Socket's official MCP server lets agents look up supply-chain security and quality scores for packages across ecosystems, and read organization alerts, threat feed data and package file contents. The public hosted server uses OAuth sign-in with no API key to manage, and the npm package can be self-hosted.
Connect
- 1Connect it in ChatGPT
Turn on Developer mode in ChatGPT (Settings → Security and login), open Plugins, select + and paste https://mcp.socket.dev/ as the MCP server URL, then sign in with OAuth. Add it to a chat from the composer's tools menu.
- 2Or add it to Codex or the API
codex mcp add socket --url https://mcp.socket.dev/ codex mcp login socketThe login command opens a browser to finish OAuth.
Configs are generated from the publisher's documented endpoint. Check their docs for plan requirements and scopes. New to this? Read the step-by-step tutorial.
Tools 7
depscoreorganizationsalertsthreat_feedpackage_filespackage_file_contentspackage_file_grepThings to ask
- “Check the dependencies in my package.json for risky packages”
- “What's the security score for left-pad@1.3.0?”
- “Show open Socket alerts for my organization”
- “Is there anything suspicious in the install scripts of this package?”