zn-gate for Gemini CLI

Gemini CLI support is experimental. Treat it as a first layer: zn can block a call, but it cannot hide what a tool returns (see Limits below).

Google replaced Gemini CLI with Antigravity CLI for free and Google One accounts on June 18, 2026. Antigravity is now the first choice for new setups; zn-gate still supports Gemini CLI.

You need Node.js 18 or later. Paste each line in a terminal and press Enter after each one:

npm install -g zn-gate
zn hooks install gemini

On macOS and Linux, if npm install -g fails with EACCES, follow npm's guide to fixing permission errors.

Fix it without administrator rights:

mkdir -p ~/.npm-global && npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.zshrc

Bash users: write to ~/.bashrc instead of ~/.zshrc.

Then open a new terminal and run npx -y zn-gate init. A Node.js version manager such as nvm also avoids the problem.

Then open a new Gemini CLI session. zn adds its hook to ~/.gemini/settings.json. Updating later? See Upgrading zn-gate.

For one project only

Run zn hooks install gemini --project inside the project. It writes .gemini/settings.json in that project instead of your home folder. Gemini CLI treats a project hook as untrusted until you approve it, and the hook runs zn from your PATH, so everyone who opens the project needs zn-gate installed.

What you get

• zn checks every tool call before it runs.
• Reads and writes of secret files, such as .env files with values, are blocked by file path.
• Shell commands that handle secrets are blocked. For a command that uses a __ZN_<NAME>__ marker, zn blocks it and tells the model the exact zn run -- ... line to use instead.
• A search across a folder that would print plain-text secrets is blocked. Name a narrower path.
• The agent cannot edit Gemini CLI's own settings files.
• zn never approves a call for you. When it has no objection, Gemini CLI's own approval applies.

Limits

• What a tool returns is not changed. A value that a command prints, or that sits in a file the agent may read, still reaches the model. Keep your secrets in the vault.
• zn blocks what it would ask about. Gemini CLI hooks cannot ask you for confirmation, so zn blocks what it would refuse, and what it would ask about, with the reason and how to approve it. For everything else Gemini CLI's own approval applies.
• A secret pasted into a typed prompt is not checked.
• Gemini CLI lets a call run when a hook crashes or times out, so zn blocks it instead. In Gemini CLI only an explicit refusal blocks. zn sets a 15-second timeout on its hook (Gemini CLI's own default is 60 seconds), and a check still running after 11 seconds is answered with a block. On a user install a small launcher script, and on a project install a start guard, answer a hook that fails (including when the Node.js that zn was installed with is gone) with a block.
• Settings can switch the hook off. hooksConfig.enabled: false, a hook name in hooksConfig.disabled and the /hooks disable command each turn it off. zn-gate check reports them.
• zn was checked against Gemini CLI 0.64.0 with a scripted model, not with every version.

Check that it works

In a new terminal, run zn-gate check. It should show OK for Gemini CLI. What the output means.

On Windows PowerShell, if npm says "running scripts is disabled on this system", use npm.cmd and zn.cmd instead: see Install.

Remove it

Run zn hooks uninstall gemini in your own terminal (add --project for a project install).