Socket MCP Server

What it does

Socket MCP Server connects an MCP client to Socket's supply-chain data, so an assistant can look up how risky a dependency is before you add it. The depscore tool takes a batch of packages (npm by default, also PyPI, Go, Maven, RubyGems, NuGet, Cargo, Composer and other PURL types) and returns Socket's score components for each, with a link to the package report.

With a Socket account, three more tools reach your organization's data: organizations finds your org slug, alerts lists the open or cleared issues Socket has raised on the packages your org monitors, and threat_feed pages through packages Socket has flagged as malware, typosquats or obfuscated code. Three further tools look inside a published package without installing it: package_files lists its files with sizes and hashes, package_file_contents reads one file (up to 1 MB of text; binary files give metadata only) and package_file_grep searches one file with a regular expression, returning up to 100 matching lines by default and at most 500.

You can connect to Socket's hosted server at https://mcp.socket.dev/, which signs in with OAuth, or run the socket-mcp program yourself over stdio or HTTP with a Socket API token. The tools registered in lib/server.mts at v0.2.1 are the same seven the service reference lists. In self-hosted HTTP mode the code only lets depscore fall back to the operator's startup token; the org-scoped tools need each caller's own token and return an authentication error without one, so one deployment does not expose the operator's org data to everyone who can reach it. The repository also ships an optional Claude Code hook that blocks package installs scoring below 20 on supply chain; it is separate from the MCP tools.

What it needs

Hosted: a Socket account to complete the OAuth sign-in; on Claude Team and Enterprise plans an organization owner must add the custom connector first. Self-hosted: Node.js 24 or later, the package installed globally (pnpm add -g @socketsecurity/mcp), and a Socket API token from the socket.dev dashboard with the packages:list scope; the org tools need whatever extra scopes your organization's endpoints require.

Limits

Its makers call it early-stage and fast-changing. In stdio mode one token is read at startup; without it every API-backed tool returns an authentication message, and only package_file_contents and package_file_grep work. alerts returns 100 results per page by default (up to 5000) and threat_feed 30 (up to 100). Self-hosted HTTP mode listens on port 3000 unless MCP_PORT is set and refuses request bodies over 4 MiB. Windsurf cannot use the http connection type; its docs give a serverUrl form or the stdio setup instead. The bundled hook is best-effort: it misses installs from edited manifests, direct downloads and transitive dependencies, and allows installs when Socket is unreachable.

Who it suits

Developers who want an assistant to check a package's supply-chain risk or read what a published package actually contains before adding it. The hosted endpoint suits individuals who would rather sign in once with OAuth than handle a token; self-hosting over stdio suits one developer with an API token who wants calls to go straight from their own machine, and HTTP mode suits a team running one shared instance behind its own OAuth issuer. All tools only read data, so it does not fix or update dependencies. The org alert and threat feed tools are only useful if your organization already uses Socket.