Built on Solana“I need my agent to use the Stripe, Jupiter, whatever-is-next API.”
One line adds it. No client to hand-write.
Open source · Built in public
Where agents and APIs
finally speak the same language.
Gecko translates any API, even the messy, undocumented ones, into tools your agent calls right the first time. Your key stays hidden on your machine, nothing to paste, nothing to steal. And a manipulated API can't trick your agent. Gecko spots the poison before it acts.
Try it now
$ npx @geckovision/gecko add <your-api>gecko — add
THE JOURNEY
You have felt this before. Every API, every agent.
“Do I paste my API key into mcp.json? Into an env var?”
Neither. Your key stays hidden on your machine and is used only at the moment of the call. Never in a file, never inside the agent.
“The agent called it and got a 400. Then a 401. Then another 400.”
Gecko read the API first. Your agent calls it right the first time: right params, right auth.
“I don't want to burn rate limits or real money just to test.”
Recorded mode proves every call offline, for $0.
“It worked yesterday. Now it's a 401 at 3am. Who wrote a refresh loop?”
Sessions auto-refresh. The agent never sees the expiry.
“Fifth API, same pain, times five.”
One layer for every API. Keys out of reach, calls correct, no per-API glue.
For agent builders
Any API in your agent's hands. Your keys out of reach.
- One command adds any API to your agent, even messy or undocumented ones.
- Your key stays hidden on your machine, used only at call time. Never in a prompt.
- A manipulated API can't trick your agent: Gecko spots the poison before it acts.
- $0 recorded mode proves every call offline before a live request.
For API providers
Make your API the one agents call right.
- First-call-correct MCP tools, no integration code needed.
- Connect x402 and every correct call settles. You keep 100%.
- Flat monthly fee per API. Never a take-rate.
WHY NOW
The keys are already leaking.
- 28.65M
- new hardcoded secrets on public GitHub in 2025, up 34% in a year(GitGuardian)
- ~2×
- AI-assisted commits leak secrets at about twice the base rate(WorkOS)
- 24,008
- secrets found hardcoded in MCP config files on public GitHub(Ajay Raj Singh S.)
- 90%
- of orgs letting humans share credentials with agents expect to spend on undoing it by 2028(Gartner)
- 82.5%
- of Crypto and Web3 docs traffic is already agents(Mintlify)
- 857
- tests green, live end to end on the TxODDS World Cup API(Gecko)
HOW IT WORKS
Three steps between your agent and any API.
01
CONNECT
Point Gecko at the API.
An OpenAPI spec or a docs URL. Even messy, undocumented, or paywalled. Gecko reads the API first and turns it into tools your agent picks by what you ask.
02
SECURE
Your key stays on your machine.
Sealed in the OS keychain, never in a file. The agent never sees it: nothing to paste, nothing to steal.
03
EXECUTE
The agent calls. It just keeps running.
The call is right the first time. The key joins only at the moment of the call, sent only to the API's own host. Log-ins refresh on their own; you stop babysitting.
Gecko never sees your data. The key never enters the agent, the model, your files, or Gecko's servers.
FAQ
Questions, before you install.
Where does my key actually live?+
In your OS keychain, the same vault your machine already uses for passwords. Gecko reads it on your machine at the moment of the call and sends it only to the API's own domain. It never enters the agent, your files, or Gecko's servers.
What can Gecko see?+
The API's shape (endpoints, parameters, schemas) and the tools generated from it. Never your responses, your data, or your secrets.
What if an API tries to trick my agent?+
It happens: a manipulated description or example crafted to steer an agent into a dangerous move. Gecko screens everything an API says before your agent sees it, and quarantines anything suspicious. Running today, on every API it reads.
What if my API has no OpenAPI spec?+
We read the docs. For Mintlify, Redoc, and Scalar we discover the spec behind the page. If we can't find one, we tell you what to paste.
Is it free?+
The engine is open source and free. Providers pay a flat per-API fee, never a take-rate.
Does it work outside Claude Code?+
Yes. Cursor or any MCP client via the hosted endpoint, or as a Python library with recorded mode ($0) or live.
How is this different from an MCP wrapper?+
Wrappers pass the API through raw and leave auth to you. Gecko reads the API first, adds the key itself at the moment of the call, and keeps the session alive on its own.
This page has a twin your agent can read. For agents →