Gemini CLI v0.61.0: restricted mode, sandbox isolation, and hardened MCP OAuth#
Part of the Gemini CLI Version Tracker series. | Gemini CLI on GitHub | Releases
Between v0.53.1 and v0.61.0, Gemini CLI's eight stable releases went almost entirely into security: a restricted mode that fails workspace trust closed and filters out MCP servers, Cloud Workstations OAuth support, hardened MCP OAuth with SSRF blocking and RFC 9207 issuer checks, and tighter sandbox and extension isolation.[1] No new production model IDs landed in the window.
New environment variables#
Two configuration literals appear that were not in the v0.53.1 surface, each tied to a change named in the release notes.
| Variable | What It Does |
|---|---|
GEMINI_RESTRICTED_MODE | Restricted-mode flag. In restricted mode, workspace trust is fail-closed and configured MCP servers are filtered out of an untrusted workspace rather than being loaded (v0.59.0).[2] |
GOOGLE_CLOUD_WORKSTATIONS | Marks a Cloud Workstations environment so the OAuth flow resolves its proxy redirect URI dynamically for that host (v0.57.0).[3] |
The other new literals in the source are test fixtures (GEMINI_CLI_KEY, GEMINI_CLI_SAFE_VAR_TO_EXPAND), not user knobs.
The security surface did most of the moving#
Almost every release in this range carries a fix(core), fix(sandbox), fix(extensions), or fix(a2a-server) with a security framing. The MCP client picked up two protocol-level guards: SSRF is blocked in MCP OAuth metadata discovery and authentication (v0.59.0), and the OAuth flow now enforces RFC 9207 issuer identification (v0.60.0).[4] Web fetch added destination validation and connection routing checks (v0.60.0).
The sandbox tightened repeatedly. The macOS Seatbelt profile now isolates Docker and container-runtime sockets and binaries (v0.58.0), the temporary directory and the settings directory are isolated per sandbox container (v0.60.0), and v0.61.0 hardens filesystem boundaries and isolates runtime state further. Extensions gained a matching set of guards: path resolution and boundary validation in the extension loader (v0.60.0), a consent prompt before environment changes, and sanitization of runtime-altering environment variables an extension tries to set (v0.60.0). A hardcoded Google CrUX API key was removed from the bundled chrome-devtools-mcp (v0.60.0), and untrusted tool outputs now carry envelope-metadata provenance (v0.60.0). Prompt-injection defense extended to build-file modifications and untrusted flags (v0.61.0).
On the model side, v0.61.0 preserves explicit versioned Flash model IDs rather than collapsing them to an alias.[5] The new gemini-* literals in the source are the test fixtures exercising that fix, not new model access.
Inside the release#
106 commits landed between the two tags, from 2026-07-23 to 2026-09-23, across 17 authors, holding the roughly weekly stable cadence (0.54 through 0.61). The release bot accounts for 25 of those commits. Two more authors drove repo automation rather than the shipped CLI: one contributed 18 commits under an "SSR Agent" issue-fixing batch and the Antigravity PR-generator runner, another 13 to the caretaker triage services (Cloud Run ingestion, egress, and an LLM triage worker). That leaves the product-facing security and reliability work concentrated in a small human core, four authors with 4 to 10 commits each, almost all in fix(core), fix(sandbox), and fix(extensions).
Almost all of the churn landed in packages/. Only one first-time external contributor appears across the entire window. For a repo that carries an open-source label, this stretch was an almost entirely internal effort.
What this tells us#
The direction is a CLI being hardened for running against code and services it does not trust. Restricted mode plus fail-closed workspace trust, MCP servers filtered out of untrusted workspaces, RFC 9207 and SSRF guards on the MCP OAuth path, per-container isolation of temp and settings directories, and extension env-var consent all point at the same posture: assume the workspace, the tool output, and the extension could be hostile, and gate accordingly.
The Cloud Workstations OAuth support and the system-config permission checks read as enterprise-deployment plumbing. Meanwhile the caretaker triage services and the SSR Agent issue-fixing batch show Google leaning on its own agents to keep a high-volume repo moving, which is where a large share of the commit count in this window actually went.
For anyone tracking Gemini CLI for new model access, this range is quiet. For anyone running it where the trust boundary matters, restricted mode and the MCP OAuth hardening are the changes to know.
Sources#
- [1] Gemini CLI releases (v0.54.0 to v0.61.0)
- [2] PR #29099: fail-closed workspace trust and filter mcpServers in restricted mode (v0.59.0)
- [3] PR #28688: resolve Cloud Workstations proxy redirect URI for OAuth (v0.57.0)
- [4] PR #29081: prevent SSRF in MCP OAuth metadata discovery (v0.59.0), PR #29117: enforce RFC 9207 issuer identification in MCP OAuth (v0.60.0)
- [5] PR #29252: preserve explicit versioned Flash model IDs (v0.61.0)
This analysis is based on publicly available open-source code and release metadata, conducted for educational and research purposes. All trademarks and software referenced belong to their respective owners.