
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
Vinv MCP server — runtime evidence, semantic code search, and fault localization for any MCP client. Pairs with `pip install vinv`.
Give your AI agent runtime evidence. One MCP server exposing all of Vinv's tools — semantic code search, dead-code detection, fault localization over real runs, live values/slices/coverage, and the verify/optimize loop — to any MCP client (Claude Code, Claude Desktop, Cursor, …).
Vinv runs, tests, and finds issues in your Python services with zero code
changes. vinv-mcp hands that evidence to the agent you already use.
The MCP server drives the Vinv engines, which ship on PyPI. Install them so they
are on your PATH:
pip install vinv
# or:
uv tool install vinv
Add vinv-mcp to your client's MCP config once, globally (it runs over
stdio via npx, no global install needed) — no per-repo path required:
{
"mcpServers": {
"vinv": {
"command": "npx",
"args": ["-y", "vinv-mcp"]
}
}
}
The server discovers which folder to analyze automatically: it asks your client
for its open workspace via MCP roots (Claude Code, Cursor, VS Code), so one
config follows whatever repo you have open. Resolution order is
VINV_WORKSPACE → MCP roots → current working directory. Set
VINV_WORKSPACE (or pass the path as the first argument) only to pin a
specific repo — e.g. in a client that does not expose roots.
claude mcp add vinv -- npx -y vinv-mcp"env": { "VINV_WORKSPACE": "/absolute/path/to/your/repo" }.The semantic-search index builds itself in the background the moment the
server starts on a workspace (the first build also downloads the local
embedding model, ~500 MB, once). Nothing blocks: vinv_query returns a "still
indexing" notice and you fall back to text search until it is ready. Call
vinv_index any time to start/refresh the index or check status, or
vinv_index with rebuild: true to force a full rebuild.
vinv-mcp exposes the full Vinv tool set in one server:
| Area | Tools |
|---|---|
| Code index | vinv_query (semantic search), vinv_index (build/refresh), vinv_deadcode (unreferenced code), vinv_feedback, vinv_session |
| Runtime | rank_suspects, values_of, slice, coverage_of, callers_of, blast_radius, why_did_this_run, relevant_to |
| Exercise | vinv_ingest_run, vinv_run_status, vinv_list_candidates |
vinv-mcp multiplexes Vinv's three focused MCP servers (index / runtime /
exercise) into a single stdio server: tools/list merges every tool and
tools/call routes to the one that owns it. All analysis runs locally, on
your machine — no API keys, no telemetry.
Apache-2.0.
FAQs
Vinv MCP server — runtime evidence, semantic code search, and fault localization for any MCP client. Pairs with `pip install vinv`.
The npm package vinv-mcp receives a total of 425 weekly downloads. As such, vinv-mcp popularity was classified as not popular.
We found that vinv-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.