Gemini CLI already reads a GEMINI.md. Give it one that stops overpaying.

How this maps onto Gemini CLI

GEMINI.md is the confirmed read path — and Agent Skills work too.

Gemini CLI's documented, reliable mechanism is GEMINI.md, read in three tiers: ~/.gemini/GEMINI.md (global) first, then GEMINI.md files in your configured workspace directories and their parent directories, then a just-in-time scan — when a tool accesses a file or directory, the CLI automatically scans for GEMINI.md files in that directory and its ancestors up to a trusted root (per Gemini CLI's own docs and the gemini-cli repo's docs). Gemini CLI also ships an Agent Skills feature: per Gemini CLI's own skills docs, it auto-discovers a plain SKILL.md from .gemini/skills/<name>/ (workspace) or ~/.gemini/skills/<name>/ (user), or the cross-agent .agents/skills/ alias — no extension package required. (Extension-bundled skills also work, and sit lower in the precedence order than workspace skills.) That makes a direct skill install a confirmed option alongside GEMINI.md — see Install below for both.

Undercut's tier names — cheap, standard, frontier, apex — are generic on purpose. models.md gives the rule of thumb rather than a fixed slug for Gemini CLI specifically: cheap maps to the smallest/fastest model in Google's current Gemini lineup, standard to the default work model, frontier to the highest-reasoning production model, and apex is reserved for the single batched tie-break call when the ladder is exhausted. The mapping is versioned separately from the rubric, so a new Gemini release updates the model name without touching the escalation logic itself.

Nothing about this sits between Gemini CLI and the Gemini API. It's plain markdown text Gemini CLI reads into context at session start, same as any other project instructions — no proxy, no network hop, nothing to route around if you remove the block.

Install for Gemini CLI

Free. MIT. Nothing installs, nothing proxies your traffic.

Option 1 — append to project GEMINI.md (recommended, confirmed path)

Run this from the repo root. Gemini CLI walks upward from your working directory looking for a GEMINI.md file at the project root (not inside a .gemini/ subdirectory — that's reserved for the global, home-directory copy), so appending the policy text to the root file here is the most reliable way to get it in front of Gemini CLI.

Option 2 — install globally for every session

Same file, user scope. Gemini CLI reads ~/.gemini/GEMINI.md first, before any project-level file — useful if you want the policy everywhere without touching individual repos.

Option 3 — install as an Agent Skill (also confirmed)

Gemini CLI's own docs now confirm plain SKILL.md discovery at .gemini/skills/<name>/ — no extension package needed. Undercut's skill is already named firstpass, so the directory copies straight across.

Validate it yourself

1. 1Read the published results — testing/README.md and the raw JSON in testing/results/
2. 2Reproduce for free, no API key, no spend: node src/main.js --mock
3. 3Run live on the Gemini family with an OpenRouter key — a single-vendor smoke test is pennies

Zero lock-in. It's markdown text Gemini CLI reads — delete the block and you're back to status quo.

Six flags assign a tier. Three triggers are the only way up.

This is a named, versioned spec — not internal logic we could quietly change. When the rubric changes (a new flag, a different cap), the version number moves and the changelog says why.

Every unit of work gets scored against six flags, then assigned the cheapest tier that can plausibly handle it. It only moves up a tier when something objective proves it needs to — a failed check, a measured disagreement, an explicit uncertainty flag. It never moves up on a guess, and it never moves back down mid-task.

 unit of work
      |
  6-flag rubric
      |
  +---+----+
  | 0 flags|--> cheap
  | 1-2    |--> standard
  | 3+/own |--> frontier
  +---+----+
      | fail x2 / disagree / uncertain
      v
  escalate +1 tier
  (residue only)
      |
  still unresolved?
      v
  single batched
  apex tie-break

Why it holds up

Flags steer. Verification and escalation decide.

Even when the rubric flags are scored imperfectly, the escalator still routes work to the right tier almost every time — because a wrong flag only ever costs one extra cheap attempt, never a wrong answer or a big bill.

Honest limits

What this doesn't do.

Not a proxy, not a gateway, doesn't auto-flag in production (Gemini CLI scores the flags itself — measured robust to getting them wrong, see above), and doesn't promise a dollar figure for your workload. Full list, with the finance/procurement note and the paid-tier disclosure, is on the main page.