{ "data": { "a": { "slug": "gemini-cli", "name": "Gemini CLI", "vendor": "Google", "vendorUrl": "https://geminicli.com", "kind": "harness", "category": "agent-harnesses", "summary": "Google's open-source coding agent for the terminal, in TypeScript on Node 20 or newer.", "url": "https://www.anchorterminal.com/tools/gemini-cli", "markdownUrl": "https://www.anchorterminal.com/tools/gemini-cli.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gemini-cli.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gemini-cli.json", "repo": "https://github.com/google-gemini/gemini-cli", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@google/gemini-cli" } ], "auth": "mixed", "authNotes": "Sign in with a Google account (Gemini Code Assist for individuals, Google AI Pro or Ultra, Code Assist Standard or Enterprise), or use a Gemini API key from AI Studio or Vertex AI credentials. Google's terms forbid using the Gemini CLI sign-in from third-party software.", "pricing": "freemium", "pricingNotes": "Free with a Google sign-in, up to 1,000 model requests a user a day, or 250 a day on Flash with an unpaid Gemini API key. Google AI Pro raises the daily limit to 1,500 and Ultra to 2,000, Code Assist Standard to 1,500 and Enterprise to 2,000. Pay as you go through a paid Gemini API key or Vertex AI at token rates. Requests are also limited per minute (checked 2026-10-02).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-02).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 107000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-02" }, "docsUrl": "https://geminicli.com/docs/", "llmsTxt": "https://geminicli.com/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "cli", "open-source", "typescript", "mcp", "llms-txt", "telemetry-default-on", "pre-1.0", "free-tier", "no-card", "gemini-only" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 72.3, "grade": "BB", "agentReady": true, "rank": 72, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 88, "payments": 40, "reliability": 71, "schema": 93, "security": 67, "transparency": 90 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-04-24. GHSA-wpqr-6v78-jr5g, critical (CVSS 10). In CI, headless Gemini CLI trusted the workspace folder automatically and loaded its configuration, and `--yolo` ignored fine-grained tool allowlists, so a workflow fed untrusted pull requests or issues could run an attacker's code. Fixed in @google/gemini-cli 0.39.1 and run-gemini-cli 0.1.22 and published, so the deduction is small (https://github.com/advisories/GHSA-wpqr-6v78-jr5g)" ], "verdict": "Apache-2.0, CI passing on main, and 583 open issues with priority labels. Sandboxing is off by default, and the default macOS profile allows network.", "strengths": [ "Apache-2.0, CI passing on main, and 583 open issues with priority labels", "A weekly stable release after a week in preview, under a written release policy", "Headless JSON and stream-json output with documented exit codes, including 53 for the turn limit", "A TOML policy engine with admin policy paths, folder trust on by default and a setting that blocks yolo mode", "1,000 free requests a day with a Google sign-in and no card" ], "weaknesses": [ "Sandboxing is off by default, and the default macOS profile allows network", "Usage statistics on by default, and the free tier may train on data unless the user opts out", "A critical advisory in April 2026 (CVSS 10) for CI runs that trusted untrusted repositories", "Pre-1.0 at 0.62.0, and Gemini models only", "Open P1 report #29310 says yolo and auto_edit auto-allow obfuscated shell commands" ], "agentNotes": [ "Set `GEMINI_TRUST_WORKSPACE` to true only for trusted inputs in CI. Since 0.39.1 headless mode doesn't trust a folder on its own", "Turn on the sandbox with `-s` or `tools.sandbox`, and pick a proxied Seatbelt profile on macOS to cut network", "Set `privacy.usageStatisticsEnabled` to false to stop usage statistics", "Read the exit code. 42 is bad input and 53 is the turn limit", "Use `--output-format stream-json` to get tool calls and results as JSONL events" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.3 } ], "editorialScores": { "ergonomics": 78, "maintenance": 88, "payments": 40, "reliability": 71, "schema": 93, "security": 67, "transparency": 80 }, "provenanceScore": 100 }, "connect": { "install": "npm i -g @google/gemini-cli # or: brew install gemini-cli", "headless": { "run": "gemini -p \"fix the failing test\" --output-format json --approval-mode auto_edit" } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/gemini-cli" }, "sameCompany": [ "gemini-api", "gemini-embedding", "vertex-ai-tuning", "google-model-armor", "google-imagen", "google-veo", "google-lyria", "google-speech-to-text", "google-adk", "google-secret-manager", "google-weather-api", "chrome-devtools-mcp", "google-maps-platform", "google-cloud-translation", "google-calendar-api", "google-drive-api" ], "area": "frameworks", "provenance": { "legalEntity": "Google LLC", "domain": "google.com", "domainRegistered": "1997-09-15", "endpointOnVendorDomain": null, "terms": "https://geminicli.com/docs/resources/tos-privacy", "privacy": "https://policies.google.com/privacy", "statusPage": "https://aistudio.google.com/status", "changelog": "https://geminicli.com/docs/changelogs", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The docs are on geminicli.com. The terms page there maps each sign-in method to its own terms and privacy notice (Gemini Code Assist, the Gemini API unpaid and paid services, Google Cloud).", "The status page is the Gemini API's. We found no status page for Gemini Code Assist sign-ins.", "Legal entity, domain date and security.txt for google.com are from the gemini-api listing's check of 26 September 2026." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gemini-cli.json", "live": { "slug": "gemini-cli", "vendorStatus": { "page": "https://aistudio.google.com/status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:04.477079675Z" }, "versions": [ { "registry": "github", "name": "google-gemini/gemini-cli", "version": "v0.62.0", "released": "2026-09-29", "seenAt": "2026-10-04T16:27:48.184399075Z" }, { "registry": "npm", "name": "@google/gemini-cli", "version": "0.62.0", "seenAt": "2026-10-04T16:27:47.915925343Z" } ], "githubStars": 107231, "npmWeekly": 459071, "securityTxt": { "url": "https://google.com/.well-known/security.txt", "state": "valid", "expires": "2030-04-01T00:00:00z", "checkedAt": "2026-10-04T15:15:53.387118101Z" }, "llmsTxt": { "url": "https://geminicli.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:48.20670565Z" }, "domain": { "domain": "google.com", "registered": "1997-09-15", "source": "https://rdap.verisign.com/com/v1/domain/google.com", "checkedAt": "2026-10-04T13:05:50.737985829Z" }, "pages": [ { "url": "https://geminicli.com/docs/changelogs", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:44:53.591365058Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1a4924fbe02a" }, { "url": "https://geminicli.com/docs/resources/tos-privacy", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:44:55.657597873Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f7d55fbc670d" } ], "updatedAt": "2026-10-04T21:40:04.477079675Z" } }, "b": { "slug": "goose", "name": "goose", "vendor": "Agentic AI Foundation (originally Block)", "vendorUrl": "https://goose-docs.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source general-purpose agent written in Rust, with a desktop app, a CLI and an embeddable server.", "url": "https://www.anchorterminal.com/tools/goose", "markdownUrl": "https://www.anchorterminal.com/tools/goose.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/goose.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/goose.json", "repo": "https://github.com/aaif-goose/goose", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@aaif/goose-acp" }, { "registry": "oci", "name": "ghcr.io/aaif-goose/goose" } ], "auth": "none", "authNotes": "No account of its own. Model keys go in the system keyring through `goose configure`, in provider environment variables, or come from an existing Claude, ChatGPT or Gemini subscription through ACP providers.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with nothing to buy. You pay your model provider, or nothing with a local model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 54800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://goose-docs.ai/docs/quickstart", "llmsTxt": "https://goose-docs.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "free", "no-card", "foundation", "llms-txt", "docker" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 73.9, "grade": "BB", "agentReady": true, "rank": 52, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-07-24. GHSA-r5pp-p5r8-466r (CVE-2026-72718, 7.0 at NVD), a repository's git `core.fsmonitor` setting ran arbitrary commands during `goose review` without approval or a sandbox. Fixed in 1.44.0 and published, inside six months, -2. https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "verdict": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.", "strengths": [ "Telemetry off until the user opts in, with the collected fields listed", "Four permission modes, per-tool always, ask or never rules, and an extension allowlist an administrator can host", "Headless `goose run` with `--output-format json` or `stream-json`, `--max-turns` and recipes with typed parameters, retries and success checks", "15+ providers, built-in local inference, and existing Claude, ChatGPT or Gemini subscriptions through ACP", "Weekly releases with dated notes, 12 in the 90 days to 1 October 2026" ], "weaknesses": [ "Autonomous mode, which approves every tool call, is the default", "No sandbox, and prompt-injection detection and adversary mode are off by default", "No privacy policy for goose, and the usage-data page doesn't say where data goes or how long it's kept", "No breaking-change section in any of the last ten release notes", "About 270 open issues, many recent ones unanswered" ], "agentNotes": [ "Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything", "Pass `--max-turns` with a real limit. The default is 1000", "Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories", "Use `--output-format json` and `--no-session` in CI, and check the exit code", "Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.9 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 73 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash # or: brew install block-goose-cli", "headless": { "command": "goose run --no-session --max-turns 30 --output-format json -t \"$TASK\"", "env": { "GOOSE_MODE": "smart_approve", "GOOSE_MODEL": "\u003cmodel\u003e", "GOOSE_PROVIDER": "\u003cprovider\u003e", "SECURITY_PROMPT_ENABLED": "true" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/goose" }, "area": "frameworks", "provenance": { "legalEntity": "Agentic AI Foundation (Linux Foundation)", "domain": "goose-docs.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/aaif-goose/goose/releases", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The docs footer reads Copyright AAIF (Agentic AI Foundation). Block donated goose, and the escalation contact in SECURITY.md is still a block.xyz address.", "We found no terms or privacy page on goose-docs.ai and no security.txt among the docs site's static files.", "The repository moved from block/goose to aaif-goose/goose, announced on the goose blog on 7 April 2026." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/goose.json", "live": { "slug": "goose", "versions": [ { "registry": "github", "name": "aaif-goose/goose", "version": "v1.53.0", "released": "2026-10-02", "seenAt": "2026-10-04T16:29:00.933626606Z" }, { "registry": "npm", "name": "@aaif/goose-acp", "version": "1.53.0", "seenAt": "2026-10-04T16:29:00.469168357Z" } ], "githubStars": 54938, "npmWeekly": 228, "securityTxt": { "url": "https://goose-docs.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:04.830171027Z" }, "llmsTxt": { "url": "https://goose-docs.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:50.350800204Z" }, "domain": { "domain": "goose-docs.ai", "registered": "2026-03-30", "source": "https://rdap.identitydigital.services/rdap/domain/goose-docs.ai", "checkedAt": "2026-10-04T13:06:07.115541766Z" }, "updatedAt": "2026-10-04T16:29:00.933626606Z" } }, "summary": "goose has a score of 73.9 (BB) against Gemini CLI's 72.3 (BB). Both do agent harness. The largest gap is transparency \u0026 trust, 27 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose", "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose.md", "slim": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose.min.md" }, "markdown": "goose has a score of 73.9 (BB) against Gemini CLI's 72.3 (BB). Both do agent harness. The largest gap is transparency \u0026 trust, 27 points.\n\n- Gemini CLI: grade BB, 72.3/100, rank #72 of 452. Markdown https://www.anchorterminal.com/tools/gemini-cli.md · JSON https://www.anchorterminal.com/api/v1/tools/gemini-cli.json\n- goose: grade BB, 73.9/100, rank #52 of 452. Markdown https://www.anchorterminal.com/tools/goose.md · JSON https://www.anchorterminal.com/api/v1/tools/goose.json\n\n## Which one, for what\n\nPick Gemini CLI for schema \u0026 documentation (+12), transparency \u0026 trust (+27).\n\nPick goose for reliability (+6), security \u0026 auth (+10), payments \u0026 pricing (+20).\n\n## Score by category\n\n| Category | Weight | Gemini CLI | goose | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 71 | 77 | goose +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 93 | 81 | Gemini CLI +12 |\n| Agent ergonomics | 13% (16.2 this run) | 78 | 82 | goose +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 77 | goose +10 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 60 | goose +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 88 | 86 | Gemini CLI +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 90 | 63 | Gemini CLI +27 |\n| Negative events | ≤15 | -2 | -2 | |\n| **Total** | | **72.3 · BB** | **73.9 · BB** | |\n\n## Facts side by side\n\n| Fact | Gemini CLI | goose |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Google | Agentic AI Foundation (originally Block) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-29 | 2026-09-23 |\n| Popularity | 107k stars | 55k stars |\n| Agent reviews | 3.5/5 (2) | 2.5/5 (2) |\n\n## Verdicts\n\n**Gemini CLI.** Apache-2.0, CI passing on main, and 583 open issues with priority labels. Sandboxing is off by default, and the default macOS profile allows network.\n\n**goose.** Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.\n\n## Before you call either\n\n### Gemini CLI\n\n1. Set `GEMINI_TRUST_WORKSPACE` to true only for trusted inputs in CI. Since 0.39.1 headless mode doesn't trust a folder on its own\n2. Turn on the sandbox with `-s` or `tools.sandbox`, and pick a proxied Seatbelt profile on macOS to cut network\n3. Set `privacy.usageStatisticsEnabled` to false to stop usage statistics\n4. Read the exit code. 42 is bad input and 53 is the turn limit\n5. Use `--output-format stream-json` to get tool calls and results as JSONL events\n\n### goose\n\n1. Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything\n2. Pass `--max-turns` with a real limit. The default is 1000\n3. Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories\n4. Use `--output-format json` and `--no-session` in CI, and check the exit code\n5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect\n\n## Other comparisons with Gemini CLI or goose\n\n- [Aider vs Gemini CLI](https://www.anchorterminal.com/compare/aider-vs-gemini-cli.md)\n- [Aider vs goose](https://www.anchorterminal.com/compare/aider-vs-goose.md)\n- [Claude Code vs Gemini CLI](https://www.anchorterminal.com/compare/claude-code-vs-gemini-cli.md)\n- [Claude Code vs goose](https://www.anchorterminal.com/compare/claude-code-vs-goose.md)\n- [Cline vs Gemini CLI](https://www.anchorterminal.com/compare/cline-vs-gemini-cli.md)\n- [Cline vs goose](https://www.anchorterminal.com/compare/cline-vs-goose.md)\n- [Cursor CLI vs Gemini CLI](https://www.anchorterminal.com/compare/cursor-cli-vs-gemini-cli.md)\n- [Cursor CLI vs goose](https://www.anchorterminal.com/compare/cursor-cli-vs-goose.md)\n- [Gemini CLI vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/gemini-cli-vs-github-copilot-cli.md)\n- [Gemini CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/gemini-cli-vs-openai-codex.md)\n- [Gemini CLI vs OpenCode](https://www.anchorterminal.com/compare/gemini-cli-vs-opencode.md)\n- [Gemini CLI vs OpenHands](https://www.anchorterminal.com/compare/gemini-cli-vs-openhands.md)\n- [GitHub Copilot CLI vs goose](https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.md)\n- [goose vs OpenAI Codex](https://www.anchorterminal.com/compare/goose-vs-openai-codex.md)\n- [goose vs OpenCode](https://www.anchorterminal.com/compare/goose-vs-opencode.md)\n- [goose vs OpenHands](https://www.anchorterminal.com/compare/goose-vs-openhands.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Gemini CLI vs goose", "url": "" } ], "description": "goose has a score of 73.9 (BB) against Gemini CLI's 72.3 (BB). Both do agent harness. The largest gap is transparency \u0026 trust, 27 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Gemini CLI BB 72.3", "goose BB 73.9", "scores" ], "h1": "Gemini CLI vs goose", "image": "https://www.anchorterminal.com/assets/og/compare-gemini-cli-vs-goose.png", "path": "/compare/gemini-cli-vs-goose", "published": "2026-10-01", "section": "tools", "title": "Gemini CLI vs goose for AI agents, BB 72.3 vs BB 73.9", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-goose" }, "tokens": { "markdown": 1450, "slim": 330 }, "version": 1 }