# Gecko

> Gecko gives your agent any API without exposing your keys: credentials are injected only at the moment of the call, and the calls are right the first time.

**Open source · Built in public**

## Give your agent any API. Never expose your keys.

Gecko turns any API into tools your agent calls right the first time. Your key is injected only at the moment of the call, sent only to the API's own host. Never in your files, never in the agent's context.

## THE JOURNEY

### You have felt this before. Every API, every agent.

- **"I need my agent to use the Stripe, Jupiter, whatever-is-next API."** — One line adds it. No client to hand-write.
- **"Do I paste my API key into mcp.json? Into an env var?"** — Neither. Your key stays in your keychain and is injected only at the moment of the call. Never in a file, never in the agent's context.
- **"The agent called it and got a 400. Then a 401. Then another 400."** — Gecko read the API first. Your agent calls it right the first time: right params, right auth.
- **"I don't want to burn rate limits or real money just to test."** — Recorded mode proves every call offline, for $0.
- **"It worked yesterday. Now it's a 401 at 3am. Who wrote a refresh loop?"** — Sessions auto-refresh. The agent never sees the expiry.
- **"Fifth API, same pain, times five."** — One layer for every API. Keys out of reach, calls correct, no per-API glue.

### Get started

Add the live surface to Claude Code — no key, $0, offline:

```bash
claude mcp add --transport http gecko-txline https://mcp.geckovision.tech/txline/mcp
```

Claude Code plugin: `/plugin marketplace add GeckoVision/gecko-surf` · CLI: `uvx --from "gecko-surf[serve]" gecko serve <your-api>`

## WHY NOW

### The keys are already leaking.

- **28.65M** — new hardcoded secrets on public GitHub in 2025, up 34% in a year (GitGuardian)
- **~2×** — AI-assisted commits leak secrets at about twice the base rate (WorkOS)
- **24,008** — secrets found hardcoded in MCP config files on public GitHub (Ajay Raj Singh S.)
- **90%** — of orgs letting humans share credentials with agents expect to spend on undoing it by 2028 (Gartner)
- **82.5%** — of Crypto and Web3 docs traffic is already agents (Mintlify)
- **857** — tests green, live end to end on the TxODDS World Cup API (Gecko)

## 01 — COMPREHEND (Live)

### A human-shaped spec becomes a tool your agent picks by intent.

Point Gecko at any OpenAPI, no provider help. A handful of intent-shaped tools. Auth resolved before a call goes out.

```
gecko.search("find the latest match odds") → prepare → call(mode="recorded")
```

- Any OpenAPI, zero provider cooperation.
- Auth misdeclared in the spec caught at comprehension, not on a failed call.
- Credentials hidden from the agent, injected at call time.
- Unreachable operations filtered out before the agent sees them.

## 02 — SIMULATE (Live)

### Prove the call before you spend a cent.

recorded mode synthesizes responses from the schema. $0, fully offline, correct before a live request goes out.

- Schema-generated responses, no network, no key, no spend.
- Same code path as live. Diverges only at the transport edge.
- Evaluate a paywalled API for $0 before subscribing.

## 03 — TEST (Live)

### Tests that prove first-call-correctness.

gecko test generates tests that assert the call matches the spec, run offline for $0.

- Green = first-call-correct. That's the whole assertion.
- Re-comprehend on drift, renamed field regenerates tools and tests. [Coming · V2]
- Tests are a pure function of the surface. Versionable, diffable.

## 04 — GO LIVE (Live)

### A hosted MCP your agent adds in one line.

One command. Credentials injected at call time, we're the control plane, never the data plane.

- Streamable-HTTP, one-click add to Claude or Cursor.
- Credentials injected at call time. Never custodied or logged.
- Control-plane only, we never see your response payloads.
- Re-comprehend instead of re-integrate when the API changes. [Coming · V2]

## For API providers

Own an API? See how Gecko makes it the one agents call right — and keeps it correct on every deploy: https://geckovision.tech/providers

## FOR AGENTS

### This page has a twin your agent can read.

HTML for humans. Markdown, manifest, and MCP endpoint for agents.

- [llms.txt](https://geckovision.tech/llms.txt): Curated index of this site (llmstxt.org shape).
- [llms-full.txt](https://geckovision.tech/llms-full.txt): The whole landing as one Markdown file.
- [index.md](https://geckovision.tech/index.md): Markdown twin of this page (text/markdown).
- [gecko.json](https://geckovision.tech/gecko.json): Machine-readable product manifest.
- [.well-known/gecko.json](https://geckovision.tech/.well-known/gecko.json): Discovery endpoint, the manifest at a known path.
- [MCP endpoint ↗](https://mcp.geckovision.tech/txline/mcp): Streamable-HTTP, one-click add to Claude or Cursor.
- [docs · llms.txt ↗](https://docs.geckovision.tech/llms.txt): The docs' own agent index, not the human home page.

## Links

- Website: https://geckovision.tech
- Docs: https://docs.geckovision.tech
- GitHub: https://github.com/GeckoVision/gecko-surf
- MCP: https://mcp.geckovision.tech/txline/mcp
- PyPI: https://pypi.org/project/gecko-surf/
- Discord: https://discord.gg/3gVF5NNbCa
- Install: /plugin marketplace add GeckoVision/gecko-surf

Open source, built in public. © 2026 Gecko · geckovision.tech