Socket MCP Server – Dependency Security Scores
Socket's official MCP server lets AI assistants check package dependency security and quality information from Socket. Use it when an agent is adding, reviewing, or auditing dependencies and needs supply-chain, vulnerability, maintenance, quality, and license scoring before code is merged.
Overview
Socket MCP Server is the official Model Context Protocol integration for
Socket dependency intelligence. It lets AI assistants check dependency
vulnerability scores and package security information while developers work in
tools such as Claude, VS Code Copilot, Cursor, and other MCP-compatible clients.
What the MCP server enables
Socket documents a depscore MCP tool that queries Socket package intelligence
for dependency scoring information. The tool accepts an array of packages and
can analyze packages across ecosystems such as npm, PyPI, Cargo, and other
package managers. For each dependency, Socket can return security and quality
signals such as:
- Supply-chain risk score.
- Quality score.
- Maintenance score.
- Vulnerability score.
- License score.
The tool supports batch processing so an agent can check multiple dependencies
in a single request. This is useful when a model proposes adding packages to
package.json, pyproject.toml, or another dependency manifest.
When to use it
Use Socket MCP when an AI coding agent is about to add a dependency, review a
dependency file, compare package alternatives, or assess the risk of generated
imports. Practical prompts include checking the security score for a specific
npm package, reviewing a proposed Python dependency, analyzing a set of
packages from a manifest, or requiring the agent to choose a safer alternative
when Socket reports low scores.
Connection and authentication
Socket supports three documented deployment paths. The easiest path is the
public hosted MCP server at https://mcp.socket.dev/, which requires no API key
or registration. Local stdio runs with npx -y @socketsecurity/mcp@latest and
requires SOCKET_API_KEY. Socket documents that the only required local API key
permission is packages:list, which allows the MCP server to query package
metadata for dependency scores.
Local HTTP mode runs the same package with MCP_HTTP_MODE=true,
SOCKET_API_KEY, and the --http flag, then exposes a local HTTP endpoint at
http://localhost:3000.
Key considerations
The public hosted server is simple and does not require authentication, but it
should be used only for package names and versions that can safely be sent to a
public service. Use a local deployment when you need an organization-controlled
API key, private workflow policy, or local network routing. Local API keys
should have the minimum packages:list permission and should be stored in a
secret manager or environment variable. Socket scores are decision-support
signals; review package behavior, project requirements, lockfiles, and normal
security controls before accepting or rejecting dependencies.
Supported Transports
streamable_http
URL: https://mcp.socket.dev/
streamable_http
URL: http://localhost:3000
stdio
Command: npx
Args:
-y@socketsecurity/mcp@latest
Frequently Asked Questions
- When should an AI agent use the Socket MCP server?
- Use it when an agent is adding, reviewing, or auditing dependencies and needs Socket package intelligence, such as checking a proposed npm, PyPI, Cargo, or other ecosystem package before updating a dependency manifest or generated imports.
- What does the Socket MCP server add to an AI agent's capabilities?
- It gives the agent a `depscore` tool for querying Socket dependency scores, including supply-chain, quality, maintenance, vulnerability, and license signals, instead of relying only on static model knowledge about packages.
- What can an AI agent access or manage through Socket MCP?
- The documented MCP capability is dependency scoring. The agent can submit package names, versions, and ecosystems to retrieve Socket score signals for one or more dependencies. It does not manage repositories, alerts, or organization settings through this MCP server.
- How is authentication configured for Socket MCP?
- The public hosted Socket MCP endpoint requires no API key or registration. Local stdio and local HTTP deployments require SOCKET_API_KEY. Socket documents packages:list as the only required permission scope for local MCP dependency-score queries.
- Which transport should be used for Socket MCP?
- Use the hosted Streamable HTTP endpoint at https://mcp.socket.dev/ for the fastest setup with no authentication. Use local stdio with `npx -y @socketsecurity/mcp@latest` when an MCP client launches local servers. Use local HTTP at http://localhost:3000 after starting the server with MCP_HTTP_MODE=true and the --http flag.