llm-cli-gateway

Overview Schema Source Related Servers Discussions Admin

gemini_request_async

Destructive

Start a Google Antigravity CLI request as a durable background job, then poll for status and retrieve the result through the gateway's job tools.

Instructions

Start a Google Antigravity CLI (agy) request as a durable background job through the Gemini-compatible gateway tool. Poll with llm_job_status, collect with llm_job_result.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`yolo`	No	Emit `--dangerously-skip-permissions` to auto-approve all actions.
`model`	No	Model name or alias passed to agy --model (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest)
`prompt`	No	Prompt text for Antigravity CLI (mutually exclusive with promptParts)
`project`	No	Antigravity 1.0.13 --project <ID>: select the project for this session. Mutually exclusive with newProject.
`sandbox`	No	Run Antigravity in sandbox mode (--sandbox)
`worktree`	No	Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller supply a sanitized name and/or a git ref (default: HEAD). When the request carries a sessionId and the session already has a worktree, reuse requires same-host ownership metadata and a matching live Git registration. Named path collisions never reuse manager state. Gateway-managed worktrees work with file-backed and PostgreSQL session managers. Shared PostgreSQL rows do not transfer filesystem ownership; reuse and cleanup remain limited to the owning host. The Grok, Devin, and Mistral adapters require an explicit provider-native sessionId; fresh, createNewSession, and resumeLatest-only worktree requests fail closed because they cannot durably reselect the worktree. The request must select a registered workspace explicitly, through caller-owned session metadata, or through the configured default. Worktrees never fall back to the gateway process cwd and cannot be combined with local workingDir, addDir, or includeDirs paths. The gateway spawns the child CLI with `cwd: <worktree-path>`; no `-w`/`--worktree` flag is ever emitted to the underlying CLI. On worktree materialization, the gateway suppresses repository, system, and global Git hooks and configured clean, smudge, and process checkout filters, sparse checkout, and lazy object fetching. Filter-dependent content such as Git LFS remains in its repository representation instead of executing host commands. On session_delete, session_clear_all or file-backed TTL eviction, both managers hide a durably owned worktree session while cleanup runs. Failed Git removal retains a cleanup-pending tombstone, blocks reuse, and is retried when a manager is registered on the owning host; the record is finalized only once Git no longer registers the worktree, which is read back rather than inferred from the recorded path being absent. A worktree that moved, or whose owner marker cannot be read, is not a removal. Deletion processed by another host removes no worktree and leaves the owning host's record intact. The database-side cleanup_expired_sessions function stages the same tombstone instead of deleting a worktree-bearing session; it invokes no gateway observer and so attempts no removal itself. A tombstone is not bounded by retention. Successful responses are prefixed with `[gateway] worktree=<absolute-path>\n` so callers can use the path. For Claude approvalStrategy:mcp_managed, requesting or reusing a worktree requires approval and LLM_GATEWAY_APPROVAL_ALLOW_BYPASS=1. Other adapters reject mcp_managed before launch. NOTE: callers should `.gitignore` the `.worktrees/` directory in their repo (the gateway does NOT auto-gitignore; see slice λ spec Q4).
`sessionId`	No	Antigravity conversation ID to resume (emits --conversation <id>). agy owns conversation ids; a fresh request returns no resumable sessionId, continue via resumeLatest:true.
`skipTrust`	No	Unsupported for Antigravity CLI; true is rejected.
`workspace`	No	Registered workspace alias for remote HTTP/OAuth provider calls. Do not use this field, workspace_list, or workspace_register_existing_repo as a fallback for stdio/local provider path access; pass workingDir/addDir/includeDirs directly instead.
`mcpServers`	No	This provider does not receive gateway-managed MCP configuration. mcpServers has no effect with legacy, and mcp_managed is rejected before launch because ambient MCP configuration cannot be isolated.
`newProject`	No	Antigravity 1.0.13 --new-project: create a new project for this session. Mutually exclusive with project.
`workingDir`	No	Local Antigravity process working directory. Stdio/local callers may pass local paths directly. Remote HTTP/OAuth callers must use relative paths inside a selected registered workspace. Do not call workspace_* tools to fix stdio/local provider path access.
`attachments`	No	Unsupported for Antigravity CLI; non-empty values are rejected.
`includeDirs`	No	Additional workspace directories passed as --add-dir. Stdio/local callers may pass local paths directly. Remote HTTP/OAuth callers must use relative paths inside a selected registered workspace. Do not call workspace_* tools to fix stdio/local provider path access.
`policyFiles`	No	Unsupported for Antigravity CLI; non-empty values are rejected.
`promptParts`	No	Cache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking.
`allowedTools`	No	Unsupported for Antigravity CLI; non-empty values are rejected
`approvalMode`	No	Approval mode for legacy strategy: default leaves agy prompted, auto_edit emits --mode accept-edits, plan emits --mode plan, and yolo emits --dangerously-skip-permissions.
`forceRefresh`	No	Bypass dedup and force a fresh CLI run even if a recent identical request exists
`outputFormat`	No	Output format (text\|json\|stream-json), default text. stream-json is the only agy wire that carries the working directory, the tool list, per-tool parameters and per-step token usage; text carries none of them, so per-request usage and cost are unavailable on the default.	text
`printTimeout`	No	Antigravity --print-timeout <DURATION>: print-mode wait timeout as a Go duration string (e.g. '5m0s', '30s').
`resumeLatest`	No	Continue the most recent conversation. agy owns conversation ids; a fresh request returns no resumable sessionId, continue via resumeLatest:true.
`correlationId`	No	Request trace ID (auto if omitted)
`idleTimeoutMs`	No	Total-runtime bound, not an idle timer: this provider emits no output until it exits, so the child is killed after this duration even while healthy. Min 30s, max 1h, omit=1h default.
`providerFlags`	No	Flags passed to the provider binary verbatim, keyed exactly as the binary spells them (e.g. {"--best-of-n": "3", "--verbatim": true, "--rules": ["a", "b"]}). Use this for any flag your installed CLI accepts that this schema does not name: the binary decides what it supports, not the gateway. true emits the flag alone; a list REPEATS the flag once per item (pass a joined string if your CLI wants a comma-separated value). Values may not start with '-', and a flag the gateway is already emitting for this request is refused rather than duplicated. LOCAL stdio callers only: remote HTTP/OAuth callers are refused every flag here and should use this tool's declared parameters, which carry their own host-path and approval gates.
`approvalPolicy`	No	approvalPolicy is unavailable for this provider. It has no effect with legacy, and mcp_managed is rejected before launch because ambient MCP configuration cannot be isolated.
`optimizePrompt`	No	Optimize prompt before execution
`adminPolicyFiles`	No	Unsupported for Antigravity CLI; non-empty values are rejected.
`approvalStrategy`	No	Approval strategy: legacy is supported. mcp_managed is rejected before launch because this adapter cannot isolate ambient MCP configuration.	legacy
`compressResponse`	No	Compress the response display text when collected via llm_job_result (native compressor; default: [compression].enabled).
`createNewSession`	No	Force new session

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv3.2.1Sep 9, 2026

changedInput schema / properties / worktree / description

Previous value: -"Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller supply a sanitized name and/or a git ref (default: HEAD). When the request carries a sessionId and the session already has a worktree, reuse requires same-host ownership metadata and a matching live Git registration. Named path collisions never reuse manager state. Gateway-managed worktrees require the local file-backed session manager and fail closed with PostgreSQL sessions. The Grok, Devin, and Mistral adapters require an explicit provider-native sessionId; fresh, createNewSession, and resumeLatest-only worktree requests fail closed because they cannot durably reselect the worktree. The request must select a registered workspace explicitly, through caller-owned session metadata, or through the configured default. Worktrees never fall back to the gateway process cwd and cannot be combined with local workingDir, addDir, or includeDirs paths. The gateway spawns the child CLI with `cwd: <worktree-path>`; no `-w`/`--worktree` flag is ever emitted to the underlying CLI. On worktree materialization, the gateway suppresses repository, system, and global Git hooks and configured clean, smudge, and process checkout filters, sparse checkout, and lazy object fetching. Filter-dependent content such as Git LFS remains in its repository representation instead of executing host commands. On session_delete or TTL eviction the gateway hides the session and runs `git worktree remove --force`. Failed removal retains a durable cleanup-pending tombstone which blocks reuse and is retried when the file store is registered on the owning host. The tombstone is finalized only after verified Git removal. Successful responses are prefixed with `[gateway] worktree=<absolute-path>\\n` so callers can use the path. For Claude approvalStrategy:mcp_managed, requesting or reusing a worktree requires approval and LLM_GATEWAY_APPROVAL_ALLOW_BYPASS=1. Other adapters reject mcp_managed before launch. NOTE: callers should `.gitignore` the `.worktrees/` directory in their repo (the gateway does NOT auto-gitignore; see slice λ spec Q4)."New value: +"Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller supply a sanitized name and/or a git ref (default: HEAD). When the request carries a sessionId and the session already has a worktree, reuse requires same-host ownership metadata and a matching live Git registration. Named path collisions never reuse manager state. Gateway-managed worktrees work with file-backed and PostgreSQL session managers. Shared PostgreSQL rows do not transfer filesystem ownership; reuse and cleanup remain limited to the owning host. The Grok, Devin, and Mistral adapters require an explicit provider-native sessionId; fresh, createNewSession, and resumeLatest-only worktree requests fail closed because they cannot durably reselect the worktree. The request must select a registered workspace explicitly, through caller-owned session metadata, or through the configured default. Worktrees never fall back to the gateway process cwd and cannot be combined with local workingDir, addDir, or includeDirs paths. The gateway spawns the child CLI with `cwd: <worktree-path>`; no `-w`/`--worktree` flag is ever emitted to the underlying CLI. On worktree materialization, the gateway suppresses repository, system, and global Git hooks and configured clean, smudge, and process checkout filters, sparse checkout, and lazy object fetching. Filter-dependent content such as Git LFS remains in its repository representation instead of executing host commands. On session_delete, session_clear_all or file-backed TTL eviction, both managers hide a durably owned worktree session while cleanup runs. Failed Git removal retains a cleanup-pending tombstone, blocks reuse, and is retried when a manager is registered on the owning host; the record is finalized only once Git no longer registers the worktree, which is read back rather than inferred from the recorded path being absent. A worktree that moved, or whose owner marker cannot be read, is not a removal. Deletion processed by another host removes no worktree and leaves the owning host's record intact. The database-side cleanup_expired_sessions function stages the same tombstone instead of deleting a worktree-bearing session; it invokes no gateway observer and so attempts no removal itself. A tombstone is not bounded by retention. Successful responses are prefixed with `[gateway] worktree=<absolute-path>\\n` so callers can use the path. For Claude approvalStrategy:mcp_managed, requesting or reusing a worktree requires approval and LLM_GATEWAY_APPROVAL_ALLOW_BYPASS=1. Other adapters reject mcp_managed before launch. NOTE: callers should `.gitignore` the `.worktrees/` directory in their repo (the gateway does NOT auto-gitignore; see slice λ spec Q4)."

Addedv3.2.0Sep 5, 2026
Removedv3.0.0Jul 18, 2026
First observedv2.16.0Jul 10, 2026

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide destructiveHint=true and readOnlyHint=false, so the description is not responsible for the basic mutation signal. It adds the durable-background-job behavior and the poll/collect workflow, which is useful. However, it does not elaborate on the execution model, side-effect scope, failure behavior, or why the operation is considered destructive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: the first sentence states the action, resource, and mode; the second provides the retrieval workflow. The most decision-relevant information is front-loaded, and nothing is repeated from the schema or tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 31-parameter, no-output-schema, destructively-annotated tool, the description is somewhat sparse. It explains how to launch the job and where to get results, but it does not describe what happens while the job runs, when to prefer this over the sync variant, or what side effects the underlying CLI may trigger. The schema compensates for parameter meaning, but operational context is thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema carries the full semantic load for all 31 parameters, including unsupported-parameter rejections and mutual exclusions. The description adds no parameter guidance, but the baseline of 3 is appropriate because the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Start'), a specific resource ('Google Antigravity CLI (`agy`) request'), and the key mode ('durable background job'). It also clarifies the async lifecycle by pointing to llm_job_status and llm_job_result, which distinguishes it from the synchronous gemini_request sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this for background/durable async execution, then poll with llm_job_status and collect with llm_job_result. It does not explicitly state when not to use it or compare it to gemini_request, but the async/durable framing makes the intended usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

gemini_request_async

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools