Skip to content
ProductArena

How Gecko Security’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score35/100

Agent-ready 48.3 × 0.30 = 14.49

API quality 30.9 × 0.20 = 6.18

Openness 23.4 × 0.20 = 4.68

Built-in AI 36.9 × 0.15 = 5.53

Automation 24.8 × 0.15 = 3.72

(14.49 + 6.18 + 4.68 + 5.53 + 3.72) ÷ (0.30 + 0.20 + 0.20 + 0.15 + 0.15) = 34.60 ÷ 1.00 = 34.6

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready48.3/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

  • [probe] https://gecko.security/llms.txt“PROBE llms.txt: HTTP 200 at https://gecko.security/llms.txt # Gecko Security > Gecko Security is an AI security engineer that finds exploitable vulnerabilities and helps developer”
  • [probe] https://gecko.security/docs.md“PROBE docs-md: HTTP 200 at https://gecko.security/docs.md --- title: "Gecko Security - Gecko Security" description: "An AI security engineer that finds real, exploitable vulnerab”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”
  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/admin/api-keys.md“Give the key a descriptive name, such as `CI/CD Pipeline` or `Production`.”
  • [claimed-docs] https://gecko.security/docs/scanning/pr-checks.md“Gecko posts a pass/fail check back to GitHub or GitLab so reviewers see the security status inline.”
  • [claimed-docs] https://gecko.security/docs/scanning/pr-checks.md“**Fail-on severity**: the severity threshold that fails the check (for example, fail on High and above).”
  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”

Plug MCP servers into this product so it can use their toolsweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”
  • [probe] https://gecko.security/docs/ai-tools/overview“official MCP server documented at https://gecko.security/docs/ai-tools/overview”

Connect an agent via an official MCP serverweight 3

3 (weight) × 7 (quality) × 1.0 (full) = 21.0 of 30 max

  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”
  • [probe] https://gecko.security/docs/ai-tools/overview“official MCP server documented at https://gecko.security/docs/ai-tools/overview”
  • [probe] https://gecko.security/docs.md“PROBE docs-md: HTTP 200 at https://gecko.security/docs.md --- title: "Gecko Security - Gecko Security" description: "An AI security engineer that finds real, exploitable vulnerab”

Use an official CLIweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Drive the product through a documented public APIweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/changelog“API keys are now visible to the whole team with owner attribution and per-request usage logging”
  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”
  • [claimed-docs] https://gecko.security/docs/admin/api-keys.md“Give the key a descriptive name, such as `CI/CD Pipeline` or `Production`.”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”

Issue scoped/least-privilege API credentials for an agentweight 2

2 (weight) × 4 (quality) × 0.3 (disputed) = 2.4 of 20 max

  • [claimed-docs] https://gecko.security/docs/connect/github.md“The App grants Gecko scoped, auto-rotating access, with no personal access token to manage.”
  • [claimed-docs] https://gecko.security/docs/admin/api-keys.md“Give the key a descriptive name, such as `CI/CD Pipeline` or `Production`.”
  • [claimed-docs] https://gecko.security/docs/changelog“API keys are now visible to the whole team with owner attribution and per-request usage logging”
  • [claimed-docs] https://gecko.security/docs/changelog“PATCH /integrations/gitlab swaps in a fresh token, built for secret managers and rotation scripts.”
  • [community] https://news.ycombinator.com/item?id=44747204“OAuth flow asks for permission to write GitHub email/profile settings and 'act on my behalf' - concerning for a vuln scan tool, not just fine-grained repo access.”
  • [community] https://news.ycombinator.com/item?id=44747204“User objects to GitHub OAuth requesting 'act on your behalf' permission, equating it to full admin access across all repos and orgs; asks Gecko to use fine-grained GitHub App permissions instead, stating they'll never sign up otherwise.”

Build against official SDKsweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/changelog“API keys are now visible to the whole team with owner attribution and per-request usage logging”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”

Subscribe to events via webhooksweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”
  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”

Agent-ready = 101.4 ÷ 210 × 100 = 48.3

API quality30.9/100×0.20 of the PA blend

The programmable surface once an agent is there — machine-readable spec, interactive docs, sandbox, versioning discipline.

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”
  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”
  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 10 max

  • [claimed-docs] https://gecko.security/docs/quick-start.md“Paste a public repository URL or upload a ZIP instead. No provider connection required.”
  • [claimed-docs] https://gecko.security/docs/deployment/hybrid.md“the scanner, S3 storage, and all AI inference run inside your AWS account. Gecko hosts only the dashboard, database, and scan orchestration.”
  • [claimed-docs] https://gecko.security/docs/deployment/hybrid.md“the scanner, S3 storage, and all AI inference run inside your AWS account.”

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 3 (quality) × 0.6 (partial) = 3.6 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/changelog“resolves a version to its release... the response includes the digest-pinned image_ref to pull”
  • [claimed-docs] https://gecko.security/docs/changelog“GET /releases/{channel}/{version} resolves a version to its release.”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”

API quality = 21.6 ÷ 70 × 100 = 30.9

Openness23.4/100×0.20 of the PA blend

Can you leave, inspect, or self-host — data export, open source, portability.

Do everything through the API that I can do in the UIweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“Repository wiki: An AI-written map of your app: architecture, routing, and security model.”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“Endpoint map: The HTTP attack surface Gecko discovered in your code.”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“PR reviews & fixes: On pull requests, a security review summary and one-click fixes.”

Export all of my data in open formats and leaveweight 3

3 (weight) × 3 (quality) × 0.6 (partial) = 5.4 of 30 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”

Read the product's source under an open licenseweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Self-host the core productweight 3

3 (weight) × 6 (quality) × 0.6 (partial) = 10.8 of 30 max

  • [claimed-docs] https://gecko.security/docs/deployment/hybrid.md“the scanner, S3 storage, and all AI inference run inside your AWS account. Gecko hosts only the dashboard, database, and scan orchestration.”
  • [claimed-docs] https://gecko.security/docs/deployment/hybrid.md“the scanner, S3 storage, and all AI inference run inside your AWS account.”
  • [claimed-docs] https://gecko.security/pricing“Unlimited scanning * On-prem / self-hosted / private cloud”

Openness = 23.4 ÷ 100 × 100 = 23.4

Built-in AI36.9/100×0.15 of the PA blend

Inside-out: how agentic the product itself is for its users — built-in assistants, autonomous features.

Get AI-generated insights and suggestions from my data inside the productweight 2

2 (weight) × 5 (quality) × 0.3 (disputed) = 3.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/quick-start.md“Each finding includes a severity (CVSS 4.0), a confidence score, the full source-to-sink call chain, a proof of concept, and a suggested patch.”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“Repository wiki: An AI-written map of your app: architecture, routing, and security model.”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“Endpoint map: The HTTP attack surface Gecko discovered in your code.”
  • [claimed-docs] https://gecko.security/docs/how-gecko-works.md“PR reviews & fixes: On pull requests, a security review summary and one-click fixes.”
  • [community] https://news.ycombinator.com/item?id=44747204“Tool gave 100% confidence for two vulnerabilities (severity 9.4 and 6.5) that turned out not to be real.”
  • [community] https://news.ycombinator.com/item?id=44747204“Ran Gecko on a C project after Semgrep AI flagged a minor real issue; Gecko found nothing. After removing the fix and recreating the project, scan showed as started but scan list stayed empty - suspected UI bug.”
  • [community] https://news.ycombinator.com/item?id=44747204“Uploaded a project (sydbox) to scan; took 10 minutes and found only one vulnerability, an 'RCE: IRC Message Command Execution Bypass' in an IRC bot script for a CTF server, deemed hilarious/inaccurate by the user.”

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”
  • [claimed-docs] https://gecko.security/docs/scanning/pr-checks.md“Gecko posts a pass/fail check back to GitHub or GitLab so reviewers see the security status inline.”
  • [claimed-docs] https://gecko.security/docs/quick-start.md“Click Request fix to open a gecko/* pull request with the patch applied, or apply the patch yourself.”
  • [claimed-docs] https://gecko.security/docs/quick-start.md“Gecko rechecks the finding and marks it Fix verified once the vulnerability is gone.”
  • [claimed-docs] https://gecko.security/docs/concepts/findings.md“create a ticket in Jira, Linear, ClickUp, or Shortcut”
  • [claimed-docs] https://gecko.security/docs/remediation/auto-fix-prs.md“Commit to an existing PR: For findings from a PR scan, Gecko can commit the fix directly to the PR's head branch so the fix rides along with the change.”

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

  • [claimed-docs] https://gecko.security/docs/quick-start.md“Click Request fix to open a gecko/* pull request with the patch applied, or apply the patch yourself.”
  • [claimed-docs] https://gecko.security/docs/concepts/findings.md“create a ticket in Jira, Linear, ClickUp, or Shortcut”
  • [claimed-docs] https://gecko.security/docs/quick-start.md“Click **Request fix** to open a `gecko/*` pull request with the patch applied, or apply the patch yourself.”
  • [probe] https://gecko.security/llms.txt“PROBE llms.txt: HTTP 200 at https://gecko.security/llms.txt # Gecko Security > Gecko Security is an AI security engineer that finds exploitable vulnerabilities and helps developer”
  • [community] https://news.ycombinator.com/item?id=44747204“Tool gave 100% confidence for two vulnerabilities (severity 9.4 and 6.5) that turned out not to be real.”
  • [community] https://news.ycombinator.com/item?id=44747204“Uploaded a project (sydbox) to scan; took 10 minutes and found only one vulnerability, an 'RCE: IRC Message Command Execution Bypass' in an IRC bot script for a CTF server, deemed hilarious/inaccurate by the user.”

Operate the product with natural-language commandsweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”
  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [probe] https://gecko.security/openapi.json“PROBE openapi: HTTP 200 at https://gecko.security/openapi.json — contains "openapi" key”
  • [probe] https://gecko.security/docs/ai-tools/overview“official MCP server documented at https://gecko.security/docs/ai-tools/overview”

Built-in AI = 33.2 ÷ 90 × 100 = 36.9

Automation24.8/100×0.15 of the PA blend

Depth of automation primitives — rules, scheduling, bulk operations, webhooks.

Perform bulk operations across many items at onceweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

  • [claimed-docs] https://gecko.security/docs/ai-tools/overview.md“Connect it to an AI tool and the tool can list your repositories and scans, pull full vulnerability evidence (proof of concept, call chain, patch diff), triage findings, and file tickets.”
  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”
  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

  • [claimed-docs] https://gecko.security/docs/api-reference/webhooks“Gecko can push events to your systems as scans run and findings change: page a channel when a scan fails, open a workflow when a critical lands”
  • [claimed-docs] https://gecko.security/docs/scanning/pr-checks.md“**Fail-on severity**: the severity threshold that fails the check (for example, fail on High and above).”
  • [claimed-docs] https://gecko.security/docs/concepts/findings.md“create a ticket in Jira, Linear, ClickUp, or Shortcut”
  • [claimed-docs] https://gecko.security/docs/quick-start.md“Click Request fix to open a gecko/* pull request with the patch applied, or apply the patch yourself.”

Schedule recurring jobs or workflowsweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [claimed-docs] https://gecko.security/docs/api-reference/introduction.md“Gecko's v1 API lets you trigger scans, read scan, repository, and vulnerability data, triage findings, manage scan schedules, rotate your GitLab token, and receive webhook events”

Version, review, and roll back my automationsweight 1

1 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 10 max

  • [claimed-docs] https://gecko.security/docs/quick-start.md“Click Request fix to open a gecko/* pull request with the patch applied, or apply the patch yourself.”
  • [claimed-docs] https://gecko.security/docs/quick-start.md“Gecko rechecks the finding and marks it Fix verified once the vulnerability is gone.”
  • [claimed-docs] https://gecko.security/docs/concepts/findings.md“create a ticket in Jira, Linear, ClickUp, or Shortcut”

Automation = 19.8 ÷ 80 × 100 = 24.8