Skip to main content
Gecko runs a Claude-powered agent that reads your code like a security engineer. It follows untrusted input from where it enters your app to where it does damage, and reports an issue only when it can prove the path is exploitable.

​
What a scan produces

Findings

Each with the full source-to-sink call chain, a CVSS severity, a proof of concept, and a ready-to-apply patch.

Repository wiki

An AI-written map of your app: architecture, routing, and security model.

Endpoint map

The HTTP attack surface Gecko discovered in your code.

PR reviews & fixes

On pull requests, a security review summary and one-click fixes.

​
The scan pipeline

A deep scan maps your codebase so the agent understands your app, focuses on the security-sensitive code, then traces each path from source to sink, reporting only proven, high-confidence findings.

​
Supported languages

Gecko follows data flow across files using compiler-accurate analysis where available, and general parsing support everywhere else.