Govern Google Antigravity with Agentic Control Plane

See, control, and price every tool call Antigravity makes — shell, file edits, browser actuation, MCP tools, subagents — from one dashboard, alongside your Claude Code, Codex, Cursor, and Grok Build sessions. Antigravity's hook vocabulary has a native ask; this hook puts your policy on that path.

TL;DR

curl -sf https://agenticcontrolplane.com/install.sh | bash

The installer detects Antigravity (the agy CLI or an existing ~/.gemini profile), drops the hook at ~/.acp/hooks/antigravity/hook.mjs, merges the registration into ~/.gemini/config/hooks.json (shared by the CLI, the IDE, and the app — merged under an acp key, never overwritten), and opens your browser once to provision a workspace into ~/.acp/credentials. The next Antigravity session is governed.

MIT-licensed, zero dependencies, one readable file — read it before you run it.

The ask that stays an ask

Antigravity is the first harness we’ve integrated whose hooks can hand a call to the human natively. When ACP policy answers ask, the hook returns force_ask — Antigravity renders its own approval card, and because force_ask deliberately ignores cached “Always Allow” grants, a local remembered approval can’t pre-empt a policy hold. (On Grok Build we document the opposite caveat — a local allow rule outranks an ACP ask. Here that gap doesn’t exist.)

Unattended, the same answer resolves correctly with no work on our side: headless Antigravity soft-denies unobtainable approvals itself, continuing the run with a stderr notice. The empty chair answers “no” natively.

What’s on the wire

Tool names. Antigravity’s native names (run_command, view_file, replace_file_content, …) are mapped to the canonical vocabulary before the policy check so content floors fire on input shape, with the native name preserved in the audit record as client_tool_name. Unknown and MCP tool names pass through.

Failure posture

Antigravity’s hook core is fail-closed: a crashed, timed-out, or non-zero-exiting hook blocks the tool call. That’s the right default for a policy path — and it means a hook must never let an upstream outage become its own crash. This hook always answers in JSON with exit 0 and carries its own posture: gateway unreachable in an attended session fails open, loudly ([ACP] ⚠ UNGOVERNED plus a durable ~/.acp/lapse.log line — an ACP outage must never brick your session); unattended tiers fail closed. One retry on transport failure; an HTTP error status is the server answering and is never retried. The internal 4-second decision budget sits far below the registered 30-second timeout, so the answer always arrives before Antigravity’s error path.

One Antigravity-specific note: the hook environment is sanitized, so configuration rides in ~/.acp/config.json (snake_case keys), not env vars. Unattended fleets should pin "agent_tier": "background" there.

Manual install

mkdir -p ~/.acp/hooks/antigravity ~/.gemini/config
curl -fsSL https://raw.githubusercontent.com/agentic-control-plane/antigravity-acp-plugin/main/hook.mjs \
  -o ~/.acp/hooks/antigravity/hook.mjs
# Merge the registration (never overwrite — hooks.json is shared):
curl -fsSL https://raw.githubusercontent.com/agentic-control-plane/antigravity-acp-plugin/main/hooks/acp.json \
  -o /tmp/acp-agy-hooks.json
node -e 'const fs=require("fs");const p=process.env.HOME+"/.gemini/config/hooks.json";let cur={};try{cur=JSON.parse(fs.readFileSync(p,"utf8"))}catch{};const add=JSON.parse(fs.readFileSync("/tmp/acp-agy-hooks.json","utf8"));fs.writeFileSync(p,JSON.stringify({...cur,...add},null,2))'

Credentials live at ~/.acp/credentials (the installer provisions them; or paste a workspace key from cloud.agenticcontrolplane.com). Check registration inside Antigravity with /hooks.

Verified vs. pending

Live-verified end to end on agy 1.1.21 (2026-08-26): the hook fires in real turns before the native permission layer; run_command’s payload key is CommandLine, normalized to the canonical shape — the production hardline floor denied a recursive root delete under the native tool name; headless soft-deny and the session receipt behave as documented.

One verified limit to plan around: --dangerously-skip-permissions bypasses the hook layer entirely — this hook (and any other) is simply not invoked under the flag, unlike Claude Code and Grok Build. Scoped permissions.allow rules, not the flag, are the right way to unblock headless runs; if you operate a fleet, treat the flag’s appearance as an alertable event. Still pending: force_ask rendering in the interactive TUI (offline-verified against the documented contract).

How Antigravity’s own controls work — the permissions engine, sandbox, headless posture, and the enterprise plane: the deep page.