# Gemini CLI with an X-API-Key header: PASS (on the second run, after a server fix)

Run date: 2026-10-12 (UTC). Endpoint: `https://api.sbx.agent-next.com/mcp/v1`. Client: `gemini` 0.62.0, preinstalled in the default template, fresh sandbox per run. Model: GLM 5.3 through the gateway's Gemini-compatible endpoint (`GOOGLE_GEMINI_BASE_URL`, `GEMINI_API_KEY`, `--yolo`). The key was read in-process and never printed or logged.
Setup text: the live [For agents page](https://sbx.agent-next.com/docs/agents/#client-gemini-cli), Gemini CLI section.

## What the first run found

- Gemini CLI adds a boolean `wait_for_previous` argument to follow-up tool calls. The gateway rejected it as an unknown field (`-32602`), so the tool call failed and the model retried. Fixed in the gateway before the second run: the hint is ignored, other unknown fields and non-boolean values are still rejected.
- `gemini mcp list` shows the server as `Disabled` in a folder Gemini does not trust. With `GEMINI_CLI_TRUST_WORKSPACE=true` it shows `Connected`. The page now says so.
- `gemini mcp remove sandbox` looks in the project settings first; `--scope user` removes the entry the page added. The page now says so.

## Flow (second run, fixed gateway)

| step | result |
| --- | --- |
| `gemini mcp add ... --scope user` from the page | PASS |
| `gemini mcp list` with the trust variable | PASS: `Connected` |
| session A: create, `echo ok; exit 3`, write and read `/tmp/hello.txt`, `ls -l /tmp`, `python3 -m http.server 8000` in the background, preview URL, no kill | PASS: exit code 3 and `ok`; file content `hi`; an external fetch of the preview URL returned HTTP 200; an independent MCP read returned `hi`; PID 1 is `tini`, 0 zombies |
| session B: `sandbox_kill` twice | PASS: `killed: true`, then `already_gone: true`; the preview URL then returned 502 |

## Residue (zero)

- The key's sandbox list was 0 at the end.
- After `gemini mcp remove --scope user sandbox`, a scan of the home directory, `/tmp` and `/dev/shm` for the key found nothing except the test harness's own key file, which went away when the sandbox was destroyed. Without `--scope user` the key stayed in `$HOME/.gemini/settings.json`.