Add excludedTools to extensions. (#2853)

1 files changed, 3 insertions, 1 deletions

diff --git a/docs/extension.md b/docs/extension.md
index e669f56c..0bdede0b 100644
--- a/docs/extension.md
+++ b/docs/extension.md
@@ -28,7 +28,8 @@ The `gemini-extension.json` file contains the configuration for the extension. T
       "command": "node my-server.js"
     }
   },
-  "contextFileName": "GEMINI.md"
+  "contextFileName": "GEMINI.md",
+  "excludeTools": ["run_shell_command"]
 }
 ```
 
@@ -36,5 +37,6 @@ The `gemini-extension.json` file contains the configuration for the extension. T
 - `version`: The version of the extension.
 - `mcpServers`: A map of MCP servers to configure. The key is the name of the server, and the value is the server configuration. These servers will be loaded on startup just like MCP servers configured in a [`settings.json` file](./cli/configuration.md). If both an extension and a `settings.json` file configure an MCP server with the same name, the server defined in the `settings.json` file takes precedence.
 - `contextFileName`: The name of the file that contains the context for the extension. This will be used to load the context from the workspace. If this property is not used but a `GEMINI.md` file is present in your extension directory, then that file will be loaded.
+- `excludeTools`: An array of tool names to exclude from the model. You can also specify command-specific restrictions for tools that support it, like the `run_shell_command` tool. For example, `"excludeTools": ["run_shell_command(rm -rf)"]` will block the `rm -rf` command.
 
 When Gemini CLI starts, it loads all the extensions and merges their configurations. If there are any conflicts, the workspace configuration takes precedence.