Section 2: Using coding agents for application development

Question 1, 2.1 Using coding agents effectively

A data engineering team uses the Antigravity CLI to write BigQuery transformations. They want the agent to inspect live dataset schemas through the Google Cloud remote BigQuery MCP server. Security policy forbids storing long-lived credentials, such as API keys or service account keys, in any configuration file, and the MCP configuration must be shared with every engineer through the repository. Every engineer already has Application Default Credentials configured with gcloud and holds the required IAM roles. What should you do?

1. Add an entry to ~/.gemini/config/mcp_config.json on each laptop that sets serverUrl to the BigQuery MCP endpoint and passes a token minted from a service account key in the Authorization header.
2. Commit <workspace>/.agents/mcp_config.json with an mcpServers entry whose serverUrl is the BigQuery MCP endpoint and whose authProviderType is "google_credentials".
3. Commit <workspace>/.agents/mcp_config.json with an entry that sets httpUrl to the BigQuery MCP endpoint and uses the HTTP+SSE transport.
4. Commit a stdio MCP proxy configuration that uses command to launch a local bridge process and passes the path of a downloaded service account JSON key through env.

Question 2, 2.1 Using coding agents effectively

Your team uses both the Antigravity App and the Antigravity CLI. You wrote step-by-step instructions and a helper script that validates Cloud Run service YAML before a deployment. Every engineer who clones the repository should get this capability without extra setup. The agent should apply it only when a task involves Cloud Run deployments, and the full instructions should not consume context during unrelated tasks. What should you do?

1. Commit .agents/skills/cloud-run-validate/SKILL.md with a precise description of when to use it, and put the script in a scripts/ subfolder.
2. Save the skill in ~/.gemini/config/skills/cloud-run-validate/ on your workstation, which both the App and the CLI read, and share the folder with the team.
3. Add the full step-by-step instructions and the script contents to an AGENTS.md file at the repository root so that every session can follow them.
4. Wrap the script in a local stdio MCP server, register it in each engineer's global ~/.gemini/config/mcp_config.json, and describe the workflow in the tool description.

Question 3, 2.1 Using coding agents effectively

A bank provides Cloud Workstations on which developers run coding agents such as the Antigravity CLI and Claude Code. Compliance requires that workstations have no direct path to the public internet, that agents and developers can still reach Google APIs and a short list of approved external package sites, and that all access to those external sites is logged and subject to data loss prevention controls. Which two actions should you take? (Choose two.)

1. Add the approved package sites as read_url allow rules in each developer's Antigravity permissions so that the terminal sandbox can reach only those hosts.
2. Set disableSsh in the workstation configuration so the workstation VMs cannot reach the internet.
3. Set disablePublicIpAddresses to true in the workstation configuration and configure Private Google Access on the workstation subnet.
4. Assign one workstation to each team instead of each developer so that external traffic comes from fewer VMs.
5. Configure Secure Web Proxy with policies for the approved domains, and set https_proxy and http_proxy to it in a custom workstation image.

Question 4, 2.1 Using coding agents effectively

An application security team has thousands of static analysis findings across a large Java and Python codebase, many of them false positives. They want an AI agent that confirms whether each vulnerability is actually exploitable before fixing it, generates and tests a patch, and lets developers review and approve every patch before it is committed. Full source repositories must not be uploaded to Google's servers. The team has approval to evaluate Preview offerings in a non-production pilot. Which approach should you recommend?

1. Ask a coding agent in Antigravity to read the scanner report and rewrite every flagged function in one pass, and then run the existing unit tests.
2. Enable Model Armor for the team's coding agents so that prompts and responses that contain vulnerable code patterns are blocked.
3. Use CodeMender on Gemini Enterprise Agent Platform through its local CLI client, and review the verified, tested patches as code diffs.
4. Enable Artifact Analysis vulnerability scanning on the application's container images in Artifact Registry, and triage the results by severity.

Question 5, 2.2 Customizing coding agents for enterprise workflows

Your team's internal Antigravity plugin ships a PreToolUse hook in its hooks.json that matches the run_command tool. Testing reveals two problems. First, when the hook script detects a command against the production database, it prints a message to stderr and exits with code 2, yet the command still runs. Second, commands against the staging database must prompt a human every time, but developers who previously chose "Always Allow" are no longer prompted. Which two changes resolve both problems? (Choose two.)

1. Increase the hook's timeout value so that the script finishes before Antigravity proceeds with the tool call.
2. For production commands, exit with code 0 and write {"decision": "deny", "reason": "..."} to stdout.
3. For staging commands, return "decision": "ask" so that the developer is prompted for approval.
4. For staging commands, return "decision": "deny_unless_prior_grant" so that only previously approved commands run.
5. For staging commands, return "decision": "force_ask" so that the developer is prompted regardless of cached permissions.

Question 6, 2.2 Customizing coding agents for enterprise workflows

A data engineering team is moving from Gemini CLI and Claude Code to the Antigravity CLI. Over the past year, the team built several Gemini CLI extensions stored in ~/.gemini/extensions/ and a few Claude Code plugins stored in ~/.claude/plugins/ that bundle MCP servers and team instructions. The team wants to keep using these capabilities in Antigravity with the LEAST manual effort. What should you do?

1. Rewrite each extension and plugin by hand as SKILL.md files under .agents/skills/, and re-create the MCP server entries in mcp_config.json.
2. Copy the ~/.gemini/extensions/ and ~/.claude/plugins/ directories into ~/.gemini/config/skills/ so that Antigravity discovers them as skills.
3. Install the Antigravity extension for Visual Studio Code so that the editor loads the Gemini CLI extensions and Claude Code plugins.
4. Run agy plugin import gemini and agy plugin import claude to migrate the existing extensions and plugins into Antigravity.

Question 7, 2.2 Customizing coding agents for enterprise workflows

An ADK agent scaffolded with agents-cli is deployed to Agent Runtime. A security review finds two gaps: the agent's outbound calls to third-party APIs bypass the company's existing Agent Gateway, and a vendor API key is stored in the project-root .env file. You must route all outbound agent traffic through the gateway and keep the key out of the deployed service's plain environment variables. Which two actions should you take? (Choose two.)

1. Redeploy with --agent-gateway-ingress set to the gateway's resource name, because the gateway uses the CLIENT_TO_AGENT governed access path.
2. Keep the key in .env, because agents-cli deploy excludes .env files from the deployed service.
3. Run agents-cli scaffold enhance --agent-gateway, and then redeploy with --agent-gateway-egress set to a gateway whose governedAccessPath is AGENT_TO_ANYWHERE.
4. Redeploy with --key set to a Cloud KMS key so that the .env values are encrypted at rest.
5. Store the key in Secret Manager, remove it from .env, and redeploy with --secrets VENDOR_API_KEY=<secret-name>.