Antigravity brings local models to its agent SDK

The attraction of a local coding model is easy to picture: source code stays on the workstation while the assistant reads it and proposes a change. Google’s Antigravity SDK now offers another route to that workflow. Before calling the arrangement local, though, it is worth following what happens after the model has produced its next instruction. A shell command or a cloud planning step can take a different route from inference itself.

Google’s September 23 announcement introduces Gemma 4 26B A4B through LiteRT and recommends more than 24 GB of VRAM or unified memory. It also describes OpenAI-compatible local servers, including Ollama and vLLM. Those choices give teams different ways to run the model’s request processing on their own hardware. The demonstrated hybrid configuration adds a cloud planner, which still receives filenames and task descriptions even though execution is local.

Local inference and the tools around it

Consider a hypothetical repository audit. The agent reads code locally and prepares a patch, but its shell has inherited a cloud credential from the developer’s environment. A command can use that credential to contact an external system. Nothing about local inference prevents this: where a model computes and what a tool can reach are separate properties of the workflow.

In this repository audit, the permitted task is reading code and preparing a patch; the inherited cloud account would let the shell act on systems outside that assignment. The production-agent guidance develops this idea for shared systems. Here it means that permission to read a repository does not silently become permission to alter it, write a ticket or use an inherited production account. Each capability changes what can happen after a perfectly reasonable model response.

The SDK README documents read-only defaults and tool policies that deny, allow or require approval. They provide concrete controls to inspect when moving from a demonstration to a company task. There is also a practical setup detail: installation needs the published package’s runtime binary, so a repository clone by itself does not produce the complete working environment.

A repository audit with visible file and network access

A disposable repository copy lets a team evaluate usefulness and access together. Give it a known defect and synthetic secrets, remove production credentials, and observe which files the agent reads and changes. Existing tests can assess the patch, while an independent check of the planted defect answers whether it fixed the intended problem. Recording tool access explains what the workflow was capable of doing along the way.

This trial also exposes the price of a chosen boundary. A fully local arrangement may fit a data policy while requiring suitable hardware and checked local dependencies. A hybrid planner may be convenient, but it sends some task information away. If policy forbids filenames or task descriptions from leaving the machine, the demonstrated hybrid planner is unsuitable; choose a checked fully local workflow or defer that use case.

When the patch is ready to share, sending it to another system still needs a defined destination and permission; the local audit did not automatically authorize that transmission. The pilot’s result should therefore include both a patch the team can judge and an account of its file, tool and outbound access. Those records let the team choose the next repository task with an understanding of which information stays local and which actions the workflow can take.