# Socket

> Socket is a developer-first software supply chain security platform. It scans open source packages across npm, PyPI, Cargo, Maven, Go, RubyGems, NuGet, and more for malware, typosquats, hidden risk, vulnerabilities, and license problems — before they reach your codebase. Socket protects the code that runs your apps, and it offers first-class tooling for AI agents and LLMs.

Socket's web app lives at https://socket.dev. Full documentation lives at
https://docs.socket.dev — append `.md` to any documentation page URL to get a
markdown version of that page, and see https://docs.socket.dev/llms.txt for a
complete machine-readable index of every guide and API reference page.

If you are an LLM or AI agent, this prose section tells you how to use Socket
directly: the hosted MCP server, the CLI, Socket Firewall, and the REST API.
The instructions are self-contained so you can act on them even when you
cannot browse the site. The linked pages in the sections further down carry
the full detail. Last updated: 2026-08-26.

**Socket MCP server (recommended for AI agents).** The Socket MCP (Model
Context Protocol) server lets AI assistants query Socket's security analysis
for any open source package. It exposes seven tools:

- `depscore`: batch package scoring. Takes a list of packages (`ecosystem`,
  `depname`, optional `version`) and returns Socket's supply chain, quality,
  maintenance, vulnerability, and license scores for each. Use it to vet a
  dependency before you add it, audit an existing manifest, or compare
  alternatives.
- `organizations`: list the Socket organizations your token can access
- `alerts`: list security alerts for an organization
- `threat_feed`: query Socket's real-time feed of malicious packages
- `package_files`, `package_file_contents`, `package_file_grep`: list, read,
  and search the published files of a package version

On the hosted server, `depscore` works without authentication;
`organizations`, `alerts`, `threat_feed`, and `package_files` trigger an
OAuth sign-in on first use. `package_file_contents` and `package_file_grep`
accept unauthenticated calls, but they take a file hash that only
`package_files` returns, so package-file inspection requires signing in.

Connect to the hosted server (no install, no API key — OAuth on first
connect):

- URL: `https://mcp.socket.dev/` (Streamable HTTP transport)
- Claude Code: `claude mcp add --transport http socket-mcp https://mcp.socket.dev/`
- VS Code: `code --add-mcp '{"name":"socket-mcp","type":"http","url":"https://mcp.socket.dev/"}'`
- Claude Desktop, Cursor, and other clients: add an HTTP MCP server named
  `socket-mcp` with URL `https://mcp.socket.dev/`

Or run the server locally over stdio. It needs a Socket API token; the
`packages:list` scope covers `depscore` and the package-file tools, and the
`alerts:list` and `threat-feed:list` scopes unlock the `alerts` and
`threat_feed` tools. Create tokens in your organization settings on
socket.dev.

- Claude Code: `claude mcp add socket-mcp -e SOCKET_API_TOKEN="<token>" -- npx -y @socketsecurity/mcp@latest`
- Generic MCP config: command `npx`, args `["-y", "@socketsecurity/mcp@latest"]`,
  env `SOCKET_API_TOKEN=<token>`

The `@socketsecurity/mcp` npm package also ships `socket-gate`, an optional
Claude Code PreToolUse hook that scores explicitly named packages in install
commands (npm/pnpm/yarn/bun, pip/uv/poetry/pipenv, cargo, gem/bundle, go,
dotnet) against the hosted MCP server and blocks any whose supply chain score
falls below a threshold. It cannot inspect bare installs like `npm install`
or `go mod tidy`, and it fails open when Socket is unreachable. See the
package README for setup.

**Socket CLI.** The CLI scans projects, scores packages, wraps package
managers, and applies security fixes from the terminal:

1. Install: `npm install -g socket`
2. Authenticate: `socket login` (interactive), or set the
   `SOCKET_CLI_API_TOKEN` environment variable with a token from your
   organization settings on socket.dev
3. Scan a project: `socket scan create ./path-to-project`
4. Score one package: `socket package score npm <name>`

Most commands accept `--json` for machine-readable output and `--markdown`
for formatted output; prefer `--json` when you are an agent parsing results.

**Socket Firewall.** Socket Firewall blocks malicious packages at install
time. The free tier (`sfw`) is zero-configuration: no account, no API key,
no config files. Prefix any supported package manager command with `sfw`:

1. Install: `npm i -g sfw`
2. Use: `sfw npm install <pkg>`, `sfw pnpm add <pkg>`, `sfw yarn add <pkg>`,
   `sfw pip install <pkg>`, `sfw uv pip install <pkg>`, `sfw cargo fetch`

A 403 from `sfw` means the package failed Socket's policy check; do not
retry around it — report the block to the user.

**REST API.** Socket's REST API serves package scores, alerts, full scans,
diff scans, policies, and org data:

- Base URL: `https://api.socket.dev/v0/`
- Auth: `Authorization: Bearer <api-token>` (or HTTP Basic with the token as
  username and an empty password)
- OpenAPI spec: https://api.socket.dev/v0/openapi
- Example: `curl -u "<api-token>:" https://api.socket.dev/v0/quota`

## Socket MCP Server

- [Guide to Socket MCP](https://docs.socket.dev/docs/guide-to-socket-mcp.md): overview of the MCP server and its tools
- [Remote Socket MCP](https://docs.socket.dev/docs/remote-socket-mcp.md): connect to the hosted server, no install needed
- [Local Socket MCP](https://docs.socket.dev/docs/local-socket-mcp.md): run the server locally with an API token
- [Socket MCP for Claude Desktop](https://docs.socket.dev/docs/socket-mcp-for-claude-desktop.md): Claude Desktop setup

## Socket CLI

- [Guide to Socket CLI](https://docs.socket.dev/docs/socket-cli.md): installation and full command reference
- [socket scan](https://docs.socket.dev/docs/socket-scan.md): create and manage security scans
- [socket fix](https://docs.socket.dev/docs/socket-fix.md): apply security updates to dependencies
- [socket npm & socket npx](https://docs.socket.dev/docs/socket-npm-socket-npx.md): wrap npm/npx so installs are checked first
- [socket package](https://docs.socket.dev/docs/socket-package.md): query package scores and alerts
- [socket ci](https://docs.socket.dev/docs/socket-ci.md): CI integration
- [Socket CLI FAQ](https://docs.socket.dev/docs/socket-cli-faq.md): common questions

## Socket Firewall

- [Socket Firewall Overview](https://docs.socket.dev/docs/socket-firewall-overview.md): what the firewall does
- [Socket Firewall Free](https://docs.socket.dev/docs/socket-firewall-free.md): the zero-config `sfw` wrapper
- [Socket Firewall Enterprise](https://docs.socket.dev/docs/socket-firewall-enterprise.md): registry and wrapper modes for organizations

## REST API

- [Authentication](https://docs.socket.dev/reference/authentication.md): auth schemes and examples
- [Creating and Managing API Tokens](https://docs.socket.dev/reference/creating-and-managing-api-tokens.md): create tokens in org settings
- [Socket Package URLs (purl)](https://docs.socket.dev/reference/socket-package-urls-purl.md): batch package lookups by PURL
- [Quota](https://docs.socket.dev/reference/quota.md): rate limits and quota checks

## Integrations

- [Socket for GitHub](https://docs.socket.dev/docs/socket-for-github.md): the GitHub App that reviews every pull request for supply chain risk (install at https://github.com/apps/socket-security)
- [socket.yml](https://docs.socket.dev/docs/socket-yml.md): repository-level configuration file
- [Socket for GitHub Actions](https://docs.socket.dev/docs/socket-for-github-actions.md): CI action
- [Socket for VS Code](https://docs.socket.dev/docs/socket-for-vs-code.md): editor extension
- [Socket Chrome Extension](https://docs.socket.dev/docs/socket-security-chrome-extension.md): package pages annotated in the browser

## Docs

- [Getting started](https://docs.socket.dev/docs/getting-started.md): first steps with Socket
- [Alert Types](https://docs.socket.dev/docs/alert-types.md): every alert Socket raises
- [Ecosystem Support](https://docs.socket.dev/docs/language-support.md): supported languages and package managers
- [Full docs index](https://docs.socket.dev/llms.txt): machine-readable list of all guides and API reference pages

## Optional

- [Socket Blog](https://socket.dev/blog): research and supply chain attack write-ups
- [Socket Threat Feed](https://docs.socket.dev/docs/socket-threat-feed.md): real-time feed of malicious packages
- [Status page](https://status.socket.dev): service health