Gemini CLI excludeTools examples: block shell commands and tools
To hide a whole built-in tool, list it in tools.exclude in .gemini/settings.json. To hide tools from one MCP server, use excludeTools on that server's entry. To block specific shell commands like rm -rf, current docs say to use a Policy Engine rule; run_shell_command(...) entries in tools.exclude still work but are deprecated for that.
Stats from the 2026-10-20 snapshot of public GitHub configs (methodology). Behavior checked against the official docs linked below.
Hide whole tools
{
"tools": {
"exclude": [
"web_fetch",
"google_web_search"
]
}
}Hide tools from an MCP server
{
"mcpServers": {
"github": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-github"
],
"excludeTools": [
"delete_repository",
"push_files"
]
}
}
}Block shell commands (Policy Engine)
Put .toml files in ~/.gemini/policies/. All of them are loaded and combined, and the highest-priority matching rule decides.
# ~/.gemini/policies/deny.toml
[[rule]]
toolName = "run_shell_command"
commandPrefix = "rm -rf"
decision = "deny"
priority = 100
[[rule]]
toolName = "run_shell_command"
commandPrefix = "git push"
decision = "deny"
priority = 100The older way (deprecated for commands)
Before the Policy Engine, the docs used run_shell_command(<prefix>) entries in tools.exclude. Matching is by prefix, chained commands (&&, ||, ;) are split and checked separately, and exclude wins over tools.core. Very old configs used a flat top-level excludeTools key; current docs only use excludeTools inside an MCP server entry.
{
"tools": {
"core": [
"run_shell_command"
],
"exclude": [
"run_shell_command(rm)"
]
}
}Allowlist instead
tools.core lists the only built-in tools the CLI may use. Setting it to anything turns off every built-in tool you don't list, including read_file and write_file, so list those too. A prefix blocklist can miss variants and scripts that call the blocked command, so pair it with --sandbox for real isolation.
What public configs do
Of 85 unique public Gemini CLI configs that set any permission keys, 17 (20%) exclude something and 36 (42.4%) turn on YOLO or auto-accept. The sample is small. Separately, 3.4% of 1,377 unique Gemini settings files contain a credential-looking value.
FAQ
Does exclude override core?
Yes. Per the shell tool docs, tools.exclude is checked first, so a prefix in both lists is blocked.
Is tools.exclude deprecated?
Only for blocking shell commands; the docs point to the Policy Engine for that. tools.exclude is still a documented setting for removing tools from discovery.
Does exclude apply in YOLO mode?
Excluded tools aren't offered to the model, so YOLO can't approve them. Still, use a sandbox if you run YOLO. Admins can also set security.disableYoloMode.