Antigravity CLI has a dangerously skip permissions flag.
Gemini CLI uses yolo mode.
Antigravity CLI (agy), which replaced Gemini CLI for Google AI Pro, Ultra and free accounts on 18 June 2026, accepts --dangerously-skip-permissions at launch. It bypasses every permission prompt for that session, file writes and shell commands included. Without the flag, the toolPermission preset decides, and request-review, the default, asks before write, shell and web tools. Gemini CLI has no such flag. Its unattended setting is --approval-mode=yolo, and the older --yolo is deprecated. Both take the human out. The safer pattern keeps a gate and moves it to your phone: Pushary hooks agy and Gemini CLI and holds the risky calls until you answer.
Updated
The flag
agy --dangerously-skip-permissionsAuto-approves every tool permission request for the session, file writes and shell commands included. Gemini CLI's equivalent is gemini --approval-mode=yolo.
Featured on Hacker NewsWhat the flag actually does
In agy, --dangerously-skip-permissions is a launch-time override. It auto-approves all tool permission requests until you restart the session, and the settings menu shows where the override came from. The lasting version is the toolPermission preset, which you change with /config (alias /settings) or in ~/.gemini/antigravity-cli/settings.json. request-review asks before write, shell and web tools; strict asks before every tool that is not a read; proceed-in-sandbox runs sandboxed commands without asking; always-proceed never asks. /permissions is a different control: it manages allow, ask and deny rules. agy has no --yolo flag, and --mode=accept-edits auto-approves file edits only. In Gemini CLI, --approval-mode=yolo approves every tool call, and Ctrl+Y toggles it mid-session. Its four modes run from plan, which is read-only, through default and auto_edit to yolo. Gemini turns its sandbox on in yolo mode by default, but a sandbox only isolates. It does not bring back the approval you removed.
Why people use it, and the real risk
With every tool call auto-approved, agy or Gemini runs destructive shell commands and file changes without pausing, so one bad plan step runs immediately. Prompt injection is the sharp edge: a repo file, an issue or a fetched page can carry instructions that become auto-approved tool calls, and nobody is asked. agy's own docs warn that the flag approves file writes and command execution, and suggest scoped allow rules instead. There is no per-command approval trail, because approvals are off wholesale, so after an incident you cannot point to a human decision. A sandbox narrows what the agent can reach, but tokens and workspace data inside it are still fair game.
Three ways to run an agent
Full bypass keeps the agent moving but drops the gate. Babysitting keeps the gate but pins you to the keyboard. A phone gate keeps both.
| Approach | Agent keeps moving | Destructive actions gated | Away from the keyboard | Audit trail |
|---|---|---|---|---|
| Full bypass (Antigravity CLI) | ||||
| Babysit the terminal | ||||
| Pushary phone gate |
The safer alternative
Keep a gate on the risky calls and move it to your phone. For agy, Pushary installs a PreToolUse hook and becomes the only gate. In request-review mode agy ignores a hook's allow, so an answer from your phone could not let a call through. Connecting therefore sets toolPermission to always-proceed if you never chose a mode, and disconnecting puts it back. A call nobody answers is blocked, unless your rule approves on timeout. For Gemini CLI, stay in default or auto_edit mode and let the hook push the risky calls. The safe calls run unattended, and each risky one waits for a yes or no from your lock screen, with the answer recorded.
Antigravity CLI skip permissions questions
Does Antigravity CLI (agy) have --dangerously-skip-permissions?
Yes. agy accepts --dangerously-skip-permissions at launch, which bypasses every tool permission prompt for that session. Without the flag, the toolPermission setting decides: request-review, the default, asks before write, shell and web tools; strict asks before every tool that is not a read; proceed-in-sandbox runs sandboxed commands without asking; always-proceed never asks. Change it with /config inside agy. /permissions manages the allow, ask and deny rules instead. Pushary installs hooks for agy, and approving from your phone needs always-proceed or the flag, because agy ignores a hook's allow in its other modes. Pushary is then the only gate, and a call nobody answers is blocked unless your rule approves on timeout.
Does agy have a --yolo flag?
No. agy's unattended switch is --dangerously-skip-permissions. The setting that does the same for every session is toolPermission set to always-proceed. --mode=accept-edits is the narrower option: it auto-approves file edits and creations, and shell commands still follow your permission rules.
How do I stop agy asking for permission on every command?
Add allow rules with /permissions for the commands you trust, such as command(git). Anything without a rule asks by default, so only the commands you allowed stop prompting. Rules are checked deny first, then ask, then allow, so a broad ask rule such as command(*) would override your allows. If you want no prompts at all, set toolPermission to always-proceed with /config, or start agy with --dangerously-skip-permissions. That removes the human, which is where a phone gate helps: Pushary keeps asking about the risky calls, on your phone instead of your terminal.
Does Gemini CLI have --dangerously-skip-permissions?
No. Claude Code and Antigravity CLI have it; Gemini CLI does not. The Gemini equivalent is --approval-mode=yolo, or the deprecated --yolo (short form -y), which auto-approves every tool call for the session; Ctrl+Y toggles it while a session is running. Gemini has four approval modes where Claude Code has a single on-off flag: default prompts on every tool call, auto_edit auto-approves edit tools but still prompts for the rest, yolo approves everything, and plan is read-only. auto_edit is usually the mode people reach for yolo to get.
How do I enable YOLO mode in Gemini CLI?
Start it with gemini --approval-mode=yolo to auto-approve all tool calls. The older --yolo flag still works but is deprecated. Inside a running session you can toggle yolo with Ctrl+Y. This removes every confirmation, so it belongs only in disposable or sandboxed environments. If you want automation without giving up the human check, keep default or auto_edit mode and route risky calls to your phone with Pushary.
How do I make Gemini CLI auto-approve all commands?
The auto-approve setting is yolo, reached with --approval-mode=yolo or the deprecated --yolo flag, which approves file edits and shell commands with no prompt. A middle option is auto_edit, which auto-approves edits but still asks before other tools run. Better yet, keep approvals on for anything destructive and have Pushary deliver those approvals to your phone, blocking until you answer and logging the result.
Can I still use Gemini CLI?
Through a Gemini Code Assist Standard or Enterprise licence, or a paid Gemini API key, yes. On 18 June 2026 Google stopped serving Gemini CLI and the Code Assist IDE extensions to Google AI Pro, Ultra and free accounts and moved those users to Antigravity CLI. If you still run Gemini CLI, yolo and the other approval modes on this page apply, and Pushary's hooks gate its shell commands, writes and edits.
Is Gemini CLI --yolo safe to run unattended?
Only in an isolated or throwaway environment like a CI container or VM, never on a system with sensitive data or live credentials, because yolo mode executes injected or destructive commands with no human able to intervene. For everyday unattended runs, keep default or auto_edit approval and add a Pushary policy that pushes the risky decisions to your phone and keeps an audit trail of what was approved.
Run Antigravity CLI unattended without skipping every permission.
Keep the agent moving, gate the risky calls, approve from your phone. Set up in two minutes.
Start your trial$9.99/mo after a 3-day free trial. Cancel anytime.