Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Socket server

Socket MCP server

Lets AI assistants query Socket dependency security scores and metadata across npm, PyPI, cargo, Maven, NuGet, RubyGems, Go and more, list org alerts and threat feed items, and inspect files inside published packages. Use the public hosted server or self-host the npm package. Socket hosts it at https://mcp.socket.dev/, or you can run @socketsecurity/mcp (npm) locally with OAuth or API key auth.

Last verified 7 tools8 sources

Install

Claude Code

About Claude Code
Terminal
claude mcp add --transport http socket-mcp https://mcp.socket.dev/

Cursor

About Cursor
JSON
{
  "mcpServers": {
    "socket-mcp": {
      "type": "http",
      "url": "https://mcp.socket.dev/"
    }
  }
}

VS Code

JSON
{
  "servers": {
    "socket-mcp": {
      "type": "http",
      "url": "https://mcp.socket.dev/"
    }
  }
}

Generic

JSON
{
  "mcpServers": {
    "socket": {
      "command": "mcp-remote",
      "args": ["https://mcp.socket.dev/"]
    }
  }
}

Tools

depscore
Query the Socket API for dependency scores, with a Socket report URL when an overall score exists.
organizations
List the Socket organizations the authenticated user belongs to.
alerts
List the latest security alerts (supply-chain, vulnerability, quality, license, maintenance) for one Socket organization.
threat_feed
Look up packages recently flagged as malware, typosquats, obfuscated code and similar in an organization's threat feed.
package_files
List the files published in a package, with size and blob hash.
package_file_contents
Read a single file from a package by its blob hash.
package_file_grep
Search a single file from a package for lines matching a JavaScript regular expression.

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • The README says 'This project is in early development and rapidly evolving'.
  • The public hosted server uses OAuth, so no API key is needed.
  • Self-hosting reads SOCKET_API_TOKEN in stdio mode, or takes a Bearer token per request in HTTP mode. package_file_contents and package_file_grep need no token.
  • The generic snippet is the documented mcp-remote local bridge (README pins mcp-remote 0.8.3) for clients that only launch stdio servers.
  • The README says Claude Desktop should add the hosted URL as a custom connector; the docs page still shows a Developer config file.
  • Windsurf uses the serverUrl form, which differs between README (https://mcp.socket.dev/mcp) and docs (https://mcp.socket.dev/).
  • Node.js 24+ is required to run from source.
  • Latest npm package version 0.2.1.
  • Codex is not documented.

More MCP servers for auth and security

Related reading

FAQ

What does the Socket MCP server do?

Lets AI assistants query Socket dependency security scores and metadata across npm, PyPI, cargo, Maven, NuGet, RubyGems, Go and more, list org alerts and threat feed items, and inspect files inside published packages. Use the public hosted server or self-host the npm package. The vendor documents 7 tools, including depscore, organizations, alerts and threat_feed.

How do I add the Socket MCP server to Claude Code?

Run claude mcp add --transport http socket-mcp https://mcp.socket.dev/, copied from Socket's docs. This page also has snippets for Cursor, VS Code and Generic.

Does the Socket MCP server need authentication?

Yes, OAuth or API key. Transport: Streamable HTTP, stdio. Status: Unlabelled, last checked October 17, 2026.

Sources

Last verified against 8 Socket pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.