Gemini CLI

There is nothing to configure by hand. When you install Golem on a machine that has Gemini CLI, the Golem agent adds its hooks and MCP servers to your Gemini settings. From then on every tool call Gemini CLI makes is checked against your rules before it runs and signed into the record after.

What Golem adds#

Golem writes its part of ~/.gemini/settings.json, beside your own settings:

Every other key is left as it was. Restart Gemini CLI after the first install, because it reads hooks and MCP servers at startup.

~/.gemini also holds Antigravity's files, so the folder alone does not count as Gemini CLI being installed. The Golem agent wires Gemini CLI once Gemini CLI has run on the machine, or once gemini is on the PATH (Homebrew's directories included). If it arrives after Golem, the next check (every 15 minutes by default) picks it up. To wire it straight away, run:

golem setup-client

What a block and a hold look like#

A blocked call does not run, and the model is told why. The reason names the rule and carries a decision id:

blocked by Golem policy (rule "no-curl-to-paste-sites", decision gd_51e8a3c90f6d2b47). Trying again won't change this. If it's a false positive, the user can ask the security team for an exception: golem exception gd_51e8a3c90f6d2b47 --reason "why".

Gemini CLI's hooks can allow or deny a call, with no option to ask a person. So a rule set to Ask cannot become an approval prompt here:

When a rule on the prompt-injection check blocks a tool's result, the model reads Golem's reason in place of the output.

A machine you quarantine is held to its locked-down toolset on this same hook. See Block, hold and contain for the full picture.

What is recorded#

• Every tool call before it runs and after it returns, with its arguments. The tool's output is not stored.
• Each decision Golem made, signed into the session's record.

Gemini's tools are recorded under the names Claude Code uses for the same tools, so one rule covers both agents:

Other tools keep Gemini's name. Messages from other agents reach a Gemini CLI session at its next session start, prompt or tool result. See Agent coordination.

Turn off YOLO mode#

YOLO mode runs every tool without asking. Gemini CLI's hooks do not say which mode a session is in, so Golem reads the gemini command line on the first hook call from each process. A session started with --yolo, -y or --approval-mode yolo shows under Security Inventory → Agent settings for that machine.

To take YOLO mode away across a fleet, set security.disableYoloMode to true in Gemini CLI's system settings file and push it through your MDM:

{
  "security": {
    "disableYoloMode": true
  }
}

Until it is set, Agent settings notes that YOLO mode is allowed on that machine. It also flags run_shell_command in tools.allowed (every shell command runs without asking), folder trust turned off, and auto_edit as the default approval mode. See Roll out to a fleet.

Check that it is working#

1. Run golem doctor. It confirms the Golem agent is running and enrolled, and reports Gemini CLI hooks whose golem binary has moved or gone.
2. Start a Gemini CLI session and ask it which other agents are running on this machine. It should answer from Golem's list_agents tool.
3. In the console at app.golem.team, open Conversations. The session appears under the agent gemini-cli.

Limits#

• What was said is not recorded. Golem records what the agent did. Your prompts reach the Golem agent only so it can answer with context and messages, and Golem does not hook the model's replies.
• YOLO switched on mid-session is not seen. Golem reads the launch flags; Ctrl+Y inside a session leaves no trace it can read.
• Project hooks are the repository's. Golem writes only your user settings. A repository's .gemini/settings.json can add hooks of its own, which Gemini CLI asks you to trust first.
• No Golem skills. Golem installs its skills into other clients, not Gemini CLI.
• Windows is untested. The hook command is written there without the check that keeps a missing binary quiet.
• The shell jail does not apply. It covers Claude Code on macOS. See Shell jail and sandbox.
• If the Golem agent is down, calls run. The hook allows the call rather than stop your work, and nothing is recorded until it is back.

More in Coverage and Limits.

Remove it#

golem setup-client --remove takes Golem's entries out of every AI client on the machine, Gemini CLI included, and remembers the choice so the periodic check does not put them back. To remove Golem entirely, see Uninstall.