netrise-firewall
Routes package installs (pip/uv/pipx/npm/pnpm/yarn/cargo) through the netrise install-time firewall to block malicious packages.
Open source Open in the app JSON README (API)
About
Routes package installs (pip/uv/pipx/npm/pnpm/yarn/cargo) through the netrise install-time firewall to block malicious packages.
Details
- Kind
- Plugins
- Topic
- Developer tools
- Publisher
- netriseinc
- Origin
- gemini
- Category
- ferramentas
- Version
- 0.1.0
- Last push
- 2026-07-22T18:26:43Z
- Repository state
- ativo
- Added
- 2026-08-30 14:13:39
- Updated
- 2026-08-30 14:13:39
- Origin id
netriseinc/netrise-firewall-gemini-extension
README
# NetRise Package Firewall — Gemini CLI extension
A Gemini CLI extension that routes every package install an agent runs
(pip / uv / pipx / npm / pnpm / yarn / cargo) through `netrise firewall`, so
malicious packages are blocked at install time.
It registers a **`BeforeTool`** hook on `run_shell_command` that calls
`netrise hook gemini`: the binary inspects the command, transparently rewrites
simple installs to run through the firewall, and denies unsafe ones. Same
decision engine as the Claude Code plugin — no shell script, no `jq`.
## Prerequisites
1. **`netrise` binary** with **Gemini hook support** (`netrise hook gemini`) on
PATH. Download the build for your OS/arch from
https://github.com/NetRiseInc/provenance/tree/main/releases, then:
```bash
chmod +x netrise
sudo mv netrise /usr/local/bin
# macOS only: clear the Gatekeeper quarantine on the downloaded binary
xattr -d com.apple.quarantine /usr/local/bin/netrise
netrise hook gemini --help # must succeed — if it errors on `gemini`,
# your netrise is too old for Gemini support
```
2. **Credentials in your environment** (the extension ships the hook, not
secrets). Put these in your shell profile so Gemini CLI inherits them:
```bash
export NETRISE_API_URL=https://provenance.netrise.io
export NETRISE_API_KEY=<your key> # must match the endpoint
```
## Install
```bash
gemini extensions install git@gitlab.com:netrise/provenance/netrise-firewall-gemini-plugin.git
```
Restart Gemini CLI. Confirm the extension is loaded with `gemini extensions list`.
For local development:
```bash
gemini extensions link /path/to/netrise-firewall-gemini-plugin
```
> `gemini extensions install` accepts a git repo or a local path, so the GitLab
> SSH URL works (requires GitLab SSH access). Use `gemini extensions link` above
> for local development.
## Verify
Ask Gemini to run `pip install requests` → it executes as
`netrise firewall -- pip install requests --no-cache-dir`. A known-bad package
fails with a `403` + `block: <ID>` footer.
## What the hook does
| command | action |
|--|--|
| simple `pip`/`uv`/`npm`/`yarn`/`pnpm`/`cargo` install | rewritten through `netrise firewall` (+ registry flags, cache bypass) |
| non-install (`ls`, `git`, `pip list`, `cargo build`) | untouched |
| install only mentioned in a quoted arg | untouched |
| compound / piped / env-prefixed / sudo install | denied, asks to run standalone |
| `go` installs | untouched (not covered by netrise yet) |
## How it maps to Gemini's hook protocol
`netrise hook gemini` reads the `BeforeTool` event on stdin (`run_shell_command`'s
`tool_input.command`) and emits Gemini's decision JSON:
- rewrite → `{"decision":"allow","hookSpecificOutput":{"tool_input":{"command":"…"}}}`
- deny → `{"decision":"deny","reason":"…"}`
- pass-through → `{"decision":"allow"}`
Exits 0 on every decision (Gemini parses stdout as JSON on exit 0).