Terminal AI Coding Agents Cheatsheet: Claude Code, Gemini CLI, Codex CLI

Three months ago, a coding agent in your terminal was still a novelty. Now there are three serious ones from the three big model labs. OpenAI open-sourced Codex CLI on April 16. Anthropic made Claude Code generally available on May 22, together with Claude 4. Google released Gemini CLI, also open source, on June 25.

They look alike from a distance: you type a task, the agent reads your repo, edits files, runs commands and asks before doing anything risky. The differences are in the details that matter day to day: which file holds the project instructions, what "auto" mode actually allows, whether commands run in a real sandbox, how you call it from CI, and who pays for the tokens.

This cheatsheet puts those details side by side, as of mid-July 2025. All three tools ship new versions several times a week, so treat flags as a snapshot and check --help before you script against them.

1. The three tools at a glance

2. Install and authenticate

# Claude Code
npm install -g @anthropic-ai/claude-code
claude                      # first run: log in with a Claude subscription or an Anthropic API key

# Gemini CLI
npm install -g @google/gemini-cli     # or: npx https://github.com/google-gemini/gemini-cli
gemini                      # first run: sign in with a personal Google account, or set GEMINI_API_KEY

# Codex CLI
npm install -g @openai/codex          # or: brew install codex
export OPENAI_API_KEY="sk-..."        # or: codex login (paid ChatGPT plans)
codex

Authentication options, which also decide the cost model (section 8):

Platform notes: Codex CLI targets macOS and Linux and needs WSL2 on Windows. Claude Code added native Windows support (with Git for Windows) in v1.0.51 on July 11. Gemini CLI needs Node.js 20 or newer.

3. Instruction files: CLAUDE.md, GEMINI.md, AGENTS.md

All three load a Markdown file of project instructions into context at startup. Same idea, three names, slightly different rules.

What to put in it, whichever tool you use:

# Project notes for coding agents

## Commands
- Install: uv sync
- Test: uv run pytest -q
- Lint and format: uv run ruff check --fix . && uv run ruff format .

## Conventions
- Python 3.12, type hints on all public functions
- No new dependencies without asking
- Database migrations live in migrations/; never edit an applied migration

## Do not touch
- infra/ (managed by Terraform, changes go through review)
- .env files

Practical tips:

• Keep it short and factual. Build, test and lint commands, conventions, and no-go zones. It is loaded on every session, so every line costs tokens.
• One source of truth for mixed teams. Write AGENTS.md, point Gemini CLI at it with "contextFileName": "AGENTS.md", and for Claude Code keep a one-line CLAUDE.md that imports it: @AGENTS.md.

4. Permission and sandbox modes

This is where the tools differ most. Two separate questions: when does the agent ask you, and what can a command do if you do not stop it.

Claude Code: permission rules

Fine-grained rules live in settings.json (manage them with /permissions):

{
  "permissions": {
    "allow": ["Bash(uv run pytest:*)", "Bash(git diff:*)", "Edit"],
    "deny": ["Bash(rm:*)", "Bash(curl:*)", "Read(./.env)"]
  }
}

Settings layer from ~/.claude/settings.json (user) to .claude/settings.json (shared, committed) to .claude/settings.local.json (personal, git-ignored). There is no OS-level sandbox: once a command is allowed, it runs with your user's permissions.

Gemini CLI: approvals plus optional sandbox

Codex CLI: approval policy and sandbox policy

Codex separates the two questions into two settings:

The sandbox is enforced by the OS: Apple Seatbelt (sandbox-exec) on macOS 12+, Landlock and seccomp on Linux. In workspace-write, the working directory is writable and network access is disabled. In Docker, Landlock may not be available; the README recommends securing the container yourself and then using --sandbox danger-full-access inside it.

Codex also strips environment variables whose names contain KEY, SECRET or TOKEN from the subprocess environment by default (shell_environment_policy).

Which is safest out of the box?

Whatever the tool, the rule is the same: the more autonomy you give, the more the environment must do the containing. YOLO modes belong in containers, not on your laptop with production credentials in ~/.aws.

5. MCP: adding tools

All three are MCP clients, so the same servers (GitHub, Postgres, Playwright, internal APIs) work everywhere. Only the config syntax differs.

# Claude Code: CLI wizard, or commit a project-scoped .mcp.json
claude mcp add github -- npx -y @modelcontextprotocol/server-github

// Gemini CLI: .gemini/settings.json
{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_TOKEN" }
    }
  }
}

# Codex CLI: ~/.codex/config.toml (note: mcp_servers, not mcpServers)
[mcp_servers.github]
command = "npx"
args = ["-y", "@modelcontextprotocol/server-github"]
env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "..." }

Notes:

• Claude Code has the broadest transport support right now: stdio, SSE and streamable HTTP, with OAuth for remote servers (v1.0.27, June 17). Project scope (.mcp.json) lets a team share servers through the repo.
• Codex CLI can also run as an MCP server (codex mcp), marked experimental, so another agent can call Codex as a tool.
• Every MCP server is code you run with your permissions and text the model reads. Install only servers you trust, and treat their output as untrusted input.

6. Hooks: deterministic guardrails (Claude Code)

Instructions in CLAUDE.md are suggestions; the model can forget them. Hooks are shell commands Claude Code runs at fixed points, so they always happen. Released in v1.0.38 on June 30, 2025, with events including PreToolUse, PostToolUse, Stop, SubagentStop and PreCompact.

Format after every edit:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write|MultiEdit",
        "hooks": [{ "type": "command", "command": "uv run ruff format ." }]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "python3 .claude/hooks/guard_bash.py" }]
      }
    ]
  }
}

A PreToolUse hook receives the tool call as JSON on stdin. Exit code 2 blocks the call and sends stderr back to the model as the reason:

#!/usr/bin/env python3
"""Block dangerous shell commands before Claude Code runs them."""
import json
import re
import sys

BLOCKED = [
    r"\brm\s+-rf\s+/",          # rm -rf on absolute paths
    r"\bgit\s+push\b.*--force",  # force pushes
    r"\bcurl\b.*\|\s*(ba)?sh",   # curl | sh
    r"\.env\b",                  # touching env files
]

event = json.load(sys.stdin)
command = event.get("tool_input", {}).get("command", "")

for pattern in BLOCKED:
    if re.search(pattern, command):
        print(f"Blocked by policy: matches {pattern!r}", file=sys.stderr)
        sys.exit(2)  # 2 = block and tell the model why

sys.exit(0)

Gemini CLI and Codex CLI have no equivalent hook system yet. The closest substitutes are their sandboxes and, for Gemini, coreTools allow lists.

7. Headless and CI use

All three can run without a TUI, which is how you use them in scripts, cron jobs and pipelines.

A CI job that summarizes a PR diff with Claude Code, read-only:

- name: AI review of the diff
  run: |
    npm install -g @anthropic-ai/claude-code
    git diff origin/main...HEAD > diff.txt
    claude -p "Review diff.txt for bugs and missing tests. Be concise." \
      --allowedTools "Read" --output-format json > review.json
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Codex's README shows the same pattern with codex exec --full-auto "update CHANGELOG for next release" as a GitHub Actions step.

CI rules of thumb: read-only by default, scoped API keys with spending limits, a timeout on the job, and a human review of anything the agent wants to merge.

8. Cost model

None of them is "free" in the same way. What you pay depends on how you log in.

9. When to use which

Why this matters

• The agent is only as safe as its environment. Permission prompts are a UX feature; sandboxes and containers are a security feature. Know which one you are relying on.
• Instruction files are the new onboarding doc. A good AGENTS.md or CLAUDE.md helps every agent and every new hire.
• MCP makes tools portable. Invest in MCP servers, not in one vendor's plugin format.
• Headless mode turns agents into building blocks. Code review, changelogs and test triage in CI are where many teams see the first durable value.
• Cost depends on how you log in. The same task can be free, flat-rate or metered, depending on the account.

Final Thoughts

The three tools are converging fast: all read a Markdown instruction file, all speak MCP, all have an "ask me" mode and a "just do it" mode, and all can run headless. The real choice in July 2025 is about defaults: Claude Code for control and hooks, Gemini CLI for price and context size, Codex CLI for its sandbox and open Rust core.

Pick one, write a short instruction file, commit before every session, and decide in advance where autonomous mode is allowed to run. Those habits will carry over to whichever agent wins next quarter.

Sources

• Anthropic, Introducing Claude 4 (May 22, 2025): Claude Code generally available, VS Code and JetBrains integrations, GitHub Actions, Claude Code SDK.
• Anthropic, Claude Code changelog: Pro plan support (v1.0.11), Python and TypeScript SDKs (v1.0.23), streamable HTTP and OAuth for MCP (v1.0.27), hooks released (v1.0.38, June 30, 2025), Stop/SubagentStop split (v1.0.41), PreCompact hook (v1.0.48), native Windows (v1.0.51), .mcp.json project scope, --output-format stream-json, # memory shortcut, CLAUDE.md imports. Release dates from the npm registry.
• Anthropic, Claude Code hooks documentation: hook events, matchers, exit code 2 blocking.
• Google, Gemini CLI: your open-source AI agent (June 25, 2025): Apache 2.0, Gemini 2.5 Pro, 1M-token context, 60 requests per minute and 1,000 per day free, MCP, GEMINI.md.
• Google, Gemini CLI repository and its configuration docs (July 2025 versions): install, auth options and API key free tier, contextFileName, coreTools/excludeTools, sandbox (Seatbelt, Docker, Podman), --yolo, -p, checkpointing, mcpServers.
• TechCrunch, OpenAI debuts Codex CLI, an open source coding tool for terminals (April 16, 2025): launch, o3 and o4-mini, open source.
• OpenAI, Codex CLI repository (README and codex-rs/config.md as of July 14, 2025): install, codex login, approval and sandbox policies, --full-auto, Seatbelt and Landlock/seccomp, codex exec, AGENTS.md lookup order, mcp_servers, codex mcp, default model codex-mini-latest, environment variable filtering, CI example, custom providers such as Ollama.
• DevClass, OpenAI rewrites AI coding tool in Rust (June 2, 2025): Rust rewrite of Codex CLI.