Gemini CLI is open source, and that changes the trust math
Most coding agents ask for a strange deal: run a black box with shell access to your machine and your source, and take the vendor's word for what it does. Gemini CLI is the outlier among the big-vendor agents. The harness is Apache-2.0 on GitHub: the agent loop, the system prompts, the tool definitions, the approval logic, all of it readable. Code quality isn't the question here. What changes is how much you have to take on faith.
What you can actually read
Open source gets thrown around loosely, so be precise about what's on the table here. You can read the system prompt that frames every session, not a leaked screenshot but the source of truth. You can read every tool definition: what the shell tool will execute, how file edits are diffed and confirmed, what exactly leaves your machine on a web fetch. You can read the approval logic that decides when you get asked versus when the agent just acts. If you're the engineer who signs off on letting an agent loose inside a corporate network, that's the difference between auditing and believing: you can trace the path from keystroke to API call and enumerate the request surface, instead of reverse-engineering it from marketing docs.
Openness also changes how the tool evolves under you. Bugs live in a public issue tracker, fixes arrive as reviewable diffs, and behavior changes show up in the commit log instead of shipping silently inside an opaque update. When an agent that runs shell commands changes its behavior, I want a diff to point at. A security team re-reviewing a release wants exactly the same thing.
Forks are the proof
The real test of an open license is whether someone can take the code somewhere the vendor never intended. That test has been run: Qwen Code forked Gemini CLI and swapped in Qwen's models, prompts and tooling adapted to match. Whatever you make of the result, it proves the harness genuinely separates from the model. If Google's direction or terms ever stop working for you, the exit isn't hypothetical. Someone already walked through the door.
There's a quieter payoff for builders. If you're writing your own agent, this is one of the few production-grade harnesses you can study line by line: how context gets assembled and trimmed, how tool schemas are shaped, how confirmation flows are wired, and how a shipping product handles the boring failure paths that toy examples skip.
An open harness doesn't make the model trustworthy — it makes every claim about the harness checkable.
Open harness, closed model
Now the caveat that keeps the trust math honest. The weights are closed and inference runs on Google's servers. Your prompts, your code context, and your tool outputs still leave the machine; the license covers the pipe, not the brain. You can verify what gets sent, but not what happens past the API boundary, and you can't self-host your way out. Reading the source shrinks the surface you take on faith. It doesn't eliminate it. Anyone selling this as full sovereignty is overselling it.
If your organization vets agent tooling (and it should), an open harness turns a vendor-trust conversation into an ordinary engineering review, which is a materially easier sell. My rule: prefer agents you can read, price in the model you can't, and treat fork-ability as the insurance policy you hope never to claim.