Gemini Code Assist

Real-time inline completions, chat and refactoring across IDEs; no real-time issue detection documented.

No MCP-based guardrail hook for third-party AI agents; Code Assist is an MCP client, not a guardrail server.

Gemini CLI runs agentic tasks in the terminal; no pre-commit hook or local review command documented.

gemini-code-assist bot auto-added as reviewer; comments on modified code with committable inline suggestions.

No status check or required check blocking merges documented; PR review only posts comments.

PR review analyzes diffs only; Code Customization indexes repos for completion context, not scanning.

run-gemini-cli GitHub Action workflows support cron schedules; no native scheduled security/code rescan.

No DAST, WAF, or live/production monitoring documented anywhere in the product's feature table.

PR review flags injection, CSRF, IDOR, input-validation and insecure-storage issues in changed code.

Security extension covers injection categories via diff-scoped LLM analysis; no cross-file dataflow engine described.

First-party Gemini CLI Security extension flags hardcoded credentials and keys in diffs.

Extension detects hardcoded secrets by pattern; no live validation of whether a secret still works.

Optional extension's /security:scan-deps runs OSV-Scanner against declared deps for known CVEs.

OSV-Scanner reports known CVEs in declared deps only; no call-path/reachability analysis documented.

Dependency scan covers known CVEs only; no typosquat or malicious-package detection documented.

Dependency-scan section covers only known vulnerabilities; no license identification or policy documented.

No CycloneDX/SPDX export documented in the Security extension or Code Assist docs.

Documented vulnerability categories omit Terraform/CloudFormation/K8s/Dockerfile misconfiguration.

No container image or base-image CVE scanning documented anywhere in the product.

No live cloud config/posture scanning documented; Cloud Assist covers ops, not CSPM.

Security extension analyzes static code changes only; no running-app or API exercising documented.

Maintainability review category covers readability, modularity, naming, documentation, magic numbers, inconsistent formatting.

"Complex code" is named as a maintainability review target; no cyclomatic or tracked metric documented.

Code duplication named as a maintainability review concern; no duplication metric or detector documented.

Maintainability targets (naming, comments, duplication, magic numbers) never mention dead/unreachable code.

"Testing" is a listed Miscellaneous review topic; no coverage ingestion, report, or percentage documented.

No new-code or changed-lines coverage gate documented anywhere in Gemini Code Assist docs.

"Modularity and reusability" is qualitative commentary; no module-boundary enforcement documented.

Findings are severity-tagged PR comments; no time/cost remediation quantification documented.

No git-history hotspot, change-coupling, or bus-factor analytics documented.

Correctness review category covers logic errors, edge cases, race conditions and incorrect API usage.

Auto-generated natural-language PR summary on open, plus on-demand '/gemini summary'.

Natural-language styleguide.md in .gemini/, per repository or managed across repos from Cloud console.

Inline code suggestions in PR reviews that can be committed directly from GitHub.

Not offered in vendor documentation reviewed as of 2026-09-05.

Severity threshold, max-comment cap and ignore_patterns tune noise; no false-positive triage documented.

Multiple separate repositories can be selected as chat context; scanning or configuring multiple packages within a single repository is not documented.

PR reviews, chat and completions all run on Gemini foundation models with automatic model selection.

Buyer can supply their own Gemini API key for the CLI; Gemini models only.

Agent Mode and Gemini CLI consume local and remote MCP servers; no MCP server exposing review findings.

No AI-generated-code governance; built-in telemetry tracks adoption and usage events instead.

Ask clarifying follow-up questions on Gemini's review in PR comments; /gemini slash commands.

memory_config enables persistent per-repository memory; feedback forms collected, no documented review-tuning loop.

Google does not use customer data to train models without permission; service stateless, no prompt storage by default.

Optional Cloud Logging bucket can store inputs and responses; no dedicated admin audit log documented.

Cloud Identity or Google Workspace accounts with support for externally federated identity providers and 2-step verification.

IAM-based access control built on least privilege; roles recommended at developer-group level.

Not offered in vendor documentation reviewed as of 2026-09-05.