Skip to directory

About Socket MCP

Socket MCP exposes package-security scoring and Socket organization intelligence to AI clients, with an OAuth-hosted server and a self-hosted npm server option.

What you can use it for

  • Inspect package dependency security and quality scores
  • Retrieve Socket organization metadata, alerts and threat-feed data when authorized
  • Inspect package files and file contents where supported by current catalog
Connection and setup
Hosting
both
Transport
Not documented
Endpoint
https://mcp.socket.dev/
Authentication
Hosted server authenticates through browser-based Socket OAuth on first connection. Self-hosted server uses SOCKET_API_TOKEN; the documented minimum packages:list scope permits package metadata/dependency score lookup, while organization tools require their own endpoint scopes.

Requirements

  • Socket account for OAuth or API token
  • MCP-compatible client supporting remote HTTP, or Node.js/npx for local stdio server

Setup steps

  1. Preferred hosted path: add https://mcp.socket.dev/ as a remote HTTP MCP server and complete Socket OAuth in the browser.
  2. Claude Code example: claude mcp add --transport http socket-mcp https://mcp.socket.dev/.
  3. For self-hosted stdio, run npx -y @socketsecurity/mcp@latest and set SOCKET_API_TOKEN in the client environment.
  4. For clients limited to stdio, the repository documents mcp-remote@0.8.3 as a local bridge to the hosted endpoint.
  5. Verify using a dependency score lookup for a named package/version.
Tools

Socket documents one depscore tool for package dependency security scoring. Public remote endpoint uses OAuth; local server requires a token with packages:list scope.

  • depscore

    Query Socket security and quality scores for package dependencies.

    01
Limitations and notes
  • Full tool schemas and roster are linked from the repository but GitHub's service-reference file could not be fetched in this pass.
  • Hosted OAuth access and organization-scoped tools may depend on Socket account permissions/client availability.
  • Windsurf docs state native `http` type is unsupported; its `serverUrl` form or self-hosted stdio setup is required.
  • No full browser OAuth flow or connection test performed.
Original sources
  • official tool reference

    Socket documents one depscore tool for package dependency security scoring. Public remote endpoint uses OAuth; local server requires a token with packages:list scope.

  • official documentation or source

    Socket documents one depscore tool for package dependency security scoring. Public remote endpoint uses OAuth; local server requires a token with packages:list scope.

Documentation checked 2026-10-28T14:15:00.000Z. Connection has not been runtime tested.

Views

07 days

Platforms

Remote

both

Authentication

Hosted server authenticates through browser-based Socket OAuth on first connection. Self-hosted server uses SOCKET_API_TOKEN; the documented minimum packages:list scope permits package metadata/dependency score lookup, while organization tools require their own endpoint scopes.

Sponsored