What it does
Gecko is a code security product that analyses a repository together with its infrastructure and design documents. It targets flaws that pattern matching tends to miss, naming business logic flaws, broken access control, injection and SSRF. The site says each finding arrives with a source-to-sink call chain and a working proof of concept. Findings are ranked by the attack path they form rather than listed flat. For fixing, Gecko traces a finding back to the design decision behind it, locates variants across repositories, and opens one pull request for the whole class in the style of your codebase. After the merge it rescans to confirm. Fixes can also go to Jira, ClickUp or another tracker, or to Claude, Codex or Devin over MCP. A deep scan maps the repository and investigates attack paths, with first findings typically arriving within the hour. Pull request checks then label each finding as new, persisting or fixed. The site says every fix becomes a guardrail enforced on each pull request and inside the AI agents that write your code. The home page offers a free trial and a demo booking. Plan prices are on a separate pricing page and are not stated here.
Capabilities
- Looks for business logic flaws, broken access control, injection and SSRF
- Findings come with a call chain and a proof of concept
- Ranks findings by the attack path they form
- One pull request fixes the root cause and its variants
- Pull request checks mark findings as new, persisting or fixed
- Connectors for Jira, ClickUp, Claude, Codex and MCP servers
When to use it
- You want security findings that go beyond pattern-matching scanners
- Your backlog is full of alerts that share one underlying cause
- You want every pull request checked and fixes handed to a coding agent
