ArmorGemini
Intent-based security enforcement for the Gemini CLI
ArmorGemini
ArmorGemini adds security enforcement to the Gemini CLI. Every tool call Gemini makes is checked against a declared intent plan and policy rules before execution.
One Command Setup
curl -fsSL https://armoriq.ai/install_armorgemini.sh | bashInstalls the hooks, merges the settings block into ~/.gemini/settings.json, copies /armor:* slash commands into ~/.gemini/commands/armor/, and installs the ArmorIQ CLI.
What It Does
When you prompt Gemini to do something, ArmorGemini:
- Makes Gemini declare its plan before any tool runs, Gemini registers what tools it intends to use
- Checks every tool call unplanned tools are blocked (intent drift)
- Enforces policy rules the ArmorIQ backend evaluates each call via
POST /iap/verify-step - Logs everything audit records flow to the ArmorIQ dashboard via
POST /iap/audit
Setup
ArmorGemini requires an ArmorIQ API key. Get one at armoriq.ai.
armoriq login --product armorgemini # OAuth, saves to ~/.armoriq/credentials.json
# or
export ARMORIQ_API_KEY=YOUR_ARMORIQ_API_KEYSee Configuration for the full key-resolution order.
How Gemini CLI Sees It
ArmorGemini wires four Gemini CLI lifecycle hooks into ~/.gemini/settings.json. The block the installer merges in looks like this:
{
"hooks": {
"SessionStart": [
{
"matcher": "*",
"hooks": [
{
"name": "armorgemini-session-start",
"type": "command",
"command": "node <install-dir>/scripts/hook-router.mjs session-start"
}
]
}
],
"BeforeTool": [
{
"matcher": "*",
"hooks": [
{
"name": "armorgemini-before-tool",
"type": "command",
"command": "node <install-dir>/scripts/hook-router.mjs before-tool"
}
]
}
],
"AfterTool": [
{
"matcher": "*",
"hooks": [
{
"name": "armorgemini-after-tool",
"type": "command",
"command": "node <install-dir>/scripts/hook-router.mjs after-tool"
}
]
}
],
"SessionEnd": [
{
"matcher": "*",
"hooks": [
{
"name": "armorgemini-session-end",
"type": "command",
"command": "node <install-dir>/scripts/hook-router.mjs session-end"
}
]
}
]
}
}The installer rewrites <install-dir> to the absolute path where ArmorGemini is checked out on your machine. This is standard Gemini CLI hook format: an event key, one matcher per entry, command-type hooks that receive the payload on stdin and return a JSON decision on stdout.
Requirements
- Gemini CLI (
geminion your PATH) - Node.js 20+
curl(preinstalled on every macOS + Linux)- macOS, Linux, or Windows with WSL or any bash-compatible shell