Agent stack guide

Best CLI Tools for Gemini CLI

Build a local inspection stack around search and structured data, then add HTTP and GitHub access with explicit scopes.

Coding agentsLocal write

Gemini CLI command policy preview

Start with one recommended CLI and a read-only policy. Review command prefixes, the target environment, and approval boundaries before saving it.

Recommended CLISafety mode

Gemini CLI policyverified · 2026-07-10

gemini-policy.toml

# Gemini CLI policy for GitHub CLI
# Install as a .toml file under ~/.gemini/policies/ (or an administrator policy directory).
# Generated mode: read-only
# Mode boundary: R0 exact commands may be used; R1, R2, and R3 commands are forbidden.
# Evidence: verified; checked 2026-07-10; tested version: 2.86.0.
# Review generated command prefixes before loading this policy.

[[rule]]
toolName = "run_shell_command"
commandPrefix = "gh pr list --state open --json number,title,reviewDecision,url"
decision = "ask_user"
priority = 200

[[rule]]
toolName = "run_shell_command"
commandPrefix = "gh pr merge"
decision = "deny"
priority = 300

[[rule]]
toolName = "run_shell_command"
commandPrefix = "gh repo delete"
decision = "deny"
priority = 300

Evidence boundary

Compatibility is not a test result: current data does not attribute independent CLI execution to a particular agent.

Treat generated content as a reviewable starting point. Remote writes, deletion, production actions, and any confirmation-marked command must still stop for explicit approval.

Outcome, inputs, and outputs

Define the result and evidence before the agent selects a command.

Goal

Give Gemini CLI predictable commands and outputs without granting an open-ended remote action surface.

Required inputs

Project instructions
shell environment
task and target services
credential policy

Expected outputs

CLI stack
command allowlist
output rules
remote-action approval list

Best CLI Tools for Gemini CLI: safe workflow

Run each step inside its stated boundary and verify the output before continuing.

Step 1Read only

Check local tools

Confirm search, JSON, YAML, and project commands before remote access.

Input: Workspace and package manager
Output: Available local tool set

$ Check local tools

rg --version && jq --version && yq --version

Step 2Local write

Define output contracts

Ask each command for structured or stable output and preserve exit codes.

Input: Selected CLI commands
Output: Parseable command patterns

Step 3Local write

Add scoped services

Configure GitHub or HTTP credentials only for the current task and target.

Input: Approved service identity
Output: Task-specific remote tools

Approval points and rollback

Pause at the listed decision points and keep recovery instructions beside the action.

Ask before these actions

Remote writes and production requests
Adding broad tokens or credentials
Commands that overwrite files or bypass project checks

Recovery plan

Version project policy changes
Remove temporary credential configuration
Revert local files and use service-specific reversal for remote changes

CLI, MCP, or API?

Choose the interface by execution location, identity, output contract, and permission boundary.

CLI

Best for local files, project commands, and reproducible requests.

MCP

Useful for typed service tools with a constrained action set.

API

Use when a stable service contract is easier to control than a broad CLI.

Recommended approach

Keep the base local and add one narrow remote interface per task.

Official evidence and references

Use these primary or upstream sources to verify current command behavior before acting.

Gemini CLI repository

Official Gemini CLI installation, configuration, and usage documentation.

Open official source

GitHub CLI manual

Official command, authentication, JSON field, and workflow documentation.

Open official source

ripgrep guide

Project guide for search behavior, filters, file types, and output controls.

Open official source

curl manual

Official HTTP options, output handling, retries, and failure semantics.

Open official source

Questions before you run it

Does Gemini CLI need both jq and yq?

Install only what the project uses; jq covers JSON while yq is useful for YAML and mixed configuration formats.

How should curl credentials be passed?

Read secrets from the environment or an approved secret helper and never include their values in logs or instructions.

Best CLI Tools for Gemini CLI

Gemini CLI command policy preview

Evidence boundary

Outcome, inputs, and outputs

Goal

Required inputs

Expected outputs

Best CLI Tools for Gemini CLI: safe workflow

Check local tools

Define output contracts

Add scoped services

Approval points and rollback

Ask before these actions

Recovery plan

CLI, MCP, or API?

CLI

MCP

API

Recommended approach

Official evidence and references

Gemini CLI repository

GitHub CLI manual

ripgrep guide

curl manual

Questions before you run it

Does Gemini CLI need both jq and yq?

How should curl credentials be passed?

Related tools and guides

Agent CLI stacks

Debug an HTTP API

Transform JSON

curl vs HTTPie

github-cli

ripgrep

jq