Skip to main content

Buyer guide

Gemini CLI System Settings Checklist

Six steps for teams taking Gemini CLI past a pilot, including which data terms govern prompts and how to see cost per engineer.

Reading time
2 min read
Sources
11 cited
In this piece
Gemini CLI−3 Mixed

Lock the sign-in method, sandbox, tool and MCP allowlists, YOLO mode, and telemetry in Gemini CLI's system overrides file, which takes precedence over the other three settings files. Google says these controls prevent accidental misuse. A user with local administrator rights can still get around them.

When you need this

  • You are rolling Gemini CLI out beyond a pilot group.
  • Security wants to know which data terms apply to prompts and what the agent may run.
  • Some engineers already sign in with personal accounts or unpaid API keys at work.
  • Finance wants cost per engineer and per department.

Evaluation criteria

  1. Pin the sign-in method

    Which terms govern the code and prompts engineers send?

    Look forSet security.auth.enforcedType in the system settings file. On a mismatch the CLI prompts users to switch, and non-interactive runs exit with an error. Code Assist Standard and Enterprise and Vertex AI run under the Google Cloud Platform Terms of Service. Unpaid API keys run under the Gemini API unpaid-services terms. Google stopped selling new Code Assist subscriptions on October 9, 2026, so teams without one pin Vertex AI or a paid API key.

  2. Force the sandbox

    What can a shell command the agent runs reach?

    Look forSet tools.sandbox to docker, or to a hardened custom image, in system settings. Sandboxing is off unless configured, and when on it limits file system access to the project directory.

  3. Allowlist tools and MCP servers

    Which tools and servers can the model call?

    Look forUse tools.core as an allowlist, with policy engine rules that allow, deny, or ask_user for specific tools and command prefixes. Set mcp.allowed with a canonical mcpServers definition for each approved server, because without mcp.allowed any server a user defines runs. Use includeTools to expose only the tools a third-party server needs.

  4. Disable YOLO mode

    Can an engineer skip confirmation for every tool call?

    Look forSet security.disableYoloMode to true, which Google's enterprise guide calls highly recommended. Add security.disableAlwaysAllow to remove the always-allow option from confirmation dialogs.

  5. Export telemetry without prompts

    How will you see usage and cost per engineer?

    Look forExport OpenTelemetry with telemetry.target set to gcp and logPrompts set to false, so usage reaches your Google Cloud project without prompt text.

  6. Protect the settings path

    Can a user point the CLI at a different settings file?

    Look forSet GEMINI_CLI_SYSTEM_SETTINGS_PATH in a wrapper script or shell profile, and lock the file permissions on /etc/gemini-cli/settings.json on Linux, /Library/Application Support/GeminiCli/settings.json on macOS, or C:\ProgramData\gemini-cli\settings.json on Windows.

Questions to ask vendors

  1. Which sign-in method does each engineer use today, and could any of them fall back to an unpaid API key?
  2. Who approves a new MCP server or extension, and where is the approved list kept?
  3. Where does telemetry land, and have we confirmed logPrompts is off?
  4. How do we detect Gemini CLI calls billed to projects outside the one we manage?
  5. Who is told when an engineer reaches the daily request cap or spends unusually?
  6. Does the CLI start promptly behind your proxy? In October 2025 a DZ BANK engineer reported that Gemini CLI 0.9.0 blocked for about 2.5 minutes at startup while downloading ripgrep, holding up many colleagues.

Red flags

  • System settings that define mcpServers but omit mcp.allowed, which leaves user-defined servers running.
  • A blocklist of shell commands in place of an allowlist. Google marks excludeTools deprecated and less secure.
  • Workspace sign-ins passing Admin console API controls you expected to block, as a Workspace Enterprise Plus administrator reported on GitHub in October 2025.
  • Treating the settings file as a security boundary on machines where engineers hold administrator rights.

Products in this piece

Sources

Official documentation
9
Public source
2
  1. Gemini CLI docs: Enterprise configurationOfficial documentationgeminicli.com
  2. Gemini CLI docs: Configuration referenceOfficial documentationgeminicli.com
  3. Gemini CLI docs: AuthenticationOfficial documentationgeminicli.com
  4. Gemini CLI docs: Terms and privacyOfficial documentationgeminicli.com
  5. Gemini CLI docs: SandboxingOfficial documentationgeminicli.com
  6. Gemini CLI docs: Policy engineOfficial documentationgeminicli.com
  7. Gemini CLI docs: MCP serversOfficial documentationgeminicli.com
  8. Gemini CLI docs: Observability with OpenTelemetryOfficial documentationgeminicli.com
  9. Gemini Code Assist docs: Gemini Code Assist Standard and Enterprise subscriptionsOfficial documentationdocs.cloud.google.com
  10. GitHub issue 12121: Workspace OAuth bypasses Admin console API controls (Oct 28, 2025)Public sourcegithub.com
  11. GitHub issue 11822: 2.5 minute startup delay behind a corporate proxy (Oct 23, 2025)Public sourcegithub.com

Keep reading

  1. Buyer guideGemini CLI Workflow PlaybookGEMINI.md context, approval modes, checkpoints, and review practice for engineers running Gemini CLI on Code Assist, Vertex AI, or a paid API key.
  2. Buyer guideGemini CLI or Antigravity CLI: Planning the DecisionCode Assist sign-in to Gemini CLI ends with each contract, while paid API keys keep working. Set every team a move date to Antigravity CLI ahead of its last renewal.
  3. Buyer guideGemini CLI in Your GitHub Review WorkflowPull requests waiting on reviewers and issues nobody has labeled: how to set Gemini CLI on both in GitHub Actions, in six steps.
Read the research