# Get started with Gomboc Community Edition

### Introduction

This guide will help you quickly get started with Gomboc Community Edition to fix your code issues directly within your favorite development workflows.

**New 🎉:** Community Edition now includes Gomboc’s latest remediation engine powered by [**Open Remediation Language (ORL)**](/orl.md), which generates deterministic, merge-ready fixes. 

## Quick Start

***

### Sign up to create a Community account

1. Go to [Gomboc portal](https://app.gomboc.ai/) click "Sign Up".
2. You can choose to sign up with your Email or with GitHub SSO. 
   1. With Email, fill out your email, name, and organization.
   2. With GitHub SSO, click on the "GitHub" option and follow the oauth process to authorize access by selecting "Authorized Gomboc-AI".

### Choose where you would like to start: 

Whether you use VS Code, AI editors like Cursor, or need an actionable pull request in GitHub

<details>

<summary><strong>Get Started in VS Code or Cursor</strong></summary>

#### 0. Prerequisites

Before you start, make sure you have:

* **VS Code** version 1.63.0 or greater\
  <https://code.visualstudio.com/download>
* **Docker** is installed and **running** (Docker Desktop or Docker Engine)\
  <https://www.docker.com/products/docker-desktop/>

> **Why Docker?** The VS Code extension runs the ORL remediation engine locally inside a Docker container when you scan. If Docker isn’t running, scans/fixes won’t start.

#### 1. Generate a personal token

* [Here's](/getting-started/generate-a-personal-access-token.md) how to create a Gomboc personal access token.

#### 2. Set up the Gomboc VSCode plugin

* Install the Gomboc Plugin via the marketplace or direct in the IDE:
  * VS Code Marketplace (click "Install") [gomboc-vscode-extension](https://marketplace.visualstudio.com/items?itemName=GombocAI.gomboc-vscode-extension)

<figure><img src="/files/4P0KlY87GaTZ5G102aIY" alt="" width="563"><figcaption></figcaption></figure>

* VSCode Extensions tab. Search for "Gomboc" and click "Install":

  <figure><img src="/files/qio3VLBdDU4QemDziMhz" alt="" width="563"><figcaption></figcaption></figure>
* When you install the extension, be sure to enable "Auto Update".
* Once installed, open the product settings by doing one of the following:
  * click the gear icon and select "Settings":

    <figure><img src="/files/GctpDpZrZfeba3e7CIcY" alt="" width="563"><figcaption></figcaption></figure>
  * Open Settings > Extensions and search for "Gomboc."

    <figure><img src="/files/8jejDBumEw5DDiHpWaJI" alt="" width="375"><figcaption></figcaption></figure>

    <figure><img src="/files/7nrv1Kldl7c3eNCybub6" alt=""><figcaption></figcaption></figure>
* Paste your Personal Access Token into the Api Key field. Run `Gomboc: Test Api Key` from the command and enable "Scan on File Save".

  <figure><img src="/files/9DdlUnDszTtKybTunKOb" alt="" width="563"><figcaption></figcaption></figure>

#### 3. Run your first scan

Choose your path before running your scan&#x20;

* **Option 1 (Recommended):** Checkout the [Gomboc Reviewer guide](/integrations/vscode-plugin/gomboc-reviewer-webview.md)
* **Option 2 (Quick):** Problems panel → Apply Fix
  * Create a project with a **Terraform** file.
    * In your IDE, create a new folder called "gomboc-quickstart" and create a new file, `main.tf`&#x20;

      <figure><img src="/files/5M487INcqCPK2Oi3CHbY" alt="" width="563"><figcaption></figcaption></figure>

      * Populate that file with the following content:

        ```
        provider "aws" {
          region = "us-east-2"
        }

        data "aws_region" "current" {}

        resource "aws_dynamodb_table" "test_table_a" {
        }

        resource "aws_lambda_function" "myfunction" {
        }

        resource "aws_appsync_graphql_api" "test_api" {
          authentication_type = "API_KEY"
        }

        resource "aws_keyspaces_table" "mykeyspacestable" {
        }
        ```
      * Alternatively, check out <https://github.com/Gomboc-AI/rattleback> with the following command

        ```
        git clone git@github.com:Gomboc-AI/rattleback.git
        ```
  * Save the file, triggering Gomboc to scan it
    * Alternatively, click on the search bar and select "Show and Run Commands":

      <figure><img src="/files/gED2omvfPpJ90enQUVpJ" alt="" width="563"><figcaption></figcaption></figure>

      * Type "Gomboc" into the search and select "Gomboc: Scan current file or scenario":

        <figure><img src="/files/Iwa9bUCyMYhvna5yK6Ps" alt="" width="563"><figcaption></figcaption></figure>

#### 4. Apply the fixes

* Review the **Problems** panel → click **Apply Fix** (or **Apply All**).
* Save, test, and commit your changes.

{% hint style="info" %}
Want a realistic repo and a guided workflow? Continue with [**Gomboc Demo Cases**](/getting-started-ce/gomboc-demo-cases.md).
{% endhint %}

</details>

<details>

<summary><strong>Get Started in Claude Code</strong></summary>

#### 1. Prerequisites

Before you start, make sure you have:

* **Claude Code terminal client** \
  <https://claude.ai/code/family><br>
* **Docker** is installed and **running** (Docker Desktop or Docker Engine)\
  <https://www.docker.com/products/docker-desktop/>

> **Why Docker?** The Gomboc plugin runs the ORL remediation engine locally inside a Docker container when you scan. If Docker isn’t running, scans/fixes won’t start.

#### 2. Generate a personal token

* [Here's](/getting-started/generate-a-personal-access-token.md) how to create a Gomboc personal access token.
* Run `export RULE_SERVICE_TOKEN=<your_pat>` in your terminal to set the environment variable for the plugin to authenticate to Gomboc services.

#### 3. Install the Claude Code Plugin

You can install the Gomboc Community plugin for Claude Code by following these steps:

1. Start Claude Code
2. Run the `/plugin` command<br>

   <figure><img src="/files/mSjMWbCwV0u0pwotgzWC" alt=""><figcaption></figcaption></figure>
3. Select "Add Marketplace"<br>

   <figure><img src="/files/CbFbZtiWG3oPK16bcc5J" alt=""><figcaption></figcaption></figure>
4. Enter the url for [gomboc-community-skills](https://github.com/Gomboc-AI/gomboc-community-skills)<br>

   ```
   https://github.com/Gomboc-AI/gomboc-community-skills
   ```

   <figure><img src="/files/zzbjwSxsBKPVlmQVJW8B" alt=""><figcaption></figcaption></figure>
5. Select the gomboc-community-marketplace:<br>

   <figure><img src="/files/tPzO2AZjUH72miYSArdg" alt=""><figcaption></figcaption></figure>
6. Select "Browse Plugins"<br>

   <figure><img src="/files/iiCoqO91az1b1AyszIdv" alt=""><figcaption></figcaption></figure>
7. Select the Gomboc Community Plugin<br>

   <figure><img src="/files/vSE3jkmbSImgdqPsDUrq" alt=""><figcaption></figcaption></figure>

#### 4. Create your first fixes

* Run the /gomboc-community:fix slash comment and direct Gomboc to fix your code with Claude:<br>

  ```
  /gomboc-community:fix Make sure my RDS database is protected in production
  ```

  .
* Push the ORL rules that the plugin creates to your community account for use anywhere you code.

{% hint style="info" %}
Want a realistic repo and a guided workflow? Continue with [**Gomboc Demo Cases**](/getting-started-ce/gomboc-demo-cases.md).
{% endhint %}

</details>

<details>

<summary><strong>Get Started in GitHub</strong></summary>

#### 1. Install the Gomboc GitHub App

* [Click here to Install.](https://github.com/apps/gomboc-ai-community)
* Select the repos you’d like us to monitor (your own or [Gomboc demo example](https://github.com/Gomboc-AI/rattleback)).

#### 2. Scan & Generate Fixes

* Edit one of your Terraform files and create a pull request in your selected repo.
* Gomboc will:
  * Automatically scan your Terraform code
  * Open a new PR with:
    * A clear summary of what was fixed
    * Suggested secure code fixes

#### 3. Review Fixes & Share Feedback

* Head to the PR created by Gomboc, review the description, accept the fixes, and merge.
* Leave feedback via our [GitHub discussions channel.](https://github.com/Gomboc-AI/gomboc-ai-feedback/discussions/2)

</details>

<details>

<summary><strong>Get started with Gomboc MCP Server (Beta)</strong></summary>

With our Gomboc MCP server, you'll be able to use your own AI tool like Claude or ChatGPT and have it interact with Gomboc.

#### 1. Pull the Docker image [here](https://hub.docker.com/r/gombocai/mcp/tags)

#### 2. Generate a personal token

* [Here's](/getting-started/generate-a-personal-access-token.md) how to create a Gomboc personal access token.
* Once you have the image and token you can run the following command to run the MCP server:

```
docker run -p 3100:3100\
-e GOMBOC_PAT='GENERATED_GOMBOC_PAT' \
gombocai/mcp:latest
```

> For examples and details go to the [dedicated MCP user docs page](https://docs.gomboc.ai/integrations/mcp-server).

</details>

***

**Need help?** Leave feedback via our [Discussions channel.](https://github.com/Gomboc-AI/gomboc-ai-feedback/discussions/2)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.gomboc.ai/getting-started-ce.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.