Socket MCP Server
Query dependency vulnerability scores and metadata directly within your AI workflow.
Data last scanned today · Reviewed today
Overview
Socket MCP Server integrates Socket.dev's security scoring and package analysis into any Model Context Protocol-compatible AI assistant. It provides visibility into security metadata for packages across multiple ecosystems, including npm, PyPI, cargo, and others, allowing users to audit dependencies or flag risks during a conversation. The server offers flexible deployment options, including a public hosted service with OAuth-based authentication or a self-hosted npm package for isolated environments. It supports batch processing for evaluating multiple dependencies at once.
Our verdict
With a security score of 48/100, this tool is classified as high-risk. This rating stems from the fact that the authentication method and read-only mode status have not yet been editorially reviewed, making it suitable for developers who are comfortable with these transparency gaps but perhaps not for those requiring strictly validated security configurations.
- Supports multiple package ecosystems including npm, PyPI, and cargo.
- Zero direct dependencies reduces the supply-chain attack surface.
- Provides a public hosted service to eliminate local setup.
- Active development with commits occurring daily.
- Security architecture has not yet been editorially reviewed.
- Authentication implementation lacks independent security verification.
- Status of read-only mode enforcement remains unverified.
Setup
{
"mcpServers": {
"socket-mcp": {
"args": [
"-y",
"@socketsecurity/mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| depscore | Query the Socket API for dependency scoring information. Returns supply chain, quality, maintenance, vulnerability, and license scores per package. | low |
| organizations | List the Socket organizations the authenticated user belongs to. | low |
| alerts | List the latest security alerts for one Socket organization: supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. | low |
| threat_feed | Look up items in a Socket organization's threat feed: packages recently flagged as malware, typosquats, obfuscated code, and similar. | low |
| package_files | List the files published in a package: a tree of file paths, each with its size and blob hash, for any package on a supported ecosystem. | low |
| package_file_contents | Read a single file from a package. | low |
| package_file_grep | Search a single file from a package for lines matching a JavaScript regular expression, returning matches with line numbers. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›Can I use the Socket MCP server without hosting it myself?
Yes, you can use the public hosted server at https://mcp.socket.dev/, which supports OAuth authentication through your MCP client.
›Do I need to manage an API key for the public hosted server?
No, the public server authenticates through your MCP client's OAuth flow, eliminating the need to copy or manage manual API keys.
›What deployment options are available for the Socket MCP server?
You can choose between using the public hosted service, running it locally via stdio, or deploying it via HTTP.
›How do I install the server if my client does not support HTTP transport?
For clients that only launch local stdio servers, you can use the mcp-remote package to create a local bridge to the hosted service.
›Does the Windsurf editor support the standard HTTP configuration?
No, Windsurf requires a different configuration using the serverUrl property set to https://mcp.socket.dev/mcp.
›What programming language ecosystems are supported for security scanning?
The server supports multiple ecosystems including npm, PyPI, cargo, Maven, NuGet, RubyGems, and Go Modules.
Changelog
Badge
Maintain this server? Add the live badge to your README.