Skip to main content
Gecko’s MCP server works with any client that supports Streamable HTTP. Use OAuth where the client supports it; otherwise create an API key under Settings > API Keys and send it as a bearer header.

​
Cursor

Install with one click: Add to Cursor Cursor runs the OAuth flow when no header is configured; approve Gecko’s authorization screen and you’re connected. To use an API key instead, add the headers block from the generic config below to .cursor/mcp.json.

​
Devin Desktop (formerly Windsurf)

Add the server to mcp_config.json with an API key:

​
Any other MCP client

Point the client at https://app.gecko.security/api/mcp using the same mcpServers config shape as above. If the client supports OAuth, omit the headers block and it will discover Gecko’s authorization server and open the consent screen automatically.

​
Smoke test

Verify connectivity from any machine:
A result.supportedVersions array in the response means you’re connected.

​
Troubleshooting

Run the smoke test above. If it succeeds, the endpoint, network, and credential are fine and the problem is the client’s configuration: confirm the type is http (Streamable HTTP, not sse; the server is stateless and returns 405 to GET).
Not every client implements MCP OAuth discovery. If yours doesn’t, fall back to an API key with the headers block above.
Access is always capped by the credential owner’s live Gecko role; see how access is scoped.
See the overview for available tools and how access is scoped.