Codex CLI vs Claude Code vs Gemini CLI: Install, Permissions, Context Files and Pricing

If you only have an evening to pick a terminal coding agent, the choice mostly comes down to four boring questions: how it installs, what it is allowed to do without asking, which file it reads for your project rules, and which account pays for it. Codex CLI, Claude Code and Gemini CLI answer those four differently, and one of the three changed more than the others this year.

I read each vendor's own docs on 2026-10-08 and wrote down what they say. I did not benchmark these tools, and I did not run all three end to end, so there are no speed or quality claims below. Where a page was unclear or contradicted another page, I say so. Prices and plan names move; treat the numbers as a dated snapshot and click through before paying.

If you are choosing between agent-in-the-editor products instead, see Claude Code vs Cursor vs GitHub Copilot and the India-focused INR cost breakdown. This post is about the three terminal agents.

What changed with Gemini CLI in 2026?

Short version: if you were planning around Gemini CLI's free tier, re-check first.

Google's developer blog post "An important update: Transitioning Gemini CLI to Antigravity CLI" (dated 19 May 2026) says Antigravity CLI is available to everyone from that day. It also says that on 18 June 2026, Gemini CLI and the Gemini Code Assist IDE extensions stop serving requests for Google AI Pro and Ultra subscribers and for Gemini Code Assist for individuals. Organizations with a Gemini Code Assist Standard or Enterprise license keep access, and Gemini CLI "will remain accessible via paid Gemini and Gemini Enterprise Agent Platform API keys". The post also warns there is no 1:1 feature parity at launch.

The geminicli.com banner puts it in plainer terms: "Unpaid tier and Google One users: Gemini CLI was replaced by Antigravity CLI on June 18th, 2026."

Here is the catch. The Gemini CLI GitHub README I fetched the same day still advertises sign-in with Google at 60 requests per minute and 1,000 requests per day. That conflicts with the announcement, so I would not plan around it. Treat the README as stale until Google says otherwise.

So in practice there are now two Google options:

• Gemini CLI (public repository on GitHub) with a paid API key, Vertex AI, or an organization license.
• Antigravity CLI (agy), the successor for individuals. Google's migration page says context files GEMINI.md and AGENTS.md need no changes, and Gemini extensions convert with agy plugin import gemini.

The rest of this post covers both Google tools under one column where the docs agree, and calls out the difference where they do not.

How do you install each one?

All commands below are copied from the vendors' pages on 2026-10-08.

Two details worth knowing. Claude Code's native installer updates itself in the background, while Homebrew, WinGet and Linux package-manager installs do not, and the docs tell you to run the upgrade command yourself. And because piping a script from the internet into a shell is exactly the habit the security section below warns about, the Claude Code docs publish a signed manifest and a GPG fingerprint you can check if you want to verify a binary.

What can each one do without asking you?

This is the question that decides whether the tool is safe on your laptop. The three use different vocabulary for the same idea: a dial between "ask for everything" and "ask for nothing", plus an optional operating-system sandbox.

Claude Code has six permission modes in its docs: default (labeled Manual, asks on first use of each tool), acceptEdits, plan, auto (a background classifier reviews actions instead of you), dontAsk and bypassPermissions. On top of the modes sits a rule language in settings.json: allow, ask and deny lists with patterns like Bash(npm run *), evaluated deny first, then ask, then allow. The docs state that these rules are enforced by Claude Code, not by the model, so text in your prompt or CLAUDE.md does not change what is allowed. A separate Bash sandbox is off by default; you turn it on with /sandbox. It uses Seatbelt on macOS and bubblewrap on Linux and WSL2, and native Windows runs commands unsandboxed. The security page also says that in this release auto mode is the starting mode for interactive terminal sessions, so look at /permissions rather than assuming Manual.

Codex CLI exposes two settings. sandbox_mode takes read-only, workspace-write or danger-full-access. approval_policy takes on-request or never (untrusted is listed as retired). The documented lower-risk local preset is workspace-write with on-request; you can set them in config.toml or with --sandbox workspace-write --ask-for-approval on-request, and /permissions opens a picker in a session. Sandboxing uses Seatbelt on macOS, bubblewrap on Linux and WSL2 (you must install it), and a native sandbox on Windows. The sandboxing page I read did not state the default network setting for workspace-write, so check that yourself before relying on it.

Gemini CLI documents several sandbox methods: macOS Seatbelt (default profile permissive-open, which confines writes to the project directory but allows broad reads and network), Docker or Podman, a native Windows sandbox, gVisor and LXC. You enable it with -s or --sandbox, the GEMINI_SANDBOX environment variable, or "sandbox": true under tools in settings.json. Its CLI reference lists --approval-mode with the choices default, auto_edit, yolo and plan (default: default), but gives no per-value description on that page, so check gemini --help before relying on what each does.

Antigravity CLI uses permissions lists in ~/.gemini/antigravity-cli/settings.json with the form action(target), for example command(git) under allow and command(sudo) under deny. Conflicts resolve deny, then ask, then allow. Workspace files are auto-allowed; commands, MCP calls and non-workspace files default to ask. Its sandbox uses kernel namespaces on Linux and Seatbelt on macOS, and the docs say sandboxed commands run without network by default. In the CLI, enableTerminalSandbox defaults to false, so turning it on is your job. One inconsistency: the sandbox page shows both agy and an antigravity --sandbox flag; I did not run either, so confirm the flag on your install.

Do not read this as "one is safest." Whichever you pick, a sandbox that covers only shell commands leaves file tools, MCP servers and hooks outside it. Claude Code's docs say so explicitly for its own sandbox. The sandbox and permissions post in this series covers what to layer on top.

Which context file does each tool read?

Codex stops adding files once the combined size reaches project_doc_max_bytes, 32 KiB by default. Claude Code's docs recommend keeping each CLAUDE.md under about 200 lines. If you maintain one repo for several tools, the full pattern is in AGENTS.md vs CLAUDE.md vs .cursorrules.

What does each one cost?

Read on 2026-10-08, USD, list prices:

Two honest caveats. OpenAI's page warns not to use API token prices to estimate how many tasks a subscription includes, because plan limits are separate. And "included in every plan" does not tell you how many tasks the free tier covers. I did not find a number, so test with your own work before you plan a month around it. If you are paying in rupees, the extra currency conversion and card fees matter more than the sticker price; the earlier India cost comparison does that math for the editor tools.

Which one should you pick?

This is my read of the documentation, not a performance ranking. Run your own task on each before deciding.

If you cannot decide, install two and give both the same small, reversible task on a throwaway branch: add a failing test, then fix it. Watch what each asks permission for. That ten-minute experiment tells you more than any comparison table, including this one. For the Claude Code side in depth, the Claude Code track walks through setup and permissions.

What I could not verify

• I did not run Codex CLI or Gemini CLI. Everything above is from their documentation pages.
• OpenAI's old developers.openai.com URLs now redirect to learn.chatgpt.com; I used the redirected pages.
• What each Gemini CLI approval mode does, and its default network behavior outside macOS Seatbelt, were not on pages I could fetch.
• Antigravity CLI's install page for sign-in steps returned 404 on one path; I used the getting-started page instead.
• No benchmark, speed, or code-quality comparison is made or implied.