Claude Code vs Codex vs Gemini CLI (and Antigravity CLI)

Part 4 of our series on AI coding CLIs. See also: Getting Started with Claude Code, Getting Started with OpenAI Codex CLI, and Getting Started with Google Gemini CLI.

Claude Code, OpenAI Codex CLI, and Google Gemini CLI are the three terminal-native AI coding assistants engineering teams have been comparing since 2025. They look similar on the surface: natural-language prompts, agentic file editing, MCP support. They differ on the things that matter under load: context window, permission model, sandboxing, CI/CD ergonomics, and who is actually allowed to use them. This head-to-head compares them on those axes, with notes on where each one breaks down in a real deployment workflow.

What changed in 2026 (updated November 2026): on June 18, 2026 Google moved free individual users and Google AI Pro / Ultra subscribers off Gemini CLI and onto Antigravity CLI (agy). Gemini CLI itself still exists, but it is now aimed at organisations on Gemini Code Assist Standard / Enterprise and paid API keys. If you were picking Gemini CLI for its free tier, read Does Gemini have a Codex equivalent? first. Model line-ups also moved on: Claude Code now runs Opus 5.5 / Sonnet 5.5, and Codex recommends the GPT-6 family.

If you only want the verdict, jump to Recommendations by Use Case. Everything in between is the receipts.

Quick Comparison Overview

Feature Comparison Matrix

For deeper coverage of the configuration-file conventions each CLI reads from, see our guide to CLAUDE.md, AGENTS.md, and copilot-instructions.md.

Does Gemini have a Codex equivalent?

Yes, but since June 2026 it is not Gemini CLI for most people. Google now splits its terminal tooling three ways:

• Antigravity CLI (agy): Google's interactive, multi-agent coding terminal and the closest analogue to Codex CLI or Claude Code for individuals. It is where free Google accounts and Google AI Pro / Ultra subscribers were moved on June 18, 2026, and it is the CLI Google recommends for Gemini 4-series models. It supports MCP, headless runs (agy -p), and asynchronous background agents. Unlike Gemini CLI, Google doesn't advertise an open-source licence for it.
• Gemini CLI (gemini): still maintained and open source (Apache 2.0), but positioned for organisations on Gemini Code Assist Standard / Enterprise, plus legacy paid API and Vertex AI keys.
• Jules: Google's autonomous coding agent that works on your GitHub repository asynchronously. Functionally it is the counterpart to Codex web (cloud tasks) rather than to the Codex CLI.

Migrating from Gemini CLI to Antigravity CLI is mostly painless for deployment-related setups, with two gotchas worth knowing before you switch a team over:

• Your GEMINI.md and AGENTS.md rule files carry over unchanged, and agy plugin import gemini converts legacy Gemini CLI extensions into Antigravity plugins. The installer also imports your skills, MCP configs, agent profiles and memory.
• MCP servers do not stay in settings.json. They move to mcp_config.json (~/.gemini/config/mcp_config.json globally, .agents/mcp_config.json per workspace), and remote servers use serverUrl instead of url / httpUrl. If your deploy-notification or database MCP server silently stops loading after the switch, this is why.
• Workspace skills in .gemini/skills/ must move to .agents/skills/ before they're recognised.
• Headless runs in CI need cached credentials. agy -p uses credentials from a prior interactive login (or an API key), and an unauthenticated CI run exits with authentication required rather than hanging. Plan for that before you swap gemini -p for agy -p in a pipeline.

The rest of this comparison covers Gemini CLI as it stands for Code Assist customers. Where Antigravity CLI behaves differently, we call it out.

Installation and Setup Comparison

All three tools install in one command, but authentication is where they diverge.

Claude Code

# Native installer (recommended, auto-updates) — macOS, Linux, WSL
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# Or Homebrew
brew install --cask claude-code

Authentication: a paid Claude subscription (Pro, Max, Ultra, Team, Enterprise) or an Anthropic Console / API key. Third-party providers (Amazon Bedrock, Google Cloud, Microsoft Foundry) are also supported.

Platform support: macOS, Linux, WSL, and native Windows. On native Windows the Bash sandbox isn't available, so run inside WSL2 if you want sandboxed shell commands.

For install requirements and a production-deploy walkthrough, see our Claude Code setup and deployment guide. For a one-page command reference — slash commands, hooks, MCP setup, and CI patterns — see the Claude Code cheatsheet.

OpenAI Codex CLI

# Standalone installer — macOS / Linux
curl -fsSL https://chatgpt.com/codex/install.sh | sh

# Or npm / Homebrew
npm install -g @openai/codex
brew install --cask codex

Authentication: sign in with a ChatGPT plan (Plus, Pro, Business, Edu, or Enterprise per the CLI README; Free and Go get limited Codex access) or use an API key.

Platform support: macOS, Linux, and Windows (native Windows sandbox in PowerShell, Linux sandbox under WSL2).

Google Gemini CLI

npm install -g @google/gemini-cli
# or
brew install gemini-cli

Authentication: Google account with a Gemini Code Assist Standard / Enterprise licence (set GOOGLE_CLOUD_PROJECT), a paid Gemini API key, or Vertex AI.

Platform support: macOS, Linux, Windows.

Winner for getting started: Codex CLI. Codex is included, in limited form, on every ChatGPT tier including Free, so most developers can try it without a new subscription (check that CLI sign-in works on your plan). Claude Code requires a paid Claude plan. Gemini CLI now requires an enterprise licence or a paid key; individuals should start with Antigravity CLI instead.

Context and Codebase Understanding

Bottom line: the context-window gap has closed. All three now offer windows in the 500K–1M range, so the real differentiator is how well each agent decides what to read, not how much it can hold.

How well each tool understands your codebase materially affects how often you have to babysit it.

Claude Code

Uses agentic search — the model decides which files to read instead of relying on you to paste paths. Opus 4.7 and later and Sonnet 5 / 5.5 run with a native 1M-token window, so the old 200K vs 1M argument no longer applies. Subagents can split large investigations (research, test runs) across parallel contexts.

Strengths:

• Strong project-structure inference
• Maintains style consistency across multi-file edits
• Auto memory saves learnings across sessions, on top of CLAUDE.md

OpenAI Codex CLI

Codex recommends the GPT-6 family: Astra for the most complex work, GPT-6.1 Sol as the balanced default-style choice (500K-token default context in Codex), Terra for fast, efficient work, and Luna for focused, repeatable tasks.

Strengths:

• Image input on the command line (-i screenshot.png)
• Model choice maps cleanly to task size and cost
• Good at following complex, multi-step instructions

Google Gemini CLI

Gemini 3.1 Pro accepts 1,048,576 input tokens, so Gemini CLI can still hold most of a monorepo at once. 3.1 Pro is opt-in via -m gemini-3.1-pro-preview; the CLI's Auto (Gemini 3) setting routes between Gemini 3 Pro and 3 Flash for you.

Strengths:

• Large context handles big repositories without manual chunking
• Built-in web search and fetch
• Fully auditable open-source harness

Context size used to be the headline difference. In late 2026 it's a tie at the top end: if you're hitting limits, the fix is usually better instruction files and narrower tasks, not a different vendor.

Deployment Workflow Capabilities

Bottom line: all three have first-class headless modes and a GitHub Action. Gemini CLI's run-gemini-cli action authenticates with an API key, Vertex AI or Code Assist rather than a personal Google login.

Creating Deployment Configurations

All three can generate deployment configs, but their defaults differ:

• Claude Code tends to ask clarifying questions and generate comprehensive configurations tailored to your setup. Plan mode (--permission-mode plan) lets you review the approach before anything is written.
• Codex CLI works inside its workspace-write sandbox by default in a Git repository, so it can draft and test configs locally without network access unless you enable it.
• Gemini CLI can check current documentation via web search while it writes. To see Gemini in a deployment pipeline, see our complete guide to deploying Gemini Search with DeployHQ.

CI/CD Integration

Codex CLI runs non-interactively via codex exec. OpenAI's docs recommend pinning the sandbox explicitly for unattended runs:

jobs:
  update_changelog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Update via Codex
        run: codex exec --sandbox workspace-write "Update CHANGELOG for next release"

For PR review bots, openai/codex-action wraps the CLI with a secure proxy to the API. The older --full-auto flag no longer appears in the current docs, and the untrusted approval policy has been retired — a stale config.toml with approval_policy = "untrusted" can stop Codex from starting at all. For a deeper walkthrough of flags and safe defaults, see our guide to running Codex exec safely from the terminal.

Claude Code runs headlessly via -p with an --allowedTools allow-list, and ships an official GitHub Action (anthropics/claude-code-action) that responds to @claude mentions or runs a prompt on any GitHub event:

claude -p "Write release notes for the last 10 commits" \
  --allowedTools "Bash(git log:*),Read,Write"

Gemini CLI enters headless mode with -p (or automatically in a non-TTY environment) and supports --output-format json. Use --approval-mode=yolo for fully unattended runs; the old --yolo flag is deprecated.

The deeper question is what happens when the agent fails inside a pipeline. All three have an approve everything escape hatch — Codex's --dangerously-bypass-approvals-and-sandbox (alias --yolo), Claude Code's --dangerously-skip-permissions, Gemini CLI's --approval-mode=yolo, and Antigravity's agy -p --dangerously-skip-permissions. Pair any of them with an isolated, disposable runner. We cover runner isolation, secret handling, and failure modes for each CLI in running AI coding agents in CI/CD in headless mode. Whichever CLI you pick, the generated config still has to ship somewhere, and that's where it feeds into your build pipeline configuration. If you're weighing a YAML-heavy CI setup against a dedicated deploy tool, our DeployHQ vs GitHub Actions comparison breaks down the trade-offs.

Git Workflow Automation

All three handle Git operations well:

# Claude Code
git log --oneline -n 10 | claude -p "Create release notes"

# Codex CLI
git log --oneline v1.0.0..HEAD | codex exec "Create release notes"

# Gemini CLI
git log --oneline -n 10 | gemini -p "Create release notes"

Note that in Codex -p means --profile, not prompt — use codex exec for one-shot prompts. For commit attribution, co-author trailers, and branch hygiene when an agent writes your commits, see our Claude Code Git guide.

Once your release notes are committed, automated Git deployments handle the rest — DeployHQ detects the push and deploys automatically. If you want the agent to trigger deploys directly from the terminal without leaving the conversation, see Drive DeployHQ from Cursor, Claude Code, and Windsurf.

Running these agents headlessly inside CI? The three CLIs each expose a non-interactive mode (claude -p, codex exec, gemini -p), but they diverge on how they handle approval bypass, runner permissions, and prompt-as-transcript secret leakage. Treat the in-CI behaviour as a separate evaluation from the interactive one — the model that wins your local terminal test isn't automatically the model that wins your runner.

How to Run Your Own Bake-off

Model versions change every few months, so any winner from a one-off test goes stale fast. The more durable approach is a repeatable bake-off on your own repository. Three tasks that expose the real differences in a deployment workflow:

Task 1: Write a production Dockerfile

Score each output on: multi-stage build, non-root user, a HEALTHCHECK, COPY ordering for layer caching, and a matching .dockerignore. Note whether the agent asked about your runtime version or guessed it.

Task 2: Create a CI workflow

Check for: dependency caching, separate lint / test / deploy jobs, pinned action versions, least-privilege permissions: on the job, and whether secrets are referenced via the runner rather than pasted into the prompt.

Task 3: Generate a deploy script (build → test → SSH to staging)

Check for: set -euo pipefail or equivalent error trapping, SSH connectivity verification before the first write, a rollback path, and idempotency on re-run. If the agent proposes atomic symlink switching, compare it with a proper zero-downtime deployment strategy rather than a hand-rolled script.

Run each task in each tool's default permission mode first, then in its most permissive mode inside a throwaway container. The difference in what each agent tries to do unprompted is the most useful safety signal you'll get.

Approval Modes and Safety

Bottom line: Codex CLI has the safest defaults (sandbox on, network off). Claude Code has the most granular permission modes. Gemini CLI sits in between with opt-in sandboxing and folder trust.

Claude Code

• Permission modes: default (prompts per action), acceptEdits, plan, auto, dontAsk, and bypassPermissions
• Project and user rules in CLAUDE.md and .claude/settings.json, including allow / deny rules per tool
• --allowedTools and --disallowedTools flags for headless runs
• --dangerously-skip-permissions (equivalent to --permission-mode bypassPermissions) — use only in isolated runners

OpenAI Codex CLI

Codex separates where the agent can act (sandbox mode) from when it must ask (approval policy):

• read-only: inspect files, but no edits or commands without approval
• workspace-write: edit inside the workspace and run routine local commands; network off by default. This is the default in version-controlled folders; other folders start in read-only until you trust them
• danger-full-access: no sandbox restrictions — use only when you mean it
• Approval policy on-request or never (-a never) works with any sandbox mode

Google Gemini CLI

• Approval modes: default, auto_edit, plan, and yolo
• Trusted folders control which workspaces get full execution policies
• Opt-in sandboxing with -s / GEMINI_SANDBOX

Security and Privacy

Bottom line: Codex CLI is the only one of the three that sandboxes shell commands by default. Claude Code and Gemini CLI both offer OS-level sandboxing, but you have to switch it on.

Code Access and Transmission

• Claude Code: reads files as needed; code is sent to Anthropic's API (or your chosen cloud provider). Review Anthropic's commercial terms for data-use details on your plan.
• Codex CLI: code is sent to OpenAI's API. Enterprise / Edu workspaces get admin-managed configuration and security controls.
• Gemini CLI: sends relevant portions of your codebase to Google's API. Because the harness is open source, you can audit exactly what's transmitted.

Secrets and Environment Variables

All three can read .env files and environment variables if they're in the project directory. Defensive practices that apply to all three:

• Block secret files per tool: Claude Code uses Read deny rules such as Read(./.env) in settings; Gemini CLI honours .geminiignore; for Codex, rely on the sandbox boundary and keep secrets out of the workspace
• Use secret managers (Vault, AWS Secrets Manager, 1Password CLI) instead of local env files for production
• Review generated deployment scripts for hardcoded credentials before running them
• Use read-only modes when exploring unfamiliar codebases
• For CI: pass secrets via runner env vars, never via the prompt itself — the prompt ends up in the agent transcript

If your CI runners are already provisioned to use DeployHQ for the actual delivery step, you don't need to give the AI agent write access to production — the agent commits, DeployHQ deploys. That separation is what makes fully autonomous modes safe to enable. See DeployHQ for AI coding agents for the terminal-deploy workflow that pairs naturally with all three CLIs.

Sandboxing

• Codex CLI: sandbox on by default — macOS Seatbelt, bubblewrap on Linux / WSL2, native Windows sandbox in PowerShell. workspace-write keeps network access off unless you enable network_access in config.
• Claude Code: OS-enforced Bash sandbox (Seatbelt on macOS, bubblewrap + socat on Linux / WSL2), off by default — turn it on with /sandbox. It covers shell commands only; file tools, MCP servers, and hooks run outside it. Network goes through a proxy with an allow-list that starts empty.
• Gemini CLI: opt-in with -s; choose macOS Seatbelt, Docker / Podman containers, gVisor (runsc), LXC, or the Windows native sandbox.

MCP and Extensibility

Bottom line: all three support MCP, and all three now ship built-in web tools, so MCP is for your own systems rather than for filling capability gaps.

Common MCP use cases across all three:

• GitHub integration: manage PRs, issues, repositories
• Database access: query production data — read-only, with guardrails that stop an agent deleting your data
• Slack / communication: post deployment notifications
• Custom tools: project-specific integrations

For a shortlist of servers worth installing, see our best MCP servers for Claude Code, Cursor, and Windsurf. For a wider look at which CLIs work inside MCP-driven agentic loops — and which break — see our writeup on 6 developer CLIs that AI coding agents actually use well and the companion CLIs or MCP for coding agents comparison.

Pricing Comparison

Bottom line: Codex CLI is the cheapest way in, because every ChatGPT tier includes Codex, in limited form on Free and Go. Claude Code needs a paid Claude plan. Gemini CLI is now an enterprise purchase; individuals looking for Google's free option should use Antigravity CLI.

Claude Code

• Pro: $20/month, or $17/month billed annually
• Max: $100/month, 5x Pro usage
• Ultra: $200/month, no 5-hour limit and 10x Pro weekly usage
• API: pay-per-use, varies by model

If the per-month subscription math doesn't add up, see Claude Code & Copilot alternatives: 7 AI coding routers compared for usage-based options that route between models, and free GitHub repos that cut your Claude Code token bill for token-economy tricks.

OpenAI Codex CLI

• Free: $0 — quick coding tasks, limited and subject to rollout
• Go: $8/month — lightweight coding tasks
• Plus: $20/month, Codex across web, CLI and IDE (OpenAI lists roughly 15–160 GPT-6.1 Sol messages per five hours; limits vary)
• Pro: from $100/month ($100, $200, or $500 tiers), no five-hour limit
• Business: $20/user/month billed annually ($25 monthly)
• API: pay-per-use

Limits depend on the model, task size, and complexity, so heavy GPT-6 Astra use burns through a plan faster than Luna.

Google Gemini CLI

• Gemini Code Assist Standard: Google lists it at $0.031232877/hour (monthly commitment) or $0.026027397/hour (12-month commitment) — roughly $23/month or $19/month per user
• Gemini Code Assist Enterprise: $0.073972603/hour (monthly) or $0.061643836/hour (12-month) — roughly $54/month or $45/month per user
• Paid Gemini API / Vertex AI keys: usage-based
• Antigravity CLI (the replacement for individuals): a $0/month individual plan is available; see Google's Antigravity pricing for quotas

Monthly figures are our arithmetic from Google's published hourly licence rates (×730 hours/month, ×8,760 hours/year ÷ 12); check the Google Cloud pricing page before budgeting.

If running these models on your own hardware is on the table — local inference beats every plan above past a certain volume — see our practical guide to self-hosted AI coding models for the hardware math.

IDE Integration

Bottom line: Claude Code and Codex both span terminal, IDE, desktop, and web with shared sessions. Gemini CLI has a VS Code companion; Google's broader IDE story for individuals is now Antigravity.

Claude Code

• VS Code extension (also installable in Cursor)
• JetBrains plugin (requires the CLI)
• Desktop app and web, with claude --teleport to pull a web session into your terminal
• Same CLAUDE.md, settings, and MCP servers across every surface

OpenAI Codex CLI

• IDE extension for VS Code, Cursor, and Windsurf
• Desktop app (codex app) and Codex web for cloud tasks
• Same AGENTS.md and config across surfaces

Google Gemini CLI

• VS Code companion extension
• Gemini Code Assist IDE extensions for Code Assist Standard / Enterprise customers (the consumer IDE extensions stopped serving free and AI Pro / Ultra users on June 18, 2026)

If you live in an editor rather than a terminal, see the Cursor setup guide for Composer, Agent mode, MCP, and Background Agent workflows that complement these CLIs.

Unique Strengths

Claude Code

• Consistency: strong at maintaining code style and patterns across large refactors
• Granular permissions: six permission modes plus per-tool allow / deny rules
• Surface breadth: terminal, IDE, desktop, web, Slack, and scheduled cloud tasks share one configuration

OpenAI Codex CLI

• Safe defaults: the only one of the three that sandboxes shell commands and blocks network access out of the box
• Cheapest entry: included on every ChatGPT plan, in limited form on Free and Go
• Open source: Apache 2.0, with an official GitHub Action

Google Gemini CLI

• Open source: Apache 2.0 and fully auditable
• Sandbox choice: Seatbelt, containers, gVisor, LXC, or Windows native
• Enterprise fit: maintained for Google Cloud organisations on Code Assist

Using AI CLIs with DeployHQ

Regardless of which CLI you choose, the generated code still has to get from your repository to your servers. The pattern fits a DeployHQ workflow cleanly:

1. Generate deployment configs with your preferred CLI (Dockerfiles, CI workflows, build scripts)
2. Commit and push the generated code to your Git repository
3. DeployHQ picks up the push via webhook and triggers your deployment pipeline
4. Build commands run automatically — if your AI-generated build script lives in your repo, DeployHQ executes it as part of the build step (npm install, composer install, asset compilation, whatever your stack needs)
5. Code deploys to your server via SSH, SFTP, or cloud provider integration

If you use GitHub as your repo host, you can deploy from GitHub with a single webhook setup. The AI CLI handles the code generation; DeployHQ handles the reliable delivery to production — including one-click rollback when the agent's this should work turns out not to.

Recommendations by Use Case

Best for solo developers or small teams on a budget

OpenAI Codex CLI — it comes with limited access on ChatGPT Free and Go, and its sandbox makes it the safest tool to let loose on a repo you don't know well. If you want Google's models for free, use Antigravity CLI, not Gemini CLI.

Best for teams already using ChatGPT

OpenAI Codex CLI — included in your subscription, with an official GitHub Action and image input on the command line.

Best for complex, multi-file changes

Claude Code — agentic codebase search, subagents, and plan mode make it strong at coherent changes across many files.

Best for Google Cloud organisations

Google Gemini CLI — if you already hold Gemini Code Assist Standard / Enterprise licences, Gemini CLI is maintained for exactly that setup.

Best for CI/CD integration

Three-way tie — all three have a GitHub Action (anthropics/claude-code-action, openai/codex-action, and google-github-actions/run-gemini-cli) and first-class headless modes. Pick the one whose permission model your security team is happier to audit.

Best for enterprises needing transparency

Codex CLI or Gemini CLI — both are Apache 2.0, so you can audit the harness itself. Claude Code is proprietary.

Making Your Choice

There's no wrong choice — all three are capable and actively improving. A working decision framework:

1. Check your existing subscriptions: on ChatGPT, start with Codex; on Claude Pro / Max / Ultra, start with Claude Code; on Gemini Code Assist, start with Gemini CLI.
2. Individual and want Google's models? Use Antigravity CLI — Gemini CLI no longer serves free or Google AI Pro / Ultra accounts.
3. Consider your ecosystem: Google Cloud organisations benefit from Gemini Code Assist; GitHub-heavy teams can use either the Claude Code or Codex GitHub Action.
4. Test on your actual projects: run the bake-off above on your own deployment scenarios.
5. You can use more than one: AGENTS.md is read by Codex and Claude Code, and Antigravity reads GEMINI.md and AGENTS.md, so one shared instruction file can serve several agents.

The Future of AI Coding Assistants

All three vendors are investing heavily, and 2026 showed how fast the ground moves: Google split its CLI line-up in two, Codex retired approval modes that early tutorials still reference, and Claude Code moved from a terminal tool to a multi-surface product. There's clear convergence around MCP, OS-level sandboxing, headless modes, and shared instruction files, while differentiation continues on models, defaults, and pricing.

For deployment workflows specifically, the trend is toward tighter CI/CD integration, safer defaults for unattended runs, and better understanding of deployment contexts and constraints.

Conclusion

Claude Code, OpenAI Codex CLI, and Google Gemini CLI each bring valuable capabilities to deployment workflows:

• Claude Code excels at thoughtful, comprehensive multi-file changes, with the most granular permission model
• Codex CLI has the safest defaults, the lowest-cost entry point, and an official GitHub Action
• Gemini CLI is the open-source choice for Google Cloud organisations on Code Assist — and individuals who want Google's models should look at Antigravity CLI instead

The best choice depends on your team's existing tools, budget, and specific needs. Start with the tool that fits your current stack, and re-check the vendor docs before you standardise — in this category, six months is a long time.

Whichever AI assistant you choose, DeployHQ automates the delivery step — from simple FTP to SSH pipelines with safe rollback for when the agent's this should work turns out otherwise. See DeployHQ pricing to size a plan against your team — or let the AI write the code and DeployHQ ship it.

Questions or feedback? Reach us at support@deployhq.com or on Twitter/X.