MCP, MCP server
Gemini Mcp Tool
MCP server that enables AI assistants to interact with Google Gemini CLI, leveraging Gemini's massive token window for large file analysis and codebase understanding
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 588e73dfff07, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
src/utils/geminiExecutor.ts, line 27
* unrestricted reference such as `@/etc/passwd`, `@~/.ssh/id_rsa` or
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
src/utils/chunkCache.ts, line 87
fs.unlinkSync(filePath);
src/utils/chunkCache.ts, line 119
fs.unlinkSync(filePath);
src/utils/chunkCache.ts, line 156
fs.unlinkSync(file.path);
Show more
src/utils/chunkCache.ts, line 190
fs.unlinkSync(path.join(CACHE_DIR, file));
Install and update
Note
README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
README.md, line 37
curl -fsSL https://antigravity.google/cli/install.sh | bash # macOS / Linux
src/constants.ts, line 116
AGY_INSTALL_CMD: "curl -fsSL https://antigravity.google/cli/install.sh | bash",
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/doctor.mjs, line 165
console.log(` ${BAD} No LLM Judge keys found. Please set DEEPSEEK_API_KEY or OPENROUTER_API_KEY in your test/.env file.`);
scripts/doctor.mjs, line 195
const envPath = path.join(repoRoot, "test", ".env");
src/utils/geminiExecutor.ts, line 27
* unrestricted reference such as `@/etc/passwd`, `@~/.ssh/id_rsa` or
Show more
scripts/doctor.mjs, line 197
if (process.env.DEEPSEEK_API_KEY) {
scripts/doctor.mjs, line 199
keyType = "process.env.DEEPSEEK_API_KEY";
scripts/doctor.mjs, line 200
} else if (process.env.OPENROUTER_API_KEY) {
scripts/doctor.mjs, line 202
keyType = "process.env.OPENROUTER_API_KEY";
scripts/doctor.mjs, line 210
keyType = "test/.env (DEEPSEEK_API_KEY)";
scripts/doctor.mjs, line 213
keyType = "test/.env (OPENROUTER_API_KEY)";
.gitignore, line 3
*.log
docs/usage/best-practices.md, line 22
@.env @config/*.js # Environment + config
docs/usage/best-practices.md, line 91
@error.log @src/api.js @models/user.js @.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 588e73dfff07. can delete files. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 588e73dfff07c29f5eeec988e886b46cc8cd6330
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.