Gemini CLI

Gemini CLI is Google's terminal client for the Gemini model family. It reads two environment variables to know where to send its requests and what credential to attach — pointing it at the Cequence AI Gateway is a matter of setting them to the right values.

Setup

Gemini CLI only supports the Gemini provider. Pick the mode you want to run in.

Gemini

Direct — gateway-managed key

The gateway stores your Google API key on the LLM Registry entry. Gemini CLI only sends its Agent Access Key.

export GOOGLE_GEMINI_BASE_URL="https://<gateway-host>/llm/<url-prefix>"
export GEMINI_API_KEY="<your-agent-access-key>"

gemini -m "<model-id>" -p "Hello"

Gemini CLI sends the value of GEMINI_API_KEY as x-goog-api-key on every request. The gateway authenticates the caller from that header, attaches the stored Google credential on the outbound side, and forwards to Google.

Via Agent Persona

Route Gemini CLI through an Agent Persona so its LLM calls run under the same policies that gate the persona's tools, and attach the persona's MCP tools to Gemini CLI in the same setup.

export GOOGLE_GEMINI_BASE_URL="https://<gateway-host>/p/<persona-id>/llm/<registry-entry-id>"
export GEMINI_API_KEY="<your-agent-access-key>"
export GEMINI_CLI_CUSTOM_HEADERS="X-API-Key: <your-agent-access-key>"
export GEMINI_CLI_AIGW_AGENT_KEY="$GEMINI_API_KEY"

gemini mcp add -t http <persona-name> \
  --url "https://<gateway-host>/p/<persona-id>" \
  -H "x-api-key: ${GEMINI_API_KEY}"

What each line does:

• GOOGLE_GEMINI_BASE_URL points Gemini CLI at the persona-scoped LLM endpoint. The /p/<persona-id>/llm/<registry-entry-id> path is what makes the call flow through the persona's guardrails.
• GEMINI_API_KEY is the Agent Access Key. Gemini CLI sends it on x-goog-api-key, which the gateway accepts.
• GEMINI_CLI_CUSTOM_HEADERS adds the same Agent Access Key on X-API-Key, a fallback header the gateway also honors.
• GEMINI_CLI_AIGW_AGENT_KEY mirrors the key for the wrapper's internal use.
• gemini mcp add registers the persona's MCP tool socket with Gemini CLI, using the same Agent Access Key on x-api-key. From this point on, Gemini CLI can both call the model and invoke the persona's tools with a single credential.

Where to find each value

Placeholder	Where to find it
<gateway-host>	Host from the LLM Registry entry's Overview tab
<url-prefix>	The URL prefix field on the entry's Overview tab
<model-id>	A model identifier from the entry's Allowed Models list (e.g., gemini-3.6-flash)
<persona-id>	The persona's ID on the Agent Persona page
<registry-entry-id>	The LLM Registry entry's ID on the entry's URL
<persona-name>	Any short name you want Gemini CLI to use for this MCP server locally
<your-agent-access-key>	Generate from the LLM Registry entry's Agent Access Keys step; plaintext is shown once

Tips

• One key covers both surfaces. In the persona setup, the same Agent Access Key authenticates the LLM call (x-goog-api-key) and the MCP tool socket (x-api-key). Generate one key, use it in both places.
• Restart the CLI after any env change. Gemini CLI reads its environment at startup, so export in a fresh shell before invoking gemini.
• Verify MCP registration. Run gemini mcp list after gemini mcp add to confirm the persona endpoint is registered.
• Unset when finished. If these variables are set only for testing, run unset GOOGLE_GEMINI_BASE_URL GEMINI_API_KEY GEMINI_CLI_CUSTOM_HEADERS GEMINI_CLI_AIGW_AGENT_KEY before returning to your normal Gemini CLI usage — otherwise every subsequent gemini invocation continues to route through the gateway.