
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@google-dev/gemini-cli-core
Advanced tools

This repository contains the Gemini CLI, a command-line AI workflow tool that connects to your tools, understands your code and accelerates your workflows.
With the Gemini CLI you can:
Prerequisites: Ensure you have Node.js version 20 or higher installed.
Run the CLI: Execute the following command in your terminal:
npx https://github.com/google-gemini/gemini-cli
Or install it with:
npm install -g @google/gemini-cli
gemini
Pick a color theme
Authenticate: When prompted, sign in with your personal Google account. This will grant you up to 60 model requests per minute and 1,000 model requests per day using Gemini.
You are now ready to use the Gemini CLI!
The Gemini API provides a free tier with 100 requests per day using Gemini 2.5 Pro, control over which model you use, and access to higher rate limits (with a paid plan):
Generate a key from Google AI Studio.
Set it as an environment variable in your terminal. Replace YOUR_API_KEY with your generated key.
export GEMINI_API_KEY="YOUR_API_KEY"
(Optionally) Upgrade your Gemini API project to a paid plan on the API key page (will automatically unlock Tier 1 rate limits)
The Vertex AI API provides a free tier using express mode for Gemini 2.5 Pro, control over which model you use, and access to higher rate limits with a billing account:
Generate a key from Google Cloud.
Set it as an environment variable in your terminal. Replace YOUR_API_KEY with your generated key and set GOOGLE_GENAI_USE_VERTEXAI to true
export GOOGLE_API_KEY="YOUR_API_KEY"
export GOOGLE_GENAI_USE_VERTEXAI=true
(Optionally) Add a billing account on your project to get access to higher usage limits
For other authentication methods, including Google Workspace accounts, see the authentication guide.
Once the CLI is running, you can start interacting with Gemini from your shell.
You can start a project from a new directory:
cd new-project/
gemini
> Write me a Gemini Discord bot that answers questions using a FAQ.md file I will provide
Or work with an existing project:
git clone https://github.com/google-gemini/gemini-cli
cd gemini-cli
gemini
> Give me a summary of all of the changes that went in yesterday
Head over to the troubleshooting guide if you're having issues.
Start by cding into an existing or newly-cloned repository and running gemini.
> Describe the main pieces of this system's architecture.
> What security mechanisms are in place?
> Implement a first draft for GitHub issue #123.
> Help me migrate this codebase to the latest version of Java. Start with a plan.
Use MCP servers to integrate your local system tools with your enterprise collaboration suite.
> Make me a slide deck showing the git history from the last 7 days, grouped by feature and team member.
> Make a full-screen web app for a wall display to show our most interacted-with GitHub issues.
> Convert all the images in this directory to png, and rename them to use dates from the exif data.
> Organize my PDF invoices by month of expenditure.
Head over to the Uninstall guide for uninstallation instructions.
For details on the terms of service and privacy notice applicable to your use of Gemini CLI, see the Terms of Service and Privacy Notice.
FAQs
Gemini CLI Core
We found that @google-dev/gemini-cli-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.