Gemini CLI

defenseclaw setup geminicli

Confirms once, wires the hooks against ~/.gemini/settings.json, points OTLP at the gateway, and restarts the gateway. Findings flow to mandatory SQLite event history and the TUI; configured v8 destinations receive only the buckets/signals their routes select. No traffic is intercepted and no requests are blocked. Pass --yes to skip the confirmation in CI.

defenseclaw setup geminicli --yes --with-local-stack

Same as standard but also runs setup local-observability up so Prom/Loki/Tempo/Grafana come up locally — particularly useful for Gemini since native OTLP feeds traces and metrics directly into Tempo and Prometheus. That command writes the export destination after the alias has already restarted the gateway, so run its printed defenseclaw-gateway restart step before expecting exports. See Local observability.

export DEFENSECLAW_LLM_KEY='replace-with-your-key'

defenseclaw setup geminicli                               # base alias first
defenseclaw setup guardrail \
  --connector geminicli \
  --rule-pack strict \
  --scanner-mode local \
  --detection-strategy regex_judge \
  --judge-model anthropic/claude-sonnet-4-20250514 \
  --judge-api-key-env DEFENSECLAW_LLM_KEY \
  --judge-hook-connectors geminicli \
  --restart

The alias selects Gemini CLI; the follow-up setup guardrail --connector geminicli swaps in the strict rule pack, keeps scanning local, and turns the LLM judge on as a second-pass adjudicator on regex-flagged events. Configure the remote scanner separately through full guardrail setup, which validates its endpoint and API-key environment variable.

Gemini CLI has no proxy enforcement, but its hooks can enforce directly:

defenseclaw setup geminicli --mode action --fail-mode closed

With mode=action, the declared blocking hooks stop policy-denied work. Because Gemini CLI has no native ask surface, confirm uses an alert/context fallback; operators can review the event in audit or the TUI, but cannot resume it there.