MCP SERVER · OFFICIAL PROJECTScore a dependency before it goes in, then open the package's own files to see what it actually ships.
LABSCO SUMMARY
The score rates what is about to be installed, and when a score is not enough the file tools read the published artifact itself — install scripts included — without pulling it into your tree. The organization tools turn the same connection on what you already depend on: alerts by severity, and a feed of packages flagged as malware. The hosted server is the fast way in; self-hosting is the answer when the package names themselves should not leave your network.
Socket's supply-chain data in seven tools: a dependency score for packages you name, your organization's alert and threat feeds, and file-level inspection of any published package. It runs as a public hosted server or as a package you host yourself.
Nothing to install for the public server at https://mcp.socket.dev/ — your client opens a browser to sign in to Socket on first connect, and there is no key to manage. Self-hosting keeps every request inside your own infrastructure and needs Node.js 24 or later plus a Socket API token; a token with the packages:list scope covers dependency scoring, and the organization tools need whatever scopes those endpoints require.
One command — pnpm add -g @socketsecurity/mcp
USE CASES
Score it before it reaches the lockfile, and when the score is not decisive, look at what the package actually publishes.
The published artifact opens file by file — up to 1 MB of text per read, and a regex search with context for the rest — without pulling it into your tree first.
Alerts filter down to the severity and category worth acting on today, scoped to one repo when the question is about one service.
The threat feed carries recently flagged packages — malware, typosquats, obfuscated code — narrowed to your ecosystem and paged through.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
alertsList the latest security alerts for a Socket organization with the alerts tool. Requires org_slug — call the organizations tool first if you don't have it. Supports filtering by severity, category, status, artifact type/name, alert type, and repo. Use this to surface supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. Results are paginated — pass the previous response's endCursor as cursor to fetch the next page.
depscoreGet the dependency score of packages with the depscore tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).
organizationsList the Socket organizations the authenticated user belongs to with the organizations tool. Use this to discover the org_slug values needed by other org-scoped tools (e.g. alerts, threat_feed), or when the user asks which organizations they have access to.
package_file_contentsRead a single file from a package using the package_file_contents tool from Socket. Pass the hash printed next to each entry in package_files output. Returns up to 1 MB of UTF-8 text; binary files return metadata only.
package_file_grepSearch a single file from a package for lines matching a JavaScript regular expression. Pass the hash printed next to each entry in package_files output. The file is fetched from Socket once per session and cached, so repeated greps on the same hash skip the network. Returns matching lines with line numbers (grep -n style); binary files are refused. Useful for locating a specific symbol, import, or string inside a dependency without dumping the whole file.
package_filesList the files published in a package using the package_files tool from Socket. Returns a tree of paths and sizes for any package on a supported ecosystem (npm, pypi, gem, cargo, maven, golang, nuget, chrome, openvsx). Useful for inspecting what a dependency ships before installing it. After calling this, use package_file_contents with one of the paths to read the file's contents.
threat_feedLook up items in the Socket organization threat feed with the threat_feed tool. Requires org_slug — call the organizations tool first if you don't have it. Returns recently flagged packages (malware, typosquats, obfuscated code, etc.) along with a nextPageCursor for pagination. Use filter to narrow the threat category (default mal for malware), ecosystem to scope to a registry, or name/version to look up a specific package. Pass the previous response's cursor as cursor to fetch the next page.
BEFORE YOU INSTALL
7 tools when we connected. Without a token, only depscore answers; four of the other tools return an auth-required error.
CONTEXT COST
Rated by the size of the 7 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
pnpm add -g @socketsecurity/mcphttps://mcp.socket.dev/mcpAdd this hosted endpoint to your MCP client.
{
"servers": {
"socket-mcp": {
"type": "http",
"url": "https://mcp.socket.dev/"
}
}
}{
"mcpServers": {
"socket-mcp": {
"type": "http",
"url": "https://mcp.socket.dev/"
}
}
}claude mcp add --transport http socket-mcp https://mcp.socket.dev/{
"mcpServers": {
"socket-mcp": {
"serverUrl": "https://mcp.socket.dev/mcp"
}
}
}droid mcp add socket https://mcp.socket.dev/ --type http{
"mcpServers": {
"socket-mcp": {
"command": "socket-mcp",
"env": {
"SOCKET_API_TOKEN": "<YOUR_SOCKET_API_TOKEN>"
}
}
}
}MCP servers
qianniuspace
double527
tiluckdave
Nekzus