Socket.dev (Dependency Security) Connector for AI agents.

Q: How can I check if a specific npm package is safe to use?

You can use the getpackagescore tool by providing the Package URL (PURL), such as pkg:npm/lodash. The agent will return a security score and risk assessment.

Q: Can I scan my entire project's dependencies at once?

Yes! Use the createscan tool and provide the content of your manifest files (like package.json). Socket will analyze all dependencies and generate a report.

10 live capabilities

Audit open-source packages and protect your software supply chain from malicious code.

Live agent request Socket.dev (Dependency Security) / Connector

Waiting for input…

AI Agent

Why people use Socket.dev (Dependency Security)

Socket.dev (Dependency Security) for Automated Supply Chain Protection

Socket.dev (Dependency Security) lets your AI agent do this work for you. You can ask it to scan your manifest files or check the safety of a specific library in seconds. This replaces manual searching with direct, actionable security data.

What Vinkius changes

You get a clear view of your supply chain risks without manual auditing.

Use it from Claude, ChatGPT, Cursor or another AI client you already have.

One account · 5,900+ Connectors

Real-world use case 01

Checking a package's safety

A developer wants to know if 'axios' is safe before adding it to a project.
Real-world use case 02

Scanning a new repository

A security engineer needs to audit a new project's dependencies.
Real-world use case 03

Monitoring for new threats

A DevOps lead wants to see if any recently flagged malware is in their stack.

Complete set · 10capabilities

The complete Socket.dev (Dependency Security) capability set.

These are the exact actions your AI can choose when you ask it to work with Socket.dev (Dependency Security).

Capability set01 / 03

01—04

4 capabilities in this set.

Part of 10 available through Socket.dev (Dependency Security).

01 Capability
Create scan
Upload your package.json or requirements.txt to start a new security audit. This gives you a clear picture of your current risks.
02 Capability
Delete scan
Remove a specific scan from your history. This helps keep your workspace clean.
03 Capability
Get package issues
Fetch all known alerts for a specific package. You'll see exactly what issues need your attention.
04 Capability
Get package score
Get the current security score for a library. Use this to decide if a package is safe to use.

Capability set02 / 03

05—07

3 capabilities in this set.

Part of 10 available through Socket.dev (Dependency Security).

05 Capability
Get quota
Check your remaining API usage. This ensures you don't run out of credits during a big audit.
06 Capability
Get report
Pull the full details of a security report. This provides the deep dive you need for compliance.
07 Capability
Get scan
View the status and metadata of a specific scan. This lets you track progress on large audits.

Capability set03 / 03

08—10

3 capabilities in this set.

Part of 10 available through Socket.dev (Dependency Security).

08 Capability
Get threat feed
Access the real-time list of malicious packages. Use this to stay ahead of new supply chain attacks.
09 Capability
List organizations
See all organizations linked to your token. This helps manage access across different teams.
10 Capability
List reports
Get a list of all available security reports. This makes it easy to find past audit results.

Set up in minutes

One URL. Then ask Socket.dev (Dependency Security) to work.

Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use Socket.dev (Dependency Security) from the conversation.

Choose your client

Live preview

Advanced clients IDE · CLI

Claude · Web + desktop

Official guide ↗

Connector URL · ready to paste

Streamable HTTP

https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp

Step 01

Open Connectors

In Claude Web or Claude Desktop, open Settings and choose Connectors.
Step 02

Add the URL

Choose Add custom connector, name it Socket.dev (Dependency Security), and paste the URL above.
Step 03

Turn it on in chat

Select +, open Connectors, and enable Socket.dev (Dependency Security) for the conversation.

ChatGPT · Web + desktop

Official guide ↗

Connector URL · ready to paste

Streamable HTTP

https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp

Step 01

Open MCP settings

On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
Step 02

Add the URL

Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the Socket.dev (Dependency Security) URL.
Step 03

Save and start

Save the connection and enable Socket.dev (Dependency Security) in your conversation. Desktop may ask you to restart once.

Cursor · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "socketdev-dependency-security": {
      "url": "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"
    }
  }
}

Step 01

Open MCP Settings

Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
Step 02

Add the server config

Paste the JSON configuration above into the mcp.json file that opens
Step 03

Save the file

Cursor will automatically detect the new Connector
Step 04

Start using Socket.dev (Dependency Security)

Open Agent mode in chat and ask: "Using Socket.dev (Dependency Security), help me...". 10 tools available

VS Code Copilot · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "socketdev-dependency-security": {
      "url": "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"
    }
  }
}

Step 01

Create MCP config

Create a .vscode/mcp.json file in your project root
Step 02

Add the server config

Paste the JSON configuration above
Step 03

Enable Agent mode

Open GitHub Copilot Chat and switch to Agent mode using the dropdown
Step 04

Start using Socket.dev (Dependency Security)

Ask Copilot: "Using Socket.dev (Dependency Security), help me...". 10 tools available

Windsurf · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "socketdev-dependency-security": {
      "url": "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"
    }
  }
}

Step 01

Open MCP Settings

Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
Step 02

Add the server

Paste the JSON configuration above into mcp_config.json
Step 03

Save and reload

Windsurf will detect the new server automatically
Step 04

Start using Socket.dev (Dependency Security)

Open Cascade and ask: "Using Socket.dev (Dependency Security), help me...". 10 tools available

Cline · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "socketdev-dependency-security": {
      "url": "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"
    }
  }
}

Step 01

Open Cline MCP Settings

Click the Connectors icon in the Cline sidebar panel
Step 02

Add remote server

Click "Add Connector" and paste the configuration above
Step 03

Enable the server

Toggle the server switch to ON
Step 04

Start using Socket.dev (Dependency Security)

Ask Cline: "Using Socket.dev (Dependency Security), help me...". 10 tools available

Claude Code · Terminal command

Official guide ↗

Advanced setup

claude mcp add socketdev-dependency-security --transport http "https://edge.vinkius.com/vk_preview_R4rzC31YO5lAo6xekKbMZrPuutcnC2L5364MbwbS/mcp"

Step 01

Install Claude Code

Run npm install -g @anthropic-ai/claude-code if not already installed
Step 02

Add the Connector

Run the command above in your terminal
Step 03

Verify the connection

Run claude mcp to list connected servers, or type /mcp inside a session
Step 04

Start using Socket.dev (Dependency Security)

Ask Claude: "Using Socket.dev (Dependency Security), show me...". 10 tools are ready

Where the request belongs

Work Socket.dev can move forward.

Built around the request

This is for security engineers who need to automate audits, developers who want to check package safety before installing, and DevOps teams triaging security alerts.

Security Engineer

Automates the review of new dependencies and monitors the security posture of the entire organization.

Software Developer

Checks package safety scores instantly before running install commands to avoid typosquatting.

DevOps Engineer

Triages security reports and monitors the real-time threat feed to keep the production environment safe.

Build the capability set

Each Connector adds new actions and data without changing how you work.

Browse Connectors

01 4 capabilities

Google Deps.dev Security Hacker

Transform your AI into a Senior DevSecOps Engineer. Instantly audit any open-source package, hunt for hidden supply-chain threats in dependency trees, and analyze full GitHub repositories using Google's deps.dev API. No authentication required.

View Connector

02 9 capabilities

Snyk

Bring your Snyk code security ecosystem directly to your AI. Analyze vulnerabilities, project metadata, and scan issues right from your editor.

View Connector

03 6 capabilities

FOSSA (License Compliance)

Manage license compliance and security vulnerabilities via FOSSA. list projects, inspect revisions, and track dependencies directly from your AI agent.

View Connector

04 10 capabilities

Black Duck (Synopsys)

Secure your open source supply chain via Black Duck. list projects, versions, and vulnerabilities directly from any AI agent.

View Connector

05 16 capabilities

Aikido Security

Query security vulnerabilities via Aikido. list open issues, check repositories, monitor cloud assets, and track compliance directly from any AI agent.

View Connector

06 4 capabilities

SBOM Dependency Risk Scorer

Analyze SBOM files to quantify supply chain risk through dependency structure, package staleness, and vulnerability exposure.

View Connector

Bring your own AI

Change the model, client or framework. Keep Socket.dev connected.

Claude
ChatGPT
Gemini
Cursor
VS Code
Windsurf
ZCode
Cline
Zed
Continue
Kiro
Roo Code
Zencoder
Goose
Void
Augment Code
Amp
Qodo
Tabnine
Pieces
Sourcegraph Cody
JetBrains
Warp
Amazon Q
Antigravity
BoltAI
Raycast
Jan
LM Studio
AnythingLLM
Open WebUI
Msty
Cherry Studio
LibreChat
TypingMind
Chorus
5ire
n8n
LangChain
LlamaIndex
CrewAI
Vercel AI SDK

Before you connect

Questions about Socket.dev.

The practical details behind the request, access and result.

Can Socket.dev (Dependency Security) find malware in my npm packages?

Yes. It connects to Socket's analysis engine to identify malicious packages, typosquatting, and backdoors in your dependencies.

How does Socket.dev (Dependency Security) protect my software supply chain?

It proactively scans your manifest files and provides real-time threat intelligence so you can block malicious code before it enters your codebase.

Can I use Socket.dev (Dependency Security) to scan a requirements.txt file?

Yes. You can ask your agent to create a new scan by uploading the contents of your requirements.txt or package.json file.

Does Socket.dev (Dependency Security) provide real-time threat intelligence?

Yes. It can pull a live feed of malicious packages detected by Socket's telemetry to help you stay ahead of new attacks.

How do I check the safety of a new library with Socket.dev (Dependency Security)?

You can ask your agent to pull the security score and any known issues for a specific package name to see if it's safe to use.

Can Socket.dev (Dependency Security) manage reports for multiple organizations?

Yes. It can list the different organizations your token has access to and retrieve security reports for each one.

How can I check if a specific npm package is safe to use?

You can use the get_package_score capability by providing the Package URL (PURL), such as pkg:npm/lodash. The agent will return a security score and risk assessment.

Can I scan my entire project's dependencies at once?

Yes! Use the create_scan capability and provide the content of your manifest files (like package.json). Socket will analyze all dependencies and generate a report.

How do I see the specific security issues found in a package?

Use the get_package_issues capability with the package's PURL. It will list all alerts, such as telemetry, install scripts, or known vulnerabilities associated with that package.

One connection away

Give your agent a direct line to Socket.dev.

Connect Socket.dev once. Keep it beside 5,900+ managed Connectors when the next task needs more.

Explore every Connector No credit card required · Free tier available

Socket.dev (Dependency Security) for Automated Supply Chain Protection

You get a clear view of your supply chain risks without manual auditing.

Checking a package's safety

Scanning a new repository

Monitoring for new threats

Create scan

Delete scan

Get package issues

Get package score

Get quota

Get report

Get scan

Get threat feed

List organizations

List reports

Open Connectors

Add the URL

Turn it on in chat

Open MCP settings

Add the URL

Save and start

Open MCP Settings

Add the server config

Save the file

Start using Socket.dev (Dependency Security)

Create MCP config

Add the server config

Enable Agent mode

Start using Socket.dev (Dependency Security)

Open MCP Settings

Add the server

Save and reload

Start using Socket.dev (Dependency Security)

Open Cline MCP Settings

Add remote server

Enable the server

Start using Socket.dev (Dependency Security)

Install Claude Code

Add the Connector

Verify the connection

Start using Socket.dev (Dependency Security)

Security Engineer

Software Developer

DevOps Engineer

Google Deps.dev Security Hacker

Snyk

FOSSA (License Compliance)

Black Duck (Synopsys)

Aikido Security

SBOM Dependency Risk Scorer

Give your agent a direct line to Socket.dev.