Skip to content

CYBO Attest in the Gemini CLI

Before you start

Connecting CYBO Attest to the Gemini CLI takes about a minute. You need:

  • An Attest account. Create one at attest.ulapcybo.app first; your free trial starts at registration.
  • The Gemini CLI installed and signed in, with a Google account or a Gemini API key. Attest was tested with an API key; the Attest sign in is separate from the Gemini sign in and works the same either way.

The connection details, in case you are asked for them:

Item Value
Server type Remote MCP server, HTTP transport
Server URL https://attest.ulapcybo.app/mcp
Suggested name cybo_attest
Sign in OAuth, with your Attest account
Config file ~/.gemini/settings.json for you, .gemini/settings.json in a repo for a project

Add the server

From your shell, not inside a Gemini session:

gemini mcp add --transport http --scope user cybo_attest https://attest.ulapcybo.app/mcp

Leave off --scope user to add it to the current project only, which writes .gemini/settings.json in that directory. Commit that file to share Attest with everyone on the repo; it only carries the URL, and each person signs in with their own Attest account.

No other settings edit is needed. The entry the command writes looks like this, if you prefer to add it by hand:

{
  "mcpServers": {
    "cybo_attest": {
      "httpUrl": "https://attest.ulapcybo.app/mcp"
    }
  }
}

Sign in and try it

  1. Start a session with gemini and type /mcp. Attest is listed and needs authentication.
  2. Type /mcp auth cybo_attest. Your browser opens to the Attest sign in page. Log in with your Attest account, approve the consent screen, and return to the terminal. /mcp now shows the server connected with its tools.
  3. Ask: Who am I in CYBO Attest? It answers with your name and organization, which confirms the sign in.
  4. Ask: What is the security posture of my applications?

The Gemini CLI asks before each tool call. Choose allow once for the read tools until you are comfortable, then allow always; keep answering per call for tools that change something (starting a scan, submitting a justification).

Useful next prompts, from inside a project directory:

  • Explain the first finding and tell me which file in this repo it applies to
  • Get the Attest fix plan for this app and work through it, one commit per fix
  • I pushed the fix. Scan the latest code of [app], follow it, and tell me which findings are gone and which remain
  • Draft a justification for finding [id]; we do not ship that component

Good to know

The rescan is how a fix gets proven. Once the fix is on the default branch, ask the agent to scan the latest code. Attest pulls the newest commits, rebuilds the container, and runs the scans; the agent follows the build and then lists the findings on the new scan, so you see what closed and what is left. Asking to start a scan without new code re runs the scans on the build Attest already has, which is for when a justification or configuration changed, not the code.

Same record as every other client. The findings, fix plans, and justifications the Gemini CLI works are the same ones the console and the other agents see. Writes carry your name and the client that made them.

The agent cannot approve. Approving or rejecting a build stays in the Attest console with a named person. No Gemini tool can do it.

Keep write tools out of unattended runs. If you script the CLI, allow only the read tools it needs. See Connecting an AI agent for the permissions model.

If something goes wrong

Symptom Fix
/mcp does not list cybo_attest You added it at project scope from a different directory. Re run the add command with --scope user, or run gemini from that project
Listed but disconnected, needs authentication Expected before first sign in. Run /mcp auth cybo_attest
/mcp auth opens the browser but the terminal never updates Keep the tab open until the terminal confirms; if it never does, run /mcp auth cybo_attest again
Sign in page says invalid scopes or unknown client Run gemini mcp remove cybo_attest, add it again, and sign in; that registers a fresh client. If it repeats, send the exact text to Ulap support
Tools return 401 or 403 Your session expired or your Attest role lacks access to that application. Run /mcp auth cybo_attest again and check your role in Attest
The agent uses another tool instead of Attest Say "use Attest" in the prompt

Still stuck? Contact Ulap support with the exact error text and a screenshot.