Nothing to hand? Load the
— a legacy flat-key settings file with autoAccept on, sandboxing off, a
run_shell_command(*) wildcard, a trusted unpinned MCP server, a token written out
in full, a plaintext telemetry collector that logs prompts, a rambling GEMINI.md and a command
that drops {{args}} into a shell block — or the
,
where the correct verdict is production-ready and the useful output is what to improve next.
Paste the setup — the prescan is free
No upload, no AI: the prescan splits your paste on # file: markers, parses each
JSON file for real (and if it only parses once comments and trailing commas are stripped, it
says so), reads command TOML key by key, and measures your GEMINI.md. Then it lists what it
found — every setting, MCP server, context file, command and tool — and the flags:
literal credentials, autoAccept / yolo, servers marked
trust: true, unpinned npx and :latest launches,
plaintext http:// endpoints, shell wildcards, no tool allow-list at all,
sandbox and checkpointing off, logPrompts, every
deprecated flat key with the nested key it moved to, unknown keys that are silently ignored,
includeDirectories and @ imports that reach outside the project, a
bloated or heading-less context file, unenforceable instructions, and
{{args}} inside a !{...} shell block. Each group explains why it
matters. This part costs nothing and happens while you type — and you can copy or
download the whole prescan as Markdown without an account or a balance, so it can go
straight into a pull request thread or a ticket even if you never run the review.
The AI reviews it — this is the metered part
A senior platform engineer's pass over the whole configuration: a posture with the single most important change named, the inventory with each item's role, and prioritized findings across safety, correctness, context quality, tooling, cost and hygiene — each with the problem, the concrete impact, the fix and a corrected fragment. Every prescan flag is confirmed or explicitly set aside, and findings may only cite settings, servers and commands that actually appear in your files. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.
Take the corrected file, then re-check for free
The headline output is a whole settings.json, hardened and migrated off the
deprecated flat keys, validated as JSON in your browser and downloadable as a file you can
drop straight into .gemini/ — and Check the hardened file
puts that corrected file straight back through the free prescan, so you can see whether it
really clears the flags it claims to before you commit it to a repo your whole team shares.
Alongside it: every corrected fragment in one
paste-ready block, the findings as PR review comments with ```suggestion fences,
a tickable checklist for the ticket, the findings as CSV, and Markdown or JSON export of the
whole review. Then start fixing: the prescan re-runs as you edit and the strip above the run
button counts the flags you have cleared, the ones still open and any you have just
introduced — in the browser, for free, before you pay for a second review. Reviews are
saved to your SkillSafe account when you are signed in, so they follow you to another
machine; restore puts the config back in the form too.
Derived from the @google-gemini/gemini-cli skill (Apache-2.0). Not affiliated with Google.