Use this guide when Gemini CLI is loading local extensions or embedded MCP server declarations and you want Guard to block changed extension surfaces before launch.
The Gemini adapter looks in:
~/.gemini/extensions/*/gemini-extension.json<workspace>/.gemini/extensions/*/gemini-extension.json~/.gemini/*/mcp_config.jsonFor each extension manifest Guard records:
contextFileNamemcpServersGemini currently uses the Guard approval center:
approval-centerGuard treats both of these as relevant launch inputs:
That matters because a Gemini extension can change publisher metadata, context wiring, and runtime server commands in the same file.
hol-guard detect gemini --json
hol-guard install gemini
hol-guard run gemini --dry-run
hol-guard run gemini
hol-guard approvals
Use a workspace or home directory with a real Gemini extension installed, then confirm:
Gemini is a good Guard fit when you want:
Use this guide when Gemini CLI is loading local extensions or embedded MCP server declarations and you want Guard to block changed extension surfaces before launch.
The Gemini adapter looks in:
~/.gemini/extensions/*/gemini-extension.json<workspace>/.gemini/extensions/*/gemini-extension.json~/.gemini/*/mcp_config.jsonFor each extension manifest Guard records:
contextFileNamemcpServersGemini currently uses the Guard approval center:
approval-centerGuard treats both of these as relevant launch inputs:
That matters because a Gemini extension can change publisher metadata, context wiring, and runtime server commands in the same file.
hol-guard detect gemini --json
hol-guard install gemini
hol-guard run gemini --dry-run
hol-guard run gemini
hol-guard approvals
Use a workspace or home directory with a real Gemini extension installed, then confirm:
Gemini is a good Guard fit when you want: