termalGoogle’s Gemini CLI is a capable agent in a terminal, and like the other coding agents it eventually needs to leave your laptop and touch a real server — restart a service, tail a log, run the deploy on the box itself. The tempting shortcut is to let it run ssh directly: the CLI already executes shell commands, so if a key sits unlocked in ~/.ssh or a running ssh-agent, ssh prod works for it whether or not you meant to grant that. That’s the whole problem in one line — you gave away full server access by default.
Gemini CLI has a cleaner path built in: it speaks MCP, the same protocol Claude Code, Cursor and Codex use. Termalin is an SSH client with a built-in MCP server, so you point Gemini at that server and it works your hosts for real — while the agent never holds a key. About twenty minutes, one host.
What you need
- Termalin — the desktop app; the Free tier is fine. Its built-in MCP server is what Gemini talks to.
- Gemini CLI, on the same machine.
- One host saved in Termalin — something low-stakes for the first run.
Step 1 — turn on agent access and set a policy
Agent access is off by default. In Termalin, open Settings → MCP, enable it, and tick the hosts Gemini may reach. Nothing outside that list exists as far as the agent is concerned — a new host is a decision you make in the app, not something the agent can talk its way into.
Under the hood, Termalin writes a host inventory for the MCP server with agent-only auth entries — no passwords or keys land in that file — and authentication stays with the app’s key custodian: you unlock once, and Termalin signs on the agent’s behalf. There’s no key file for Gemini to read, so there’s nothing to leak, and the ~/.ssh back door above closes with it.
While you’re there, set each host’s agent policy: full access, an allowlist of commands, or blocked. Start with an allowlist for anything you care about — the least-privilege setup is its own short post.
Step 2 — register the server in Gemini’s settings
Gemini CLI reads MCP servers from the mcpServers object in its settings file — ~/.gemini/settings.json for all your projects, or a project-local .gemini/settings.json. Add one entry pointing at the bundled termalin-mcp binary:
{
"mcpServers": {
"termalin": {
"command": "<path>/termalin-mcp"
}
}
}That’s the whole integration. Restart Gemini CLI (or reload its MCP servers), and the tools appear to the agent: hosts_list, ssh_exec, persistent sessions (session_open / session_exec), SFTP reads and writes, and port forwards. Run /mcp in Gemini to confirm the server is connected and see the tools it exposes.
If you’d rather not wire MCP at all, there’s a lighter option: Termalin has a local terminal tab, so you can just type gemini and run the CLI right inside the app next to your SSH sessions. That gives you Gemini in the same window — but it’s the MCP setup above that lets Gemini act on your servers through the custodian, which is the part that keeps your keys out of its reach.
Step 3 — give it a real chore
Skip the demo. Hand it something real:
The deploy to staging-1 finished but the health check keeps flapping. Find out why and fix it.
Gemini calls hosts_list, sees staging-1, opens a session, and starts pulling threads — service status, the last hundred log lines, the config diff against what’s running. It proposes a fix, applies it within the policy you set, and confirms the check goes green.
What makes this comfortable rather than nerve-wracking is that none of it is hidden. Every session Gemini opens shows up in Termalin as a live terminal tab, and the watch grid puts all open sessions side by side with the agent-driven tiles glowing. You watch the commands land as they run, and you can step in at any point.
Where the boundaries are
Defaults worth knowing before you point it at anything that matters:
- Your keys never enter Gemini’s environment. The custodian signs; the agent requests. Revoking access is a toggle in Settings, not a key rotation across your fleet.
- Its reach is the host list you ticked in Step 1, and each host’s command policy bounds what it can run there. “Full” on production is still a full shell — set it deliberately.
- Typing into your session is separate. By default Gemini opens its own sessions; joining one you already have open is its own consent toggle, and on Pro.
- Every command is on the record. Recordings capture output only — never keystrokes — and each agent command is tagged as the agent’s in the audit log, with the device and IP it came from.
When Gemini runs in the cloud
If Gemini is running where your desktop isn’t — a CI job, a cloud sandbox — the local binary isn’t reachable, but Termalin’s hosted MCP endpoint is. Mint an API key in the web cabinet, scope it to the right servers, set it read-only or to an allowlist, give it an expiry, and point the agent at https://termal.in/api/v1/mcp. It reaches your Connector-enrolled servers keyless, authenticating each run with a short-lived certificate — the full CI/CD pattern is here.
The habit that makes it stick
Treat the first week like onboarding a fast teammate. Keep the watch grid open, give Gemini chores with a clear done-state, and read how it gets there before widening anything. The trade is the point: Gemini gets real reach on your servers, and you keep the one thing — the keys — that can’t be handed back once it’s out.
Termalin is a cross-platform SSH client with a built-in MCP server, a key custodian and per-host agent policy — download it, read the MCP reference, or see how it handles keys.