The score rates what is about to be installed, and when a score is not enough the file tools read the published artifact itself — install scripts included — without pulling it into your tree. The organization tools turn the same connection on what you already depend on: alerts by severity, and a feed of packages flagged as malware. The hosted server is the fast way in; self-hosting is the answer when the package names themselves should not leave your network.
Socket's supply-chain data in seven tools: a dependency score for packages you name, your organization's alert and threat feeds, and file-level inspection of any published package. It runs as a public hosted server or as a package you host yourself.
- Dependency scores for a list of packages, with 'unknown' accepted where the version is not known
- Your organization's latest security alerts, filtered by severity, category, status, artifact type or name, alert type and repo
- The organization threat feed — recently flagged malware, typosquats and obfuscated code — narrowed by ecosystem or category and paged through
- The file tree a package publishes, with paths and sizes, across npm, pypi, gem, cargo, maven, golang, nuget, chrome and openvsx
- A single file from a package read as UTF-8, up to 1 MB, with binaries returning metadata
- A regular-expression search inside one package file, returning matching lines with context; the file is cached per session so repeat searches skip the network
- The organization slugs the org-scoped tools require
Nothing to install for the public server at https://mcp.socket.dev/ — your client opens a browser to sign in to Socket on first connect, and there is no key to manage. Self-hosting keeps every request inside your own infrastructure and needs Node.js 24 or later plus a Socket API token; a token with the packages:list scope covers dependency scoring, and the organization tools need whatever scopes those endpoints require.
One command — pnpm add -g @socketsecurity/mcp