# Socket.dev (Dependency Security) MCP for AI Agents AI Agent Connect > Socket.dev (Dependency Security) protects your software supply chain by scanning dependencies for malware, checking security scores, and monitoring real-time threat feeds directly through your AI agent. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/ai-agent-connect - **Tags:** supply-chain-security, dependency-scanning, open-source-security, malware-detection, devsecops, package-analysis ## Description Socket.dev (Dependency Security) lets you spot malicious code in your dependencies before it hits your production environment. You can have your AI agent scan manifest files like package.json or requirements.txt to identify risks instantly. It pulls in data on typosquatting, backdoors, and other supply chain threats so you don't have to hunt for them manually. You can check security scores for specific libraries to see if they're safe to include in your project. This Connector is available through the Vinkius catalog, giving you a direct way to audit your software supply chain. It's about moving faster while keeping your codebase locked down against external threats. ## Tools ### create_scan Upload your package.json or requirements.txt to start a new security audit. This gives you a clear picture of your current risks. ### delete_scan Remove a specific scan from your history. This helps keep your workspace clean. ### get_package_issues Fetch all known alerts for a specific package. You'll see exactly what issues need your attention. ### get_package_score Get the current security score for a library. Use this to decide if a package is safe to use. ### get_quota Check your remaining API usage. This ensures you don't run out of credits during a big audit. ### get_report Pull the full details of a security report. This provides the deep dive you need for compliance. ### get_scan View the status and metadata of a specific scan. This lets you track progress on large audits. ### get_threat_feed Access the real-time list of malicious packages. Use this to stay ahead of new supply chain attacks. ### list_organizations See all organizations linked to your token. This helps manage access across different teams. ### list_reports Get a list of all available security reports. This makes it easy to find past audit results. ## Prompt Examples **Prompt:** ``` Check the security score for the npm package 'axios'. ``` **Response:** ``` I've checked the security score for `pkg:npm/axios`. It currently has a high security score of 98/100, with no critical issues detected in the latest version. ``` **Prompt:** ``` List all security reports for my organization. ``` **Response:** ``` I've retrieved the reports. You have 3 recent scans available. Would you like me to get the details for the most recent report (ID: rep_12345)? ``` **Prompt:** ``` Show me the real-time threat feed from Socket. ``` **Response:** ``` Fetching the threat feed... I found several recently flagged malicious packages, including 'discord-selfbot-v14' which was flagged for containing malware. Be cautious if these appear in your dependencies. ``` ## Capabilities ### Upload manifest files for security audits You can send your package.json or requirements.txt to the agent to start a new scan. ### Get issues for a specific package The agent will pull all known alerts and security issues for a library like npm/babel. ### Check a package's security score You can quickly see a safety rating for any package to decide if it's safe to use. ### Access the real-time threat feed Your agent can pull the latest list of malicious packages detected by the Socket engine. ### List all security reports You can see a full list of previous scans and reports available to your account. ### Check remaining API quota The agent can tell you how many requests you have left for the month. ## Use Cases ### Checking a package's safety A developer wants to know if 'axios' is safe before adding it to a project. They ask the agent to check the security score. ### Scanning a new repository A security engineer needs to audit a new project's dependencies. They upload the package.json to create a full scan. ### Monitoring for new threats A DevOps lead wants to see if any recently flagged malware is in their stack. They ask the agent to pull the threat feed. ### Auditing organization compliance A security lead wants to see all past reports for their company. They ask the agent to list all reports. ## Benefits - Stop typosquatting by checking safety ratings for every library using get_package_score. - Automate dependency audits of your package.json or requirements.txt files with create_scan. - Stay ahead of new malware by pulling the latest data from the get_threat_feed. - Manage organizational security posture across multiple teams using list_organizations. - Keep track of your security history and find specific audit data with list_reports. - Avoid running out of credits by monitoring your remaining API usage with get_quota. ## How It Works The bottom line is you get a clear view of your supply chain risks without manual auditing. 1. Connect your Socket.dev API token to your AI client. 2. Ask your agent to scan a manifest file or check a specific package score. 3. Review the security risks and threat intelligence provided in the response. ## Frequently Asked Questions **Can Socket.dev (Dependency Security) find malware in my npm packages?** Yes. It connects to Socket's analysis engine to identify malicious packages, typosquatting, and backdoors in your dependencies. **How does Socket.dev (Dependency Security) protect my software supply chain?** It proactively scans your manifest files and provides real-time threat intelligence so you can block malicious code before it enters your codebase. **Can I use Socket.dev (Dependency Security) to scan a requirements.txt file?** Yes. You can ask your agent to create a new scan by uploading the contents of your requirements.txt or package.json file. **Does Socket.dev (Dependency Security) provide real-time threat intelligence?** Yes. It can pull a live feed of malicious packages detected by Socket's telemetry to help you stay ahead of new attacks. **How do I check the safety of a new library with Socket.dev (Dependency Security)?** You can ask your agent to pull the security score and any known issues for a specific package name to see if it's safe to use. **Can Socket.dev (Dependency Security) manage reports for multiple organizations?** Yes. It can list the different organizations your token has access to and retrieve security reports for each one. **How can I check if a specific npm package is safe to use?** You can use the `get_package_score` tool by providing the Package URL (PURL), such as `pkg:npm/lodash`. The agent will return a security score and risk assessment. **Can I scan my entire project's dependencies at once?** Yes! Use the `create_scan` tool and provide the content of your manifest files (like `package.json`). Socket will analyze all dependencies and generate a report. **How do I see the specific security issues found in a package?** Use the `get_package_issues` tool with the package's PURL. It will list all alerts, such as telemetry, install scripts, or known vulnerabilities associated with that package.