged Debian container, and no secrets. Npm audit reported 71 known vulnerabilities: 5 critical, 22 high, 40 moderate, and 4 low.
The test command did not finish within the 900-second limit. Vitest reported 6,986 passed, 10 failed, and 4 skipped out of 7,000 tests. The supplied tail showed passing files for context calculation, JSON handling, credential-leak prevention, browser wrappers, policy, and path validation, then ended at a failing-tests summary. It did not name the 10 failed cases, so the log does not support a cause or a claim that they were environment-only.
This is a large source project: 2,991 files, about 680,799 source lines, and an 86.6 MB checkout before dependencies. It uses npm workspaces and has 47 CI workflow files plus a Dockerfile. There is no root tests directory, which is normal for a workspace layout where package tests live beside package code. The 795 MB install and long suite make casual source contribution more expensive than running the published CLI.
MCP and headless output make it more than a chat client
MCP support lets Gemini CLI connect to custom tools configured in ~/.gemini/settings.json. The README illustrates GitHub, Slack, and database-style integrations. This can turn one terminal session into a front end for internal services, but each added server expands the credentials and actions available to the model. Review server commands, scope secrets, and require confirmation for side effects that matter.
Headless mode is useful for automation. A script can request JSON for one final result or stream newline-delimited events from a longer task. The README also documents a GitHub Action for pull request review, issue triage, and triggered assistance. Non-interactive execution needs tighter failure handling than a human session because a timeout, partial tool call, or malformed model response must not be mistaken for success.
Sandboxing exists, but the provider changes the boundary
The sandbox guide supports macOS Seatbelt, Docker or Podman containers, gVisor, and experimental LXC. Docker and Podman mount the current workspace at the same absolute path inside the container. A custom image can supply project dependencies. gVisor adds a user-space kernel on Linux, while Seatbelt uses profiles with different read, write, and network rules.
These modes are not interchangeable. A permissive profile can still read broadly or access the network. Docker requires a running daemon, and custom images need maintenance. LXC expects an existing container. Before allowing autonomous shell work, test which host paths are visible, whether network calls are allowed, how credentials enter the sandbox, and what changes remain after the process ends.
Weekly releases move faster than the clean-room result
GitHub showed 106,703 stars, 862 combined issues and pull requests, and a push on August 27, 2026. Stable v0.57.0 was published on August 25. Its notes include OAuth proxy handling, IDE connection fixes, evaluation formatting, capacity retries, cancellation rollback, and test stabilization. The README says stable releases arrive weekly, previews weekly, and nightlies daily.
That pace brings fixes quickly, though it also asks users to choose a channel carefully. Preview releases may contain regressions, and nightlies represent main-branch state with pending validation. For team use, pin a stable version, record the selected model and auth mode, test the tool policy, and update on a schedule rather than accepting every change during active work.
The source revision needs a security and test follow-up
Gemini CLI has broad capabilities, strong documentation, and an active community. The measured source state is less reassuring than the product overview: 10 failed tests, a 15-minute cap, and 71 audit findings are material results. The passing 6,986 tests show substantial coverage, but they do not cancel the failures or classify the dependency advisories.
Try the stable npm package in a disposable repository if Gemini is already part of your stack. Before managed use, reproduce the suite, inspect the exact audit paths, choose a sandbox provider, and restrict MCP credentials. The client is easy to start; operating a command-running agent responsibly takes more work than the one-line install suggests.