Gemini CLI Guardrails

Before-tool command guardrails for Gemini CLI

Python + TS

APort configures Gemini CLI guardrails through the same command-hook adapter used by the newer CLI harnesses. The gemini alias installs policy checks for shell, file, web, and MCP-style tool calls before execution.

Gemini CLI Repo Integration Docs

Quick Start

1. Install guardrail & create passport

setup

npx @aporthq/aport-agent-guardrails gemini

2. Configure the integration

code

# Gemini CLI setup; gemini is an alias for gemini-cli
npx @aporthq/aport-agent-guardrails gemini

# Start in warn mode for rollout:
npx @aporthq/aport-agent-guardrails mode gemini --enforcement=warn

Test the authorization boundary

Installer target: gemini-cli. Aliases: gemini.

Gemini CLI setup

npx @aporthq/aport-agent-guardrails gemini

Denied-action example

Read .env.aport-smoke-test with a passport that blocks .env* paths.

Expected policy result: deny. Use an empty test file. In warn mode the runtime may continue; enforce mode must stop the read. Hosted mode can record the decision; local mode does not prove hosted audit persistence.

Expected policy result, illustrative

{
  "policy_id": "data.file.read.v1",
  "allow": false,
  "reason": "oap.blocked_pattern"
}

Read the guardrail skill Inspect the framework passport preset

How It Works

Passport

Your agent gets an OAP passport declaring its identity, capabilities, and operational limits.

Evaluate

Before every tool call, the guardrail evaluates it against the passport's policy. Locally or via hosted API.

Decision

Allow or deny with structured OAP reason codes. Signed decisions create an auditable trail.

Frequently Asked Questions

Why does the installer use gemini instead of gemini-cli?

The CLI is commonly invoked as gemini, so APort supports that alias while keeping gemini-cli as the canonical framework identifier in passports and docs.

Ready to secure your Gemini CLI agents?

Review the setup command and denied-action check before enforcing policy.

Install my guardrail See Team Pricing

Start free for local or individual setup. Upgrade to Team for hosted org audit, signed decisions, GitHub guardrails, and shared enforcement across your team.