> ## Documentation Index
> Fetch the complete documentation index at: https://gecko.security/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code

> Connect Gecko to Claude Code over MCP with one command.

Connect Gecko to Claude Code so it can read findings, triage, and file
tickets from your terminal.

<Steps>
  <Step title="Add the server">
    ```bash theme={null}
    claude mcp add --transport http gecko https://app.gecko.security/api/mcp
    ```
  </Step>

  <Step title="Authenticate">
    In Claude Code, run `/mcp`, select **gecko**, and pick **Authenticate**.
    Approve Gecko's authorization screen in the browser. Tokens are stored by
    Claude Code, not in the config file.
  </Step>
</Steps>

<Check>
  Run `/mcp` again; the gecko server should show as connected.
</Check>

## Use an API key instead

For headless or CI use, skip OAuth and pass a static key created under
**Settings** > **API Keys**:

```bash theme={null}
claude mcp add --transport http gecko https://app.gecko.security/api/mcp \
  --header "Authorization: Bearer $GECKO_API_KEY"
```

## Plugin

The `gecko-security` Claude Code plugin ships the same server plus a security
skill. With the plugin installed, Gecko's packaged prompts surface as slash
commands: `/mcp__gecko__triage_criticals`, `/mcp__gecko__security_review`,
and `/mcp__gecko__fix_finding`.

See the [overview](/docs/ai-tools/overview) for available tools and how access is
scoped.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication never completes">
    The OAuth flow ends on Gecko's authorization screen; if **Approve** is
    replaced by a plan message, the selected team is on the Free tier, and
    if no team is offered, you lack the `api_keys.manage` permission. Fix
    the gate, then run `/mcp` > **Authenticate** again.
  </Accordion>

  <Accordion title="The server shows as failed after adding it">
    Confirm the transport is `http` (not `sse`); the server is stateless
    Streamable HTTP and rejects session-based transports. Then run the curl
    smoke test from the [overview](/docs/ai-tools/overview#troubleshooting) to
    separate a network problem from a client one.
  </Accordion>

  <Accordion title="It worked, then stopped">
    If you connected with an API key, the key was probably deleted or your
    role changed; keys die immediately on deletion. Re-add with a fresh key,
    or switch to OAuth so there's no static secret to lose.
  </Accordion>
</AccordionGroup>