# Gecko Security

> Gecko Security documentation.

- [Gecko Security](https://gecko.security/docs/index.md): An AI security engineer that finds real, exploitable vulnerabilities in your code, and ships the fix.
- [Quick start](https://gecko.security/docs/quick-start.md): Connect a repository, run your first scan, and review real findings in minutes.
- [How Gecko works](https://gecko.security/docs/how-gecko-works.md): What a scan produces, and how Gecko proves a vulnerability is real.
- [Findings](https://gecko.security/docs/concepts/findings.md): How Gecko scores, proves, and de-duplicates vulnerabilities.
- [Scans](https://gecko.security/docs/concepts/scans.md): Deep scans vs PR scans, single- vs multi-repo, and scheduled runs.
- [Repository wiki](https://gecko.security/docs/concepts/repository-wiki.md): The AI-generated map of your codebase that powers accurate analysis.
- [Endpoints & API spec](https://gecko.security/docs/concepts/api-spec.md): The HTTP attack surface Gecko discovers in your application.
- [Connect GitHub](https://gecko.security/docs/connect/github.md): Install the Gecko GitHub App for GitHub.com, or connect GitHub Enterprise Server with a token.
- [Connect GitLab](https://gecko.security/docs/connect/gitlab.md): Connect GitLab.com to Gecko in minutes with an access token.
- [Connect self-managed GitLab](https://gecko.security/docs/connect/gitlab-self-managed.md): Roll out Gecko on self-managed GitLab or GitLab Dedicated with a dedicated service account and a PAT.
- [Network & IP allowlist](https://gecko.security/docs/connect/network-allowlist.md): The IP addresses to allow if your Git instance restricts access by IP.
- [Webhooks](https://gecko.security/docs/connect/webhooks.md): Events, secrets, and signature verification for GitHub, GitHub Enterprise, and GitLab.
- [Public URLs & ZIP uploads](https://gecko.security/docs/connect/other-inputs.md): Scan code without connecting a provider. Ideal for evaluation and open source.
- [Run a scan](https://gecko.security/docs/scanning/run-a-scan.md): Start a baseline scan and read the results.
- [Pull request checks](https://gecko.security/docs/scanning/pr-checks.md): Scan every pull and merge request, post a review summary, and block risky merges.
- [Scheduled scans](https://gecko.security/docs/scanning/scheduled-scans.md): Keep the baseline fresh with recurring full scans.
- [Rules](https://gecko.security/docs/scanning/rules.md): Tune which findings surface for your team.
- [Scanner settings](https://gecko.security/docs/scanner-settings.md): Where to configure scan behavior, schedules, rules, and integrations.
- [Findings & remediation](https://gecko.security/docs/findings-remediation.md): Triage Gecko findings, request a fix, and verify the result with a rescan.
- [Auto-fix PRs](https://gecko.security/docs/remediation/auto-fix-prs.md): Ship Gecko's suggested patch as a pull request or a commit to an existing PR.
- [Integrations](https://gecko.security/docs/integrations.md): Connect Gecko to source control, issue trackers, and notifications.
- [Jira](https://gecko.security/docs/jira-integration.md): File Gecko findings as Jira issues and keep status in sync.
- [Linear](https://gecko.security/docs/linear-integration.md): Push Gecko findings into your Linear backlog with the right priority.
- [Slack](https://gecko.security/docs/slack-integration.md): Get scan notifications and remediation nudges in the right channels.
- [ClickUp](https://gecko.security/docs/clickup-integration.md): Create ClickUp tasks for Gecko findings.
- [Shortcut](https://gecko.security/docs/shortcut-integration.md): Route Gecko findings into Shortcut stories.
- [GitLab vulnerability export](https://gecko.security/docs/gitlab-vulnerability-export.md): Surface Gecko findings in GitLab's native Security Dashboard.
- [DefectDojo](https://gecko.security/docs/defectdojo-integration.md): Push Gecko findings into DefectDojo and track ASVS compliance per repository.
- [Connect AI tools](https://gecko.security/docs/ai-tools/overview.md): Give Claude, ChatGPT, Codex, Cursor, and other MCP clients scoped access to your Gecko findings.
- [Claude & Claude Desktop](https://gecko.security/docs/ai-tools/claude.md): Connect Gecko to claude.ai and Claude Desktop as a custom connector.
- [Claude Code](https://gecko.security/docs/ai-tools/claude-code.md): Connect Gecko to Claude Code over MCP with one command.
- [Codex](https://gecko.security/docs/ai-tools/codex.md): Connect Gecko to the Codex CLI, IDE, and Codex Cloud.
- [ChatGPT](https://gecko.security/docs/ai-tools/chatgpt.md): Connect Gecko to ChatGPT on the web or in the desktop app.
- [Cursor, Devin & other MCP clients](https://gecko.security/docs/ai-tools/other-clients.md): Connect Gecko to Cursor, Devin Desktop, or any MCP client that supports Streamable HTTP.
- [How identity works in Gecko](https://gecko.security/docs/access/identity-model.md): The two identities a Gecko user has: how you sign in, and who you are once signed in.
- [Teams & permissions](https://gecko.security/docs/teams-permissions.md): Roles, the permission matrix, and how to invite your team.
- [Single Sign-On (SSO)](https://gecko.security/docs/access/self-managed-sso.md): Set up SAML or OIDC single sign-on yourself, end to end, from inside Gecko.
- [SAML provider reference](https://gecko.security/docs/access/saml.md): Per-provider screens and field values for connecting a SAML 2.0 IdP to Gecko.
- [SSO & Login](https://gecko.security/docs/access/okta-saml-onboarding.md): Set up team login in Gecko with Okta SAML, verify the first sign-in, and add SCIM after SSO works.
- [API keys](https://gecko.security/docs/admin/api-keys.md): Create and manage keys for the Gecko v1 API and MCP server.
- [Audit log](https://gecko.security/docs/admin/audit-log.md): Review access and configuration events for your team.
- [Billing & plans](https://gecko.security/docs/admin/billing.md): Plans, usage, and where to manage your subscription.
- [Deployment models](https://gecko.security/docs/deployment/architecture.md): How Gecko runs: cloud SaaS and hybrid, and what that means for network access.
- [Hybrid deployment (Assume role)](https://gecko.security/docs/deployment/hybrid.md): Run the scanner, storage, and AI inference inside your own AWS account, with Gecko reaching in only through a tightly-scoped assumed role.
- [Changelog](https://gecko.security/docs/changelog.md): Product and documentation updates for Gecko Security.
- [API reference](https://gecko.security/docs/api-reference/introduction.md): Authenticate to the Gecko v1 API, understand the response envelope, pagination, idempotency, and tier-aware rate limits.
- [Webhook events](https://gecko.security/docs/api-reference/webhooks.md): Subscribe to scan and vulnerability events with HMAC-signed deliveries.
- [List scans](https://gecko.security/docs/api-reference/list-scans.md)
- [Trigger a scan (GitHub or GitLab)](https://gecko.security/docs/api-reference/trigger-a-scan-github-or-gitlab.md)
- [Get a scan](https://gecko.security/docs/api-reference/get-a-scan.md)
- [List a scan's vulnerabilities](https://gecko.security/docs/api-reference/list-a-scans-vulnerabilities.md)
- [Get the API spec discovered by a scan](https://gecko.security/docs/api-reference/get-the-api-spec-discovered-by-a-scan.md)
- [Get a scan's wiki (markdown)](https://gecko.security/docs/api-reference/get-a-scans-wiki-markdown.md)
- [List repositories](https://gecko.security/docs/api-reference/list-repositories.md)
- [Get a repository](https://gecko.security/docs/api-reference/get-a-repository.md)
- [Update repository settings](https://gecko.security/docs/api-reference/update-repository-settings.md)
- [List a repository's scans](https://gecko.security/docs/api-reference/list-a-repositorys-scans.md)
- [List a repository's vulnerabilities](https://gecko.security/docs/api-reference/list-a-repositorys-vulnerabilities.md)
- [List vulnerabilities](https://gecko.security/docs/api-reference/list-vulnerabilities.md)
- [Get a vulnerability](https://gecko.security/docs/api-reference/get-a-vulnerability.md)
- [Triage a vulnerability](https://gecko.security/docs/api-reference/triage-a-vulnerability.md)
- [List schedules](https://gecko.security/docs/api-reference/list-schedules.md)
- [Create a schedule](https://gecko.security/docs/api-reference/create-a-schedule.md)
- [Get a schedule](https://gecko.security/docs/api-reference/get-a-schedule.md)
- [Update a schedule](https://gecko.security/docs/api-reference/update-a-schedule.md)
- [Delete a schedule](https://gecko.security/docs/api-reference/delete-a-schedule.md)
- [Get the GitLab integration](https://gecko.security/docs/api-reference/get-the-gitlab-integration.md): Current GitLab connection state for the team, including the stored token expiry date. Never returns credentials.
- [Rotate the GitLab service-account token](https://gecko.security/docs/api-reference/rotate-the-gitlab-service-account-token.md): Validates the token against the GitLab instance (including the required "api" scope) before storing it. Omit `instance_url` to keep the currently connected instance.
- [List webhook endpoints](https://gecko.security/docs/api-reference/list-webhook-endpoints.md)
- [Create a webhook endpoint](https://gecko.security/docs/api-reference/create-a-webhook-endpoint.md)
- [Get a webhook endpoint](https://gecko.security/docs/api-reference/get-a-webhook-endpoint.md)
- [Update a webhook endpoint](https://gecko.security/docs/api-reference/update-a-webhook-endpoint.md)
- [Delete a webhook endpoint](https://gecko.security/docs/api-reference/delete-a-webhook-endpoint.md)
- [List image releases for a channel](https://gecko.security/docs/api-reference/list-image-releases-for-a-channel.md): Newest-first history of published scanner images. Pin pulls to the returned digest-pinned `image_ref`, never a mutable tag. Unknown channel names return `not_found`.
- [Get the latest image release for a channel](https://gecko.security/docs/api-reference/get-the-latest-image-release-for-a-channel.md): Unknown channel names return `not_found`.
- [Resolve a version to its image release](https://gecko.security/docs/api-reference/resolve-a-version-to-its-image-release.md): Looks up one release by version within a channel. The path version matches either the customer release version (for example `1.1`) or the Gecko scanner version (for example `1.1.0`). When the same scanner version was pushed more than once, the newest release is returned. Pull the digest-pinned `imag…

## OpenAPI Specs

- [openapi](/docs/api-reference/openapi.json)

## Optional

- [Dashboard](https://app.gecko.security)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.