1
Add the server
2
Authenticate
In Claude Code, run
/mcp, select gecko, and pick Authenticate.
Approve Gecko’s authorization screen in the browser. Tokens are stored by
Claude Code, not in the config file.Run
/mcp again; the gecko server should show as connected.Use an API key instead
For headless or CI use, skip OAuth and pass a static key created under Settings > API Keys:Plugin
Thegecko-security Claude Code plugin ships the same server plus a security
skill. With the plugin installed, Gecko’s packaged prompts surface as slash
commands: /mcp__gecko__triage_criticals, /mcp__gecko__security_review,
and /mcp__gecko__fix_finding.
See the overview for available tools and how access is
scoped.
Troubleshooting
Authentication never completes
Authentication never completes
The OAuth flow ends on Gecko’s authorization screen; if Approve is
replaced by a plan message, the selected team is on the Free tier, and
if no team is offered, you lack the
api_keys.manage permission. Fix
the gate, then run /mcp > Authenticate again.The server shows as failed after adding it
The server shows as failed after adding it
Confirm the transport is
http (not sse); the server is stateless
Streamable HTTP and rejects session-based transports. Then run the curl
smoke test from the overview to
separate a network problem from a client one.It worked, then stopped
It worked, then stopped
If you connected with an API key, the key was probably deleted or your
role changed; keys die immediately on deletion. Re-add with a fresh key,
or switch to OAuth so there’s no static secret to lose.