In Antigravity, there seems to be no search and list_directory tools. Therefore, the model compensates by running commands.
This results in a very annoying behavior, as you must approve every search, and there’s no way to let the agent search independently. The only workaround seem to be enabling YOLO mode and running the agent in a container.
Does someone know of any way to fix it?
I agree. Using Regex is also getting out of my hand.
allowing ‘cat’ or ‘Get-ChildItem’ individually doesn’t solve this problem because a piped terminal command is prompted for approval too.
So, you need to make a regex for allowed terminal commands, for all combinations of cat, Get-ChildItem, Get-Content, Select-Object.
But obviously regex:cat .* isn’t going to solve it because this allows cat ... ; rm / -rf
Yeah I could ‘simply’ ask AI to make a regex for it.
OR … AntiGravity could officially have toggleable useful regex, or have a list of ‘safe commands’ and ‘safe commands that can be piped’, etc and the users could just toggle them on and off.
Hi @Faheem_Anis1 and @I_hate_AIs,
Thank you both for the detailed feedback.
Here is why this happens on Windows and how you can fix it today without using “YOLO mode” (Always Proceed), external containers, or unsafe regexes:
1. Enable Built-in Proceed in Sandbox (No YOLO Mode or External Container Needed) On macOS and Linux, the Default preset runs commands inside the built-in sandbox automatically without prompting. On Windows, however, the Default preset has the sandbox turned off and sets Terminal Command Auto Execution to Require Review (Terminal Sandbox — Windows Docs).
Proceed in Sandbox.Get-ChildItem, cat, Get-Content, Select-String, and piped search commands to run automatically without prompts inside Antigravity’s built-in sandbox (which restricts writes to your workspace, blocks .env access, and blocks unauthorized network access by default), while commands that need to run outside the sandbox still ask for review.2. Why Piped & PowerShell Commands Prompt on Windows & How to Write a Safe Regex
Why individual Allow rules still prompt: Normally, Antigravity checks each part of a pipe (|) or chain individually. However, on Windows shells like PowerShell, commands or pipes whose syntax cannot be cleanly split into simple tokens disable prefix-matching and require matching the entire command line (Permissions — Windows Docs). That is also why the prompt card in PowerShell offers to allow the full command string rather than just the Get-ChildItem prefix.
How to allow read-only commands/pipes without allowing cat ... ; rm -rf /: If you prefer using Allow/Deny rules instead of the sandbox, avoid .* (which matches ; and & command chaining). Instead, use [^;&|]* to block ; and & while allowing safe read-only pipes:
command(regex:(Get-ChildItem|Get-Content|Select-String|cat) [^;&|]*(\|\s*(Select-Object|Where-Object|Select-String) [^;&|]*)*)
Use Deny rules as a safety net: Antigravity strictly enforces Deny > Ask > Allow (Precedence Rule). Adding destructive commands like command(rm -rf) and command( regex:.*(rm -rf|Remove-Item).* ) to your Deny list guarantees they are blocked even if an Allow rule matches.
As noted in the Windows Permissions documentation, the unified macOS/Linux permission system (where the sandbox is enabled by default) is coming to Windows in a future release.
The sandbox works, thank you
As you mentioned, I’ll prefer if a pre-built security preset allows sandboxed commands automatically
Update: The sandbox didn’t work
The Hello World test worked, but sandbox takes 20 minutes for a single command. I have disabled it and my problem is still unresolved
Hi @Faheem_Anis1 and @I_hate_AIs,
The 20-minute sandbox freeze you just experienced on Windows is an all-too-familiar pain point. When an agent is forced to spawn pwsh.exe with Get-ChildItem and Select-String just to locate a variable or inspect a folder, two structural bottlenecks occur:
Rather than fighting PowerShell permission regexes or resorting to dangerous “Always Proceed / YOLO” modes, there is an architectural pattern that completely eliminates permission prompt spam while executing in sub-millisecond RTT: registering read-only search tools via a lightweight local Model Context Protocol (MCP) server.
Because Antigravity treats registered MCP tools with read schemas as non-terminal operations, the agent executes symbol and file searches autonomously with zero confirmation prompts, while write and shell execution tools remain strictly gated under your human review.
+-------------------------------------------------------------------------+
| Antigravity Autonomous Agent Layer |
+-------------------------------------------------------------------------+
|
JSON-RPC 2.0 (stdio)
v
+-------------------------------------------------------------------------+
| Local Read-Only MCP Daemon |
| +--------------------------------+ +-------------------------------+ |
| | workbench_fast_search | | workbench_find_files | |
| | (ripgrep wrapper) | | (fd wrapper) | |
| +--------------------------------+ +-------------------------------+ |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------+
| Host Binaries (Sub-50ms) |
| rg.exe | fd.exe |
+-------------------------------------------------------------------------+
cat ...; rm -rf /), structured MCP schemas only accept rigid string parameters (query, path, glob). The agent literally has no shell mechanism to execute destructive payloads through the tool.If you want to set this up on your Windows workstation today, I published the full architectural specification and zero-dependency Node.js server implementation in this GitHub Gist:
RFC-001: Autonomous Developer Workbench & Performance Accelerators MCP
It takes under 3 minutes to drop the zero-dependency script into your local tools directory and register it in mcp_config.json. Once configured, your agent searches code independently and instantly without asking for approval.
While I understand your suggestion, would you prefer that a table you bought doesn’t come with legs, since you can just assemble and install them yourself?
Therefore, yes, I want Antigravity to come up with pre-built tools for search, read and delete
Yes, I’ll prefer if the sandbox mode actually worked and had a “Allow read-only” preset
@Faheem_Anis1 100% agreed—the “table without legs” analogy is spot on! Nobody wants to assemble flat-pack furniture just to search their own repository.
File and symbol traversal are fundamental primitives of any autonomous coding environment; they should be native, pre-compiled, and pre-gated out of the box so developers never have to think about them.
The local MCP wrapper is purely a pragmatic survival bridge so you aren’t blocked by 20-minute sandbox hangs while we wait for the Antigravity engineering team to ship those native legs.
Hopefully the product team takes note of this thread and delivers native read tools and a true “Allow read-only” preset in the next release.
Thank you. I shall use your MCP for now
Antigravity has improved a lot, but it still lags behind others in UX. Hopefully they improve the UX and make the agents more autonomous and safe in the long run