Socket
MCP server by Socket
Check supply-chain security scores for npm, PyPI, Maven, Go and other packages, and inspect package files before installing.
Connect to Socket
No sign-in needed. Connect with Socket’s own URL:
Paste it into any client that supports remote MCP servers. Your client talks to Socket directly, not through mcp.tc.
Share this server
Opens this page, with the URL and setup steps.
mcp.tc/i/socketAbout
Socket connects your assistant to Socket's dependency security data. It scores packages for vulnerabilities, malware, supply chain risk, quality, maintenance and license issues across ecosystems such as npm, PyPI, Cargo, Maven, NuGet, RubyGems and Go. It can also list organization alerts, read the threat feed, and browse or grep the files a package ships.
A hosted endpoint is available at https://mcp.socket.dev/ over streamable HTTP, and the README describes an OAuth sign-in through your MCP client. You can also self-host the npm package @socketsecurity/mcp with a Socket API token and Node.js 24 or later. Sessions on the hosted server may occasionally need a fresh initialize.
What you can do
- Score packages for security, quality and maintenance
- Audit dependencies found in manifests and code imports
- List Socket organizations you belong to
- List security alerts with severity and status filters
- Browse the threat feed for malware and typosquats
- List files published in a package
- Read or grep a single file inside a package
Tools 7
depscoreRead-onlyGet dependency quality and security scores for packages; use 'unknown' when the version is not…
organizationsRead-onlyList the Socket organizations the signed-in user belongs to and their org_slug values.
alertsRead-onlyList latest security alerts for an organization with filters and pagination.
threat_feedRead-onlyLook up recently flagged packages such as malware and typosquats, with filters and pagination.
package_filesRead-onlyList the files and sizes published in a package across supported ecosystems.
package_file_contentsRead-onlyRead a single file from a package, up to 1 MB of text.
package_file_grepRead-onlySearch a package file for lines matching a JavaScript regular expression.
Read from the live server on 3 Oct 2026. Read-only, Writes and Can delete are hints the server declares; your client decides whether to ask before running a tool.
Example prompts
Check the security score for express version 4.18.2
Audit the dependencies in my package.json for risky packages
Show the latest high severity alerts for my Socket organization
List the files in the npm package left-pad before I install it
Set up
Every client connects to mcp.socket.dev. Pick yours; the page remembers your choice.
Claude Code
- Run this in a terminal, in your project folder:
claude mcp add --transport http socket https://mcp.socket.dev/- Start Claude Code and type
/mcp. socket should show as connected.
Add --scope user to make it available in every project, not just this one.
Claude Desktop
- Open Settings → Connectors and click Add custom connector.
- Name it Socket and paste this URL:
https://mcp.socket.dev/- Click Add. Its tools appear in the chat’s tools menu.
Claude Desktop’s JSON config file only starts local servers. Remote servers go through Connectors, and connectors you add on claude.ai show up here too.
claude.ai
- Open the connector form on claude.ai. This button fills in the name and URL for you:
Add to claude.ai (opens in a new tab)
- Check that the URL reads
https://mcp.socket.dev/and click Add. - Turn it on in a chat from the tools menu.
Free plans allow one custom connector. On Team and Enterprise plans an owner adds it under Organization settings → Connectors.
ChatGPT
- On chatgpt.com, open Settings → Security and login and turn on Developer mode.
- Go to
chatgpt.com/pluginsand click + to create an app for a remote MCP server. - Paste
https://mcp.socket.dev/as the server URL and choose No authentication.
Developer mode is available on the web for Plus, Pro, Business, Enterprise and Education accounts.
Cursor
Add to Cursor (opens in a new tab)
Or add it by hand to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project):
{
"mcpServers": {
"socket": {
"url": "https://mcp.socket.dev/"
}
}
}VS Code
Install in VS Code (opens in a new tab)
Or from a terminal:
code --add-mcp '{"name":"socket","type":"http","url":"https://mcp.socket.dev/"}'Or commit it to the repo in .vscode/mcp.json:
{
"servers": {
"socket": {
"type": "http",
"url": "https://mcp.socket.dev/"
}
}
}Devin Desktop
- Add it to
~/.config/devin/mcp_config.json(macOS and Linux) or%APPDATA%\devin\mcp_config.json(Windows):
{
"mcpServers": {
"socket": {
"serverUrl": "https://mcp.socket.dev/"
}
}
}- Refresh the MCP server list in Cascade.
Devin Desktop is the new name for Windsurf. It reads serverUrl (or url) for remote servers.
Codex
codex mcp add socket --url https://mcp.socket.dev/Or edit ~/.codex/config.toml directly:
[mcp_servers.socket]
url = "https://mcp.socket.dev/"Gemini CLI
gemini mcp add --transport http socket https://mcp.socket.dev/This adds it to the current project. Add -s user to use it everywhere.
Any client
Most clients accept this shape. Some name the URL field differently: serverUrl in Devin Desktop, httpUrl in Gemini CLI’s settings file.
{
"mcpServers": {
"socket": {
"type": "http",
"url": "https://mcp.socket.dev/"
}
}
}Zed puts servers under context_servers in its settings. Cline needs "type": "streamableHttp", or it assumes SSE.
Client only starts local servers? Bridge it with npx -y mcp-remote https://mcp.socket.dev/.
FAQ
Can I paste mcp.tc/i/socket into my MCP client?
No. mcp.tc links are pages, not server addresses. Connect with https://mcp.socket.dev/, so your client talks to Socket directly. The quick link is for sharing: it opens this page, with setup steps for every client.
Does Socket need an API key or a sign-in?
No. Socket doesn’t ask for an account or key.
Is Socket a remote or a local server?
Remote. Socket hosts it at https://mcp.socket.dev/, and it speaks Streamable HTTP. There’s nothing to install.
What can Socket do?
It has 7 tools, including depscore, organizations and alerts. You can score packages for security, quality and maintenance, audit dependencies found in manifests and code imports and list Socket organizations you belong to.
Which clients can use it?
Any client that supports remote MCP servers: Claude Code, Claude Desktop, claude.ai, ChatGPT in developer mode, Cursor, VS Code, Devin Desktop, Codex, Gemini CLI, Zed and others. The setup steps cover each one.
Who wrote this page?
mcp.tc’s robot read Socket’s own metadata (its MCP handshake, tool list and public pages), and an AI model drafted the text from it. A person reviews anything the checks can’t confirm. The text can still be wrong, so if you spot a mistake, use Report this listing on this page.
Embed
Show Socket in a README or on your site. Each embed links to this page, uses the server’s own URL, and sets no cookies. How embeds work
README badge
[](https://mcp.tc/i/socket)<a href="https://mcp.tc/i/socket"><img src="https://mcp.tc/i/socket/badge.svg" alt="Socket on mcp.tc" height="20"></a>It follows the reader’s light or dark mode. Add ?theme=light or ?theme=dark to fix it, or ?style=compact to show the mark without the word.
Website card
<script src="https://mcp.tc/w/socket.js" async></script>The card appears where the tag is. Add data-theme="dark" or data-size="compact" to the tag to change it. The file holds everything it needs, so it makes no other requests and sets no cookies.
iframe
<iframe src="https://mcp.tc/embed/socket" title="Socket on mcp.tc" width="420" height="200" loading="lazy" allow="clipboard-write" style="border:0;border-radius:8px;max-width:100%"></iframe>Use it on pages that don’t allow scripts. Add ?theme=light or ?theme=dark to the address to fix the colors.
JSON
The listing as data for your own pages and tools: name, tagline, the server’s own URL, tools and the “Add to” links. Any site can read it (CORS is open).
https://mcp.tc/i/socket.jsonmcp.tc isn’t affiliated with Socket. This page was built from Socket’s public metadata, last checked on 3 Oct 2026, and an AI model wrote the description, so it can be wrong. Names and marks belong to their owners. Something off? Report this listing.