What is this MCP used for?

It is used to protect your software supply chain by scanning dependencies and monitoring for malicious packages through your AI agent.

Which clients can I use with this MCP?

You can use this with any MCP-compatible client, including Claude, Cursor, Windsurf, and VS Code.

How do I check a package's safety?

You can ask your agent to get the security score or get package issues for a specific package using its PURL.

Can I scan my existing project files?

Yes, you can use the create_scan capability to upload manifest files like package.json or requirements.txt for analysis.

Does this work for Python and Go?

Yes, the capability supports various package managers including npm, PyPI, and Go.

How can I check if a specific npm package is safe to use?

You can use the get_package_score capability by providing the Package URL (PURL), such as pkg:npm/lodash. The agent will return a security score and risk assessment.

Can I scan my entire project's dependencies at once?

Yes! Use the create_scan capability and provide the content of your manifest files (like package.json). Socket will analyze all dependencies and generate a report.

How do I see the specific security issues found in a package?

Use the get_package_issues capability with the package's PURL. It will list all alerts, such as telemetry, install scripts, or known vulnerabilities associated with that package.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect Socketdev Dependency Security to ChatGPT and Claude

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Catch malicious packages before they hit your codebase.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Socket.dev.

01
Delete scan
This capability removes a previously created security scan from your history.
02
Get package issues
This capability retrieves specific security alerts and issues for a package identified by its PURL.
03
Create scan
This capability starts a new security scan by processing the data from your manifest files like package.json or requirements.txt.
04
Get package score
This capability fetches the current security score for a specific package using its PURL.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Socket.dev.

05
Get quota
This capability checks how much of your API usage quota you have left.
06
Get report
This capability pulls the full, detailed data from a specific security report.
07
Get scan
This capability retrieves the metadata and current status of a specific scan.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Socket.dev.

08
Get threat feed
This capability accesses the live feed of malicious packages detected by Socket.
09
List organizations
This capability shows all the organizations your API token has permission to access.
10
List reports
This capability provides a list of all available security reports.

Real work

What teams actually run

Pre-install Verification

Your agent checks a package's score before you add it to your project.

Supply Chain Defense

The agent monitors for typosquatting and backdoors in your existing dependencies.

Automated Triage

Your agent analyzes security reports to help you quickly understand risks.

Continuous Monitoring

The agent uses the threat feed to alert you to newly discovered malicious packages.

Automate a task

Put Socket.dev to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Socket.dev works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put Socket.dev to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

1058ms average. Fast in production.

Socket.dev is checked daily against the live service.

Daily averagePeak 1195ms

Oct 3Today

Fastest day: 923ms
Slowest day: 1195ms
14-day trend: Slowing+14%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Socket.dev, so you can see the experience inside your AI.

It does not authenticate your account with Socket.dev. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Socket.dev Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — Socket.dev capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "socketdev-dependency-security-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Socket.dev in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Socket.dev owners hand off.

Security and development teams use this MCP to automate the vetting of third-party code.

01
Security Engineers
They hand off the task of monitoring organizational security posture and automating dependency reviews to their agent.
02
Developers
They use the agent to instantly verify package safety before running install commands.
03
DevOps Teams
They use the agent to triage security reports and integrate scanning into their workflows.

FAQ

Questions Socket.dev owners ask.

01
What is this MCP used for?
It is used to protect your software supply chain by scanning dependencies and monitoring for malicious packages through your AI agent.
02
Which clients can I use with this MCP?
You can use this with any MCP-compatible client, including Claude, Cursor, Windsurf, and VS Code.
03
How do I check a package's safety?
You can ask your agent to get the security score or get package issues for a specific package using its PURL.
04
Can I scan my existing project files?
Yes, you can use the create_scan capability to upload manifest files like package.json or requirements.txt for analysis.
05
Does this work for Python and Go?
Yes, the capability supports various package managers including npm, PyPI, and Go.
06
How can I check if a specific npm package is safe to use?
You can use the get_package_score capability by providing the Package URL (PURL), such as pkg:npm/lodash. The agent will return a security score and risk assessment.
07
Can I scan my entire project's dependencies at once?
Yes! Use the create_scan capability and provide the content of your manifest files (like package.json). Socket will analyze all dependencies and generate a report.
08
How do I see the specific security issues found in a package?
Use the get_package_issues capability with the package's PURL. It will list all alerts, such as telemetry, install scripts, or known vulnerabilities associated with that package.

Explore

More in Fort Knox

Connect Socket.dev to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-04

Delete scan

Get package issues

Create scan

Get package score

05-07

Get quota

Get report

Get scan

08-10

Get threat feed

List organizations

List reports

What teams actually run

Pre-install Verification

Supply Chain Defense

Automated Triage

Continuous Monitoring

Building your own app? The connector is yours to use.

Socket.dev Connector

Claude Desktop

Security Engineers

Developers

DevOps Teams

What is this MCP used for?

Which clients can I use with this MCP?

How do I check a package's safety?

Can I scan my existing project files?

Does this work for Python and Go?

How can I check if a specific npm package is safe to use?

Can I scan my entire project's dependencies at once?

How do I see the specific security issues found in a package?

Google Deps.dev Security Hacker AI Connector

zrok (Open-Source Tunnel) AI Connector

Black Duck (Synopsys) AI Connector

Snyk AI Connector

Suggestions

Open-Source Strategy Economics AI Connector

Security Audit Prover AI Connector

Open-Meteo AI Connector

Supply Chain Prover AI Connector