call_gemini · Gemini Agent MCP Server MCP: Risk & Policy

WHAT IT DOES

What call_gemini does on Gemini Agent MCP Server

AI agents invoke call_gemini to trigger actions in Gemini Agent MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why call_gemini needs a policy

This tool executes an external CLI process (Gemini CLI) with a user-controlled prompt. Because the prompt is arbitrary and the CLI handles file/directory references, an AI agent could craft prompts that access files, trigger code execution, or invoke other development tools. The blast radius is high since it chains into a capable AI model with filesystem access and tool-use capabilities.

From the tool's definition 'Calls the Gemini CLI with a given prompt' - this executes an external CLI process with arbitrary prompt input, and 'The Gemini CLI itself handles @-mentions of files and directories' indicates it can access the filesystem and trigger downstream operations

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

call_gemini Rate-limited

call_gemini stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "call_gemini": {
      "limits": [
        {
          "counter": "call_gemini_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Gemini Agent MCP Server, so you can run agents against it safely.

FAQ

Questions about call_gemini

What does the call_gemini tool do? +

Calls the Gemini CLI with a given prompt. The Gemini CLI itself handles @-mentions of files and directories. It is categorised as a Execute tool in the Gemini Agent MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on call_gemini? +

Register the Gemini Agent MCP Server MCP server in PolicyLayer and add a rule for call_gemini: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Gemini Agent MCP Server. Nothing to install.

What risk level is call_gemini? +

call_gemini is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit call_gemini? +

Yes. Add a rate_limit block to the call_gemini rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block call_gemini completely? +

Set action: deny in the PolicyLayer policy for call_gemini. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides call_gemini? +

call_gemini is provided by the Gemini Agent MCP Server MCP server (leesinliang/geminicliagentmcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.