@socketsecurity/mcp 0.0.19 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +63 -1
- package/README.md +279 -115
- package/dist/index.cjs +54801 -41179
- package/{hooks → dist}/socket-gate/README.md +13 -13
- package/dist/socket-gate/socket-gate.cjs +5391 -0
- package/package.json +185 -46
- package/hooks/socket-gate/index.mts +0 -296
- package/hooks/socket-gate/socket-gate.cjs +0 -1047
package/README.md
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
# Socket MCP Server
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
[](https://socket.dev/npm/package/@socketsecurity/mcp)
|
|
3
|
+
<a href="https://socket.dev/npm/package/@socketsecurity/mcp"><img src="https://socket.dev/api/badge/npm/package/@socketsecurity/mcp" alt="Socket Badge" height="20"></a>
|
|
4
|
+
<picture><img src="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/assets/repo/coverage.svg?v=66258ab9f3b4" height="20" alt="Coverage" /></picture>
|
|
6
5
|
|
|
7
|
-
|
|
6
|
+
[](https://twitter.com/SocketSecurity)
|
|
7
|
+
[](https://bsky.app/profile/socket.dev)
|
|
8
8
|
|
|
9
|
-
|
|
9
|
+
A Model Context Protocol (MCP) server for Socket integration - lets AI assistants query dependency vulnerability scores and security metadata.
|
|
10
10
|
|
|
11
11
|
Socket MCP exposes Socket.dev's package-scoring API through the Model Context Protocol, so any MCP-aware AI assistant (Claude, VS Code Copilot, Cursor, Windsurf) can score a package, audit a `package.json`, or flag risky dependencies as part of a conversation. It ships as both a hosted public server (`https://mcp.socket.dev/`, no setup) and a self-hostable npm package, so you can choose between zero-friction and full data isolation.
|
|
12
12
|
|
|
@@ -25,34 +25,21 @@ Socket MCP exposes Socket.dev's package-scoring API through the Model Context Pr
|
|
|
25
25
|
|
|
26
26
|
### Option 1: Use the public Socket MCP server (recommended)
|
|
27
27
|
|
|
28
|
-
The easiest way to get started. The public server uses OAuth
|
|
28
|
+
The easiest way to get started. The public server uses OAuth - your MCP client opens a browser to sign in to Socket on first connect; no API key to copy or manage. Click a button below to install in your favorite AI assistant.
|
|
29
29
|
|
|
30
30
|
[](https://vscode.dev/redirect/mcp/install?name=socket-mcp&config={"url":"https://mcp.socket.dev/","type":"http"})
|
|
31
31
|
[](https://cursor.com/en/install-mcp?name=socket-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnNvY2tldC5kZXYvIn0%3D)
|
|
32
32
|
|
|
33
|
-
<details><summary><b>Manual install
|
|
33
|
+
<details><summary><b>Manual install - Claude Desktop / Claude Code</b></summary>
|
|
34
34
|
|
|
35
|
-
|
|
36
|
-
> Custom integrations are not available to all paid versions of Claude. Check [here](https://support.anthropic.com/en/articles/11175166-about-custom-integrations-using-remote-mcp) for more information.
|
|
35
|
+
Add the hosted server through Claude's [custom connector settings](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp). The Developer configuration file is for local servers.
|
|
37
36
|
|
|
38
|
-
1.
|
|
39
|
-
2. Add
|
|
37
|
+
1. Open Customize > Connectors in Claude.
|
|
38
|
+
2. Select **Add custom connector** and enter `https://mcp.socket.dev/` as the server URL. On Team and Enterprise plans, an organization owner adds the connector through Organization settings > Connectors first.
|
|
39
|
+
3. Select **Connect** and complete the Socket authorization flow when prompted.
|
|
40
|
+
4. Enable the connector for your conversation, then ask Claude "Check the security score for express version 4.18.2".
|
|
40
41
|
|
|
41
|
-
|
|
42
|
-
{
|
|
43
|
-
"mcpServers": {
|
|
44
|
-
"socket-mcp": {
|
|
45
|
-
"type": "http",
|
|
46
|
-
"url": "https://mcp.socket.dev/"
|
|
47
|
-
}
|
|
48
|
-
}
|
|
49
|
-
}
|
|
50
|
-
```
|
|
51
|
-
|
|
52
|
-
3. Save the configuration and restart Claude Desktop.
|
|
53
|
-
4. Now you can ask Claude "Check the security score for express version 4.18.2".
|
|
54
|
-
|
|
55
|
-
For Claude Code:
|
|
42
|
+
For Claude Code, one command does all of it:
|
|
56
43
|
|
|
57
44
|
```sh
|
|
58
45
|
claude mcp add --transport http socket-mcp https://mcp.socket.dev/
|
|
@@ -60,7 +47,7 @@ claude mcp add --transport http socket-mcp https://mcp.socket.dev/
|
|
|
60
47
|
|
|
61
48
|
</details>
|
|
62
49
|
|
|
63
|
-
<details><summary><b>Manual install
|
|
50
|
+
<details><summary><b>Manual install - VS Code</b></summary>
|
|
64
51
|
|
|
65
52
|
```sh
|
|
66
53
|
# For VS Code with GitHub Copilot
|
|
@@ -82,7 +69,7 @@ Or add to `.vscode/mcp.json`:
|
|
|
82
69
|
|
|
83
70
|
</details>
|
|
84
71
|
|
|
85
|
-
<details><summary><b>Manual install
|
|
72
|
+
<details><summary><b>Manual install - Cursor</b></summary>
|
|
86
73
|
|
|
87
74
|
`Cursor Settings` → `MCP` → `Add new MCP Server`. Name `socket-mcp`, `http` type, URL `https://mcp.socket.dev/`.
|
|
88
75
|
|
|
@@ -99,10 +86,9 @@ Or add to `.vscode/mcp.json`:
|
|
|
99
86
|
|
|
100
87
|
</details>
|
|
101
88
|
|
|
102
|
-
<details><summary><b>Manual install
|
|
89
|
+
<details><summary><b>Manual install - Windsurf</b></summary>
|
|
103
90
|
|
|
104
|
-
|
|
105
|
-
> Windsurf does not support `http` type MCP servers yet. Use the stdio configuration in Option 2 below.
|
|
91
|
+
Windsurf does not support `http` type MCP servers. Use the stdio configuration in Option 2 below, or the `serverUrl` form:
|
|
106
92
|
|
|
107
93
|
```json
|
|
108
94
|
{
|
|
@@ -116,7 +102,7 @@ Or add to `.vscode/mcp.json`:
|
|
|
116
102
|
|
|
117
103
|
</details>
|
|
118
104
|
|
|
119
|
-
<details><summary><b>Manual install
|
|
105
|
+
<details><summary><b>Manual install - Factory</b></summary>
|
|
120
106
|
|
|
121
107
|
[Factory](https://factory.ai) is an AI-powered software engineering platform. Install the Socket MCP server with the Factory CLI:
|
|
122
108
|
|
|
@@ -130,16 +116,60 @@ Alternatively, type `/mcp` within the Factory droid to manage MCP servers from a
|
|
|
130
116
|
|
|
131
117
|
</details>
|
|
132
118
|
|
|
119
|
+
### Clients that need a local bridge
|
|
120
|
+
|
|
121
|
+
Prefer your client's native remote HTTP connection to `https://mcp.socket.dev/` when available. For clients that only launch local stdio servers, install `mcp-remote` 0.8.3:
|
|
122
|
+
|
|
123
|
+
```bash
|
|
124
|
+
pnpm add --global mcp-remote@0.8.3
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
Add this local server configuration to your MCP client:
|
|
128
|
+
|
|
129
|
+
```json
|
|
130
|
+
{
|
|
131
|
+
"mcpServers": {
|
|
132
|
+
"socket": {
|
|
133
|
+
"command": "mcp-remote",
|
|
134
|
+
"args": ["https://mcp.socket.dev/"]
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
}
|
|
138
|
+
```
|
|
139
|
+
|
|
140
|
+
The bridge runs on your computer and receives OAuth redirects at `http://localhost:<port>/oauth/callback`. Keep it running while you authorize. Version 0.3.3 introduced the [mid-session authorization fix](https://github.com/punkpeye/mcp-remote/pull/340); the forwarding and reauthorization retry paths were verified against the published 0.8.3 package. This verification does not cover a complete browser sign-in.
|
|
141
|
+
|
|
142
|
+
Reuse saved authorization while it remains valid. If a browser reports connection refused at the localhost callback, check the bridge's version and process. The callback listener belongs to the bridge; changing the hosted MCP URL does not start it.
|
|
143
|
+
|
|
133
144
|
### Option 2: Self-host the Socket MCP server
|
|
134
145
|
|
|
135
|
-
|
|
146
|
+
Self-hosting keeps every request inside your own infrastructure. It needs a Socket API token and Node.js 24 or later.
|
|
147
|
+
|
|
148
|
+
**Get a token first.** Sign in at [socket.dev](https://socket.dev/), open the API tokens page, and create a token with the `packages:list` scope. That single scope covers `depscore`; the org-scoped tools need whatever scopes your organization requires for the endpoints they call. Full walkthrough: [creating and managing API tokens](https://docs.socket.dev/reference/creating-and-managing-api-tokens).
|
|
149
|
+
|
|
150
|
+
**Then pick a transport.** The server speaks the same MCP protocol either way; the difference is who launches it.
|
|
136
151
|
|
|
137
|
-
|
|
152
|
+
| | Stdio (Option 2a) | HTTP (Option 2b) |
|
|
153
|
+
| ---------------------- | --------------------------------------------- | -------------------------------------------------------------------- |
|
|
154
|
+
| Who starts the process | Your MCP client, on demand | You, as a long-running service |
|
|
155
|
+
| Who it serves | One local user | Any client that can reach the port |
|
|
156
|
+
| Where the token lives | The client's config, as an env var | The server env, or per-request `Authorization` headers |
|
|
157
|
+
| Reach for it when | You are a developer wiring up your own editor | You are deploying one instance for a team, or fronting it with OAuth |
|
|
158
|
+
|
|
159
|
+
Stdio is the default and the right answer for a single developer. Choose HTTP when more than one person, or something that is not a local process, needs to reach the server.
|
|
160
|
+
|
|
161
|
+
Install it once, globally, before either option:
|
|
162
|
+
|
|
163
|
+
```sh
|
|
164
|
+
pnpm add -g @socketsecurity/mcp
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
<details><summary><b>Option 2a - Stdio mode (default)</b></summary>
|
|
138
168
|
|
|
139
169
|
Claude Code:
|
|
140
170
|
|
|
141
171
|
```sh
|
|
142
|
-
claude mcp add socket-mcp -e SOCKET_API_TOKEN="your-api-token-here" --
|
|
172
|
+
claude mcp add socket-mcp -e SOCKET_API_TOKEN="your-api-token-here" -- socket-mcp
|
|
143
173
|
```
|
|
144
174
|
|
|
145
175
|
Most other MCP clients:
|
|
@@ -148,8 +178,7 @@ Most other MCP clients:
|
|
|
148
178
|
{
|
|
149
179
|
"mcpServers": {
|
|
150
180
|
"socket-mcp": {
|
|
151
|
-
"command": "
|
|
152
|
-
"args": ["@socketsecurity/mcp@latest"],
|
|
181
|
+
"command": "socket-mcp",
|
|
153
182
|
"env": {
|
|
154
183
|
"SOCKET_API_TOKEN": "your-api-token-here"
|
|
155
184
|
}
|
|
@@ -160,40 +189,93 @@ Most other MCP clients:
|
|
|
160
189
|
|
|
161
190
|
</details>
|
|
162
191
|
|
|
163
|
-
<details><summary><b>Option 2b
|
|
192
|
+
<details><summary><b>Option 2b - HTTP mode</b></summary>
|
|
164
193
|
|
|
165
|
-
Run the server in HTTP mode
|
|
194
|
+
Run the server in HTTP mode:
|
|
166
195
|
|
|
167
196
|
```sh
|
|
168
|
-
MCP_HTTP_MODE=true SOCKET_API_TOKEN=your-api-token
|
|
197
|
+
MCP_HTTP_MODE=true SOCKET_API_TOKEN=your-api-token socket-mcp --http
|
|
169
198
|
```
|
|
170
199
|
|
|
200
|
+
The server listens on `http://localhost:3000/`. The MCP endpoint is `/` and the health endpoint is `/health`; every other path answers `404`.
|
|
201
|
+
|
|
202
|
+
The transport is stateless. Each `POST /` is self-contained, with no session to open, no `Mcp-Session-Id` header, and nothing to expire, so you can put several instances behind a load balancer without session affinity. `GET` and `DELETE` on the MCP endpoint answer `405`. Clients written against the 2025 protocol, which open with an `initialize` handshake, are still served.
|
|
203
|
+
|
|
171
204
|
Environment variables for HTTP mode:
|
|
172
205
|
|
|
173
|
-
| Variable | Required
|
|
174
|
-
| ------------------------------------------ |
|
|
175
|
-
| `
|
|
176
|
-
| `
|
|
177
|
-
| `
|
|
178
|
-
| `
|
|
179
|
-
| `
|
|
180
|
-
| `
|
|
181
|
-
| `
|
|
182
|
-
| `
|
|
183
|
-
| `
|
|
206
|
+
| Variable | Required | Default | Description |
|
|
207
|
+
| ------------------------------------------ | -------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
208
|
+
| `MCP_HTTP_MODE` | Yes, unless you pass `--http` | `false` | Set to `true` to serve HTTP instead of stdio. The `--http` CLI flag does the same thing. |
|
|
209
|
+
| `MCP_PORT` | No | `3000` | Port to bind the HTTP server to. |
|
|
210
|
+
| `SOCKET_API_TOKEN` | Required unless OAuth is enabled | None | Socket API token for outbound API calls. See the alias list below. |
|
|
211
|
+
| `SOCKET_OAUTH_ISSUER` | With OAuth | None | OAuth issuer URL. Must be `https` on a public host. See "Enabling OAuth" below. |
|
|
212
|
+
| `SOCKET_OAUTH_INTROSPECTION_CLIENT_ID` | With OAuth | None | Client ID used for RFC 7662 token introspection. |
|
|
213
|
+
| `SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET` | With OAuth | None | Client secret used for RFC 7662 token introspection. |
|
|
214
|
+
| `SOCKET_OAUTH_REQUIRED_SCOPES` | No | None | Scopes required on incoming access tokens, separated by spaces or commas. When unset, any active token passes. |
|
|
215
|
+
| `SOCKET_OAUTH_REQUIRE_AUDIENCE` | No | `false` | When `true`, reject an access token whose introspection response carries no `aud` claim. Read the audience note below first. |
|
|
216
|
+
| `SOCKET_API_BASE_URL` | No | None | Override the upstream Socket API endpoint. Falls back to `https://api.socket.dev` when unset. |
|
|
217
|
+
| `SOCKET_DEBUG` | No | `false` | Turns on verbose request and cache tracing on stderr, points `depscore` at `http://localhost:8866`, and permits a local OAuth issuer. |
|
|
218
|
+
| `TRUST_PROXY` | No | `false` | Trust `X-Forwarded-Host` and `X-Forwarded-Proto` when building OAuth metadata URLs. Enable only behind a reverse proxy that rewrites them. |
|
|
219
|
+
|
|
220
|
+
The three OAuth variables are a set: configure all three or none. Setting only some of them makes the server print `Incomplete OAuth configuration for HTTP mode` and exit `1`, rather than quietly start unauthenticated.
|
|
184
221
|
|
|
185
|
-
`
|
|
222
|
+
`SOCKET_API_TOKEN` is canonical. These aliases are read in order, first non-empty wins: `SOCKET_API_TOKEN`, `SOCKET_API_KEY`, `SOCKET_CLI_API_TOKEN`, `SOCKET_CLI_API_KEY`, `SOCKET_SECURITY_API_TOKEN`, `SOCKET_SECURITY_API_KEY`.
|
|
186
223
|
|
|
187
|
-
|
|
224
|
+
`SOCKET_API_TOKEN`, `SOCKET_API_BASE_URL`, and `SOCKET_DEBUG` also apply in stdio mode. Everything else in the table is HTTP-only.
|
|
225
|
+
|
|
226
|
+
<details>
|
|
227
|
+
|
|
228
|
+
<summary>Tuning the package-file blob cache and its fetches</summary>
|
|
229
|
+
|
|
230
|
+
`package_files`, `package_file_contents`, and `package_file_grep` fetch blobs from `socketusercontent.com` and hold them in a process-wide LRU cache. These knobs exist for operators running the server at volume; the defaults are fine otherwise.
|
|
231
|
+
|
|
232
|
+
| Variable | Default | Description |
|
|
233
|
+
| ---------------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
|
234
|
+
| `SOCKET_BLOB_CACHE_BYTES` | `67108864` (64 MB) | Bytes the blob cache holds before evicting. A non-positive or unparseable value falls back to the default. |
|
|
235
|
+
| `SOCKET_BLOB_URL` | `https://socketusercontent.com` | Base URL blobs are fetched from. |
|
|
236
|
+
| `SOCKET_BROWSER_USER_AGENT` | A Chrome UA string | `User-Agent` sent on blob fetches. |
|
|
237
|
+
| `SOCKET_BYPASS_HEADER_NAME` | None | Name of an extra header sent on every blob fetch. Both name and value must be set for it to apply. |
|
|
238
|
+
| `SOCKET_BYPASS_HEADER_VALUE` | None | Value for that header. |
|
|
239
|
+
| `SOCKET_INTERNAL_USER_AGENT` | `socket-internal-tool/1.0` | `User-Agent` sent on the authenticated file-list call. |
|
|
240
|
+
|
|
241
|
+
</details>
|
|
242
|
+
|
|
243
|
+
**Enabling OAuth.** Set all three OAuth variables to require an OAuth access token on every MCP request:
|
|
188
244
|
|
|
189
245
|
```sh
|
|
190
246
|
MCP_HTTP_MODE=true \
|
|
191
247
|
SOCKET_OAUTH_ISSUER=https://issuer.example.com \
|
|
192
248
|
SOCKET_OAUTH_INTROSPECTION_CLIENT_ID=your-client-id \
|
|
193
249
|
SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET=your-client-secret \
|
|
194
|
-
|
|
250
|
+
socket-mcp --http
|
|
251
|
+
```
|
|
252
|
+
|
|
253
|
+
With OAuth enabled, every request to the MCP endpoint goes through RFC 7662 token introspection. A raw Socket API token is rejected with a `401`, whatever its prefix; a `sktsec_` token is no more privileged than any other string here. Callers send an OAuth access token, and the server uses that token for the Socket API calls it makes on their behalf. Run without the OAuth variables to accept raw Socket API tokens instead.
|
|
254
|
+
|
|
255
|
+
At startup the server discovers the issuer's RFC 8414 metadata. An issuer that carries a path (`https://auth.example.com/tenant1`) is probed at the path-inserted well-known URL first (`https://auth.example.com/.well-known/oauth-authorization-server/tenant1`), and the metadata document's own `issuer` must match `SOCKET_OAUTH_ISSUER` byte for byte. The issuer must be `https` on a public host; a loopback or private-network issuer is refused outright unless `SOCKET_DEBUG=true` is set for local-stack work. The same rule applies to the `introspection_endpoint` the metadata advertises.
|
|
256
|
+
|
|
257
|
+
Clients discover how to authenticate from `GET /.well-known/oauth-protected-resource` (RFC 9728), which the server publishes once OAuth is on:
|
|
258
|
+
|
|
259
|
+
```json
|
|
260
|
+
{
|
|
261
|
+
"resource": "https://mcp.example.com/",
|
|
262
|
+
"authorization_servers": ["https://issuer.example.com"],
|
|
263
|
+
"scopes_supported": ["packages:list"],
|
|
264
|
+
"bearer_methods_supported": ["header"],
|
|
265
|
+
"resource_name": "Socket MCP Server"
|
|
266
|
+
}
|
|
267
|
+
```
|
|
268
|
+
|
|
269
|
+
A rejected request answers `401` with a `WWW-Authenticate` header naming that metadata URL and the scopes this resource requires:
|
|
270
|
+
|
|
271
|
+
```text
|
|
272
|
+
WWW-Authenticate: Bearer error="invalid_token", error_description="Invalid or expired token",
|
|
273
|
+
resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource", scope="packages:list"
|
|
195
274
|
```
|
|
196
275
|
|
|
276
|
+
> [!IMPORTANT]
|
|
277
|
+
> **Audience validation.** When an introspection response includes an `aud` claim, the server requires it to name this resource and rejects the token otherwise. That check is always on and has no opt-out. When the response includes no `aud` at all, the token is accepted by default, because an authorization server that never emits the claim would otherwise fail every request. Audience validation therefore protects you exactly as far as your authorization server populates `aud`; if it does not, no audience is being checked. Set `SOCKET_OAUTH_REQUIRE_AUDIENCE=true` to additionally require the claim's presence, but only once you have confirmed your authorization server returns `aud` on introspection. Enabling it against a server that omits the claim rejects all traffic.
|
|
278
|
+
|
|
197
279
|
Add `TRUST_PROXY=true` only when the server is deployed behind a trusted reverse proxy or load balancer that normalizes the forwarded host and protocol headers.
|
|
198
280
|
|
|
199
281
|
Configure your MCP client to connect to the HTTP server:
|
|
@@ -221,18 +303,21 @@ Once installed, ask your AI assistant questions like:
|
|
|
221
303
|
|
|
222
304
|
### Tools exposed
|
|
223
305
|
|
|
306
|
+
<details><summary>The full tool roster - names, arguments, and what each returns</summary>
|
|
307
|
+
|
|
224
308
|
#### depscore
|
|
225
309
|
|
|
226
310
|
Query the Socket API for dependency scoring information. Returns supply chain, quality, maintenance, vulnerability, and license scores per package.
|
|
227
311
|
|
|
228
|
-
| Parameter | Type | Required | Default | Description
|
|
229
|
-
| ---------------------- | ------ | -------- | ----------- |
|
|
230
|
-
| `packages` | Array | ✅ Yes | - | Array of package objects to analyze
|
|
231
|
-
| `packages[].ecosystem` | String | No | `"npm"` | Package ecosystem. See Supported ecosystems below.
|
|
232
|
-
| `packages[].depname` | String | ✅ Yes | - | Name of the dependency/package
|
|
233
|
-
| `packages[].version` | String | No | `"unknown"` | Version of the dependency
|
|
312
|
+
| Parameter | Type | Required | Default | Description |
|
|
313
|
+
| ---------------------- | ------ | -------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
314
|
+
| `packages` | Array | ✅ Yes | - | Array of package objects to analyze |
|
|
315
|
+
| `packages[].ecosystem` | String | No | `"npm"` | Package ecosystem. See Supported ecosystems below. |
|
|
316
|
+
| `packages[].depname` | String | ✅ Yes | - | Name of the dependency/package |
|
|
317
|
+
| `packages[].version` | String | No | `"unknown"` | Version of the dependency |
|
|
318
|
+
| `platform` | String | No | - | OS-architecture hint (`linux-x64`, `darwin-arm64`, `win32-x64`) applied to every package in the request. Picks the most relevant artifact when a package ships platform-specific builds. |
|
|
234
319
|
|
|
235
|
-
|
|
320
|
+
##### Supported ecosystems
|
|
236
321
|
|
|
237
322
|
Based on [Socket's language support](https://docs.socket.dev/docs/language-support). The `ecosystem` parameter maps to PURL types:
|
|
238
323
|
|
|
@@ -248,6 +333,8 @@ Based on [Socket's language support](https://docs.socket.dev/docs/language-suppo
|
|
|
248
333
|
| PHP | `composer` | Composer | Experimental |
|
|
249
334
|
| GitHub Actions | `actions` | GitHub Actions workflows | Experimental (workflow scanning, not package-level) |
|
|
250
335
|
|
|
336
|
+
`packagist` is accepted as an alias for `composer`, and `openvsx` for the `vscode` PURL type.
|
|
337
|
+
|
|
251
338
|
Example request:
|
|
252
339
|
|
|
253
340
|
```json
|
|
@@ -259,21 +346,39 @@ Example request:
|
|
|
259
346
|
}
|
|
260
347
|
```
|
|
261
348
|
|
|
262
|
-
|
|
349
|
+
Response, as a single block of text. Every score is an integer from 0 to 100, higher is better:
|
|
263
350
|
|
|
264
|
-
```
|
|
265
|
-
|
|
351
|
+
```text
|
|
352
|
+
Dependency scores:
|
|
353
|
+
pkg:npm/express@4.18.2: license: 100, maintenance: 87, quality: 100, supplyChain: 97, vulnerability: 98
|
|
266
354
|
Report: https://socket.dev/npm/package/express
|
|
267
|
-
pkg:pypi/fastapi@0.100.0:
|
|
355
|
+
pkg:pypi/fastapi@0.100.0: license: 100, maintenance: 100, quality: 100, supplyChain: 100, vulnerability: 100
|
|
268
356
|
Report: https://socket.dev/pypi/package/fastapi
|
|
269
357
|
```
|
|
270
358
|
|
|
359
|
+
Packages come back in the order the API returns them, not the order you asked for. A package Socket has no record of is left out of the list rather than reported as an error, so compare the response against your request when a name is missing.
|
|
360
|
+
|
|
271
361
|
#### organizations
|
|
272
362
|
|
|
273
363
|
List the Socket organizations the authenticated user belongs to. Takes no parameters. Use it to discover the `org_slug` value that the org-scoped tools (`alerts`, `threat_feed`) require.
|
|
274
364
|
|
|
275
365
|
This tool needs a Socket API token. See [Authentication for organization-scoped tools](#authentication-for-organization-scoped-tools) below.
|
|
276
366
|
|
|
367
|
+
The response is the Socket API's JSON, keyed by organization id. The `slug` is what the other tools want:
|
|
368
|
+
|
|
369
|
+
```json
|
|
370
|
+
{
|
|
371
|
+
"organizations": {
|
|
372
|
+
"1234": {
|
|
373
|
+
"id": "1234",
|
|
374
|
+
"name": "Acme Robotics",
|
|
375
|
+
"plan": "enterprise",
|
|
376
|
+
"slug": "acme-robotics"
|
|
377
|
+
}
|
|
378
|
+
}
|
|
379
|
+
}
|
|
380
|
+
```
|
|
381
|
+
|
|
277
382
|
#### alerts
|
|
278
383
|
|
|
279
384
|
List the latest security alerts for one Socket organization: supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. Backed by `GET /v0/orgs/{org_slug}/alerts`. Results are paginated; pass the previous response's `endCursor` as `cursor` to fetch the next page.
|
|
@@ -289,30 +394,30 @@ List the latest security alerts for one Socket organization: supply-chain, vulne
|
|
|
289
394
|
| `alert_type` | String | No | - | Comma-separated Socket alert types (e.g. `usesEval,unmaintained`) |
|
|
290
395
|
| `repo_slug` | String | No | - | Comma-separated repository slugs |
|
|
291
396
|
| `per_page` | Integer | No | `100` | Results per page (1–5000) |
|
|
292
|
-
| `cursor` | String | No | - | Pagination cursor
|
|
397
|
+
| `cursor` | String | No | - | Pagination cursor - the `endCursor` from a previous response |
|
|
293
398
|
|
|
294
399
|
#### threat_feed
|
|
295
400
|
|
|
296
401
|
Look up items in a Socket organization's threat feed: packages recently flagged as malware, typosquats, obfuscated code, and similar. Backed by `GET /v0/orgs/{org_slug}/threat-feed`. The response carries a `nextPageCursor`; pass it as `cursor` to page forward.
|
|
297
402
|
|
|
298
|
-
| Parameter | Type | Required | Default | Description
|
|
299
|
-
| ------------------- | ------- | -------- | ------------ |
|
|
300
|
-
| `org_slug` | String | ✅ Yes | - | Organization slug (get it from the `organizations` tool)
|
|
301
|
-
| `filter` | String | No | `mal` | Threat category: `mal` (malware), `vuln`, `typ` (typosquat), `obf` (obfuscated), `mjo`, `kes`, `spy`, etc.
|
|
302
|
-
| `ecosystem` | String | No | - | Ecosystem: `npm`, `pypi`, `gem`, `maven`, `golang`, `nuget`, `cargo`, `chrome`, `openvsx`, `huggingface`
|
|
303
|
-
| `name` | String | No | - | Filter by package name
|
|
304
|
-
| `version` | String | No | - | Filter by package version
|
|
305
|
-
| `is_human_reviewed` | Boolean | No | `false` | Only return human-reviewed items
|
|
306
|
-
| `sort` | String | No | `updated_at` | Sort field: `id`, `created_at`, `updated_at`
|
|
307
|
-
| `direction` | String | No | `desc` | Sort direction: `asc`, `desc`
|
|
308
|
-
| `updated_after` | String | No | - | ISO timestamp; only items updated after this
|
|
309
|
-
| `created_after` | String | No | - | ISO timestamp; only items created after this
|
|
310
|
-
| `per_page` | Integer | No | `30` | Results per page (1–100)
|
|
311
|
-
| `cursor` | String | No | - | Pagination cursor
|
|
403
|
+
| Parameter | Type | Required | Default | Description |
|
|
404
|
+
| ------------------- | ------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ |
|
|
405
|
+
| `org_slug` | String | ✅ Yes | - | Organization slug (get it from the `organizations` tool) |
|
|
406
|
+
| `filter` | String | No | `mal` | Threat category: `mal` (malware), `vuln`, `typ` (typosquat), `obf` (obfuscated), `mjo`, `kes`, `spy`, etc. |
|
|
407
|
+
| `ecosystem` | String | No | - | Ecosystem: `npm`, `pypi`, `gem`, `maven`, `golang`, `nuget`, `cargo`, `chrome`, `openvsx`, `vscode`, `huggingface` |
|
|
408
|
+
| `name` | String | No | - | Filter by package name |
|
|
409
|
+
| `version` | String | No | - | Filter by package version |
|
|
410
|
+
| `is_human_reviewed` | Boolean | No | `false` | Only return human-reviewed items |
|
|
411
|
+
| `sort` | String | No | `updated_at` | Sort field: `id`, `created_at`, `updated_at` |
|
|
412
|
+
| `direction` | String | No | `desc` | Sort direction: `asc`, `desc` |
|
|
413
|
+
| `updated_after` | String | No | - | ISO timestamp; only items updated after this |
|
|
414
|
+
| `created_after` | String | No | - | ISO timestamp; only items created after this |
|
|
415
|
+
| `per_page` | Integer | No | `30` | Results per page (1–100) |
|
|
416
|
+
| `cursor` | String | No | - | Pagination cursor - the `nextPageCursor` from a previous response |
|
|
312
417
|
|
|
313
418
|
#### package_files
|
|
314
419
|
|
|
315
|
-
List the files published in a package: a tree of paths and
|
|
420
|
+
List the files published in a package: a tree of file paths, each with its size and blob hash, for any package on a supported ecosystem. Use it to inspect what a dependency ships before installing it. Pass a file's `hash` to `package_file_contents` or `package_file_grep`.
|
|
316
421
|
|
|
317
422
|
| Parameter | Type | Required | Default | Description |
|
|
318
423
|
| ------------ | ------ | -------- | ------- | --------------------------------------------------------------------------------------- |
|
|
@@ -322,6 +427,16 @@ List the files published in a package: a tree of paths and sizes for any package
|
|
|
322
427
|
| `artifactId` | String | No | - | Per-version disambiguator (PyPI filename, Maven artifact id, NuGet asset) |
|
|
323
428
|
| `platform` | String | No | - | Platform qualifier for per-OS/arch artifacts (e.g. openvsx `linux-x64`, `darwin-arm64`) |
|
|
324
429
|
|
|
430
|
+
Output is a header line and a tree. The token after each size is the blob `hash`:
|
|
431
|
+
|
|
432
|
+
```text
|
|
433
|
+
pkg:npm/lodash@4.17.21 — 1054 files, 1379.3 KB
|
|
434
|
+
└── package/
|
|
435
|
+
├── fp/
|
|
436
|
+
│ ├── __.js 43B QlKUJ6782LHNEISw-t4uX1hyH1TCZye4ShYOMIAghheg
|
|
437
|
+
│ ├── _baseConvert.js 16.0K QpGkoQltpQn5ZeTFxYQOnk8FWp-7yyeUQtyzdZXl48nA
|
|
438
|
+
```
|
|
439
|
+
|
|
325
440
|
#### package_file_contents
|
|
326
441
|
|
|
327
442
|
Read a single file from a package. Pass the `hash` printed next to an entry in `package_files` output. Returns up to 1 MB of UTF-8 text; binary files return metadata only.
|
|
@@ -333,7 +448,7 @@ Read a single file from a package. Pass the `hash` printed next to an entry in `
|
|
|
333
448
|
|
|
334
449
|
#### package_file_grep
|
|
335
450
|
|
|
336
|
-
Search a single file from a package for lines matching a JavaScript regular expression, returning matches with line numbers (grep -n style).
|
|
451
|
+
Search a single file from a package for lines matching a JavaScript regular expression, returning matches with line numbers (grep -n style). Each blob is fetched once and held in a process-wide cache, so repeated reads and greps of the same hash skip the network.
|
|
337
452
|
|
|
338
453
|
| Parameter | Type | Required | Default | Description |
|
|
339
454
|
| ----------------- | ------- | -------- | ------- | ------------------------------------------------------- |
|
|
@@ -344,6 +459,8 @@ Search a single file from a package for lines matching a JavaScript regular expr
|
|
|
344
459
|
| `maxMatches` | Integer | No | `100` | Cap on matching lines returned (1–500) |
|
|
345
460
|
| `path` | String | No | - | File path, for display only; does not affect the lookup |
|
|
346
461
|
|
|
462
|
+
</details>
|
|
463
|
+
|
|
347
464
|
### Authentication for organization-scoped tools
|
|
348
465
|
|
|
349
466
|
`depscore` works without credentials on the public server. The `organizations`, `alerts`, `threat_feed`, and `package_files` tools call Socket's authenticated REST API, so they need a Socket API token.
|
|
@@ -351,7 +468,14 @@ Search a single file from a package for lines matching a JavaScript regular expr
|
|
|
351
468
|
How the server resolves a token depends on the transport:
|
|
352
469
|
|
|
353
470
|
- **stdio mode** reads one token at startup from the environment and uses it for every request. Set `SOCKET_API_TOKEN`. The server also accepts these aliases, in priority order: `SOCKET_API_TOKEN` → `SOCKET_API_KEY` → `SOCKET_CLI_API_TOKEN` → `SOCKET_CLI_API_KEY` → `SOCKET_SECURITY_API_TOKEN` → `SOCKET_SECURITY_API_KEY`. `SOCKET_API_TOKEN` is canonical; `SOCKET_API_KEY` is the alias most local setups already export. Because the process belongs to one user, this token is yours and scopes every tool to your account.
|
|
354
|
-
- **HTTP mode** scopes the organization tools to the caller, never to the server's own token. Send your
|
|
471
|
+
- **HTTP mode** scopes the organization tools to the caller, never to the server's own token. Send your credential as an `Authorization: Bearer <token>` header on each request. Which credential to send depends on whether the deployment runs OAuth. On an OAuth-enabled server, send an OAuth access token: every bearer token is validated through introspection, and a raw Socket API token is rejected with a `401` challenge no matter what it starts with. On a server without OAuth, send your raw Socket API token and it is used directly. Either way the server uses that per-request token for the Socket API calls it makes on your behalf. A shared deployment never answers `organizations`, `alerts`, `threat_feed`, or `package_files` with the operator's data: when a request carries no token, those tools return the auth-required error. `depscore` alone may fall back to the server's startup token, since package scores are the same for every caller.
|
|
472
|
+
|
|
473
|
+
When a token is missing, every affected tool returns the same message:
|
|
474
|
+
|
|
475
|
+
```text
|
|
476
|
+
Authentication is required. Set SOCKET_API_TOKEN for stdio mode, or send your Socket API
|
|
477
|
+
token as an `Authorization: Bearer <token>` header (or connect through OAuth) in HTTP mode.
|
|
478
|
+
```
|
|
355
479
|
|
|
356
480
|
Generate a token from the [Socket dashboard](https://socket.dev/) under API tokens, then export it before launching the server:
|
|
357
481
|
|
|
@@ -359,25 +483,23 @@ Generate a token from the [Socket dashboard](https://socket.dev/) under API toke
|
|
|
359
483
|
export SOCKET_API_TOKEN="your-socket-api-token"
|
|
360
484
|
```
|
|
361
485
|
|
|
362
|
-
When no token is available, these tools return an authentication-required error explaining how to supply one for each transport.
|
|
363
|
-
|
|
364
486
|
### Worked example: organization details and alerts
|
|
365
487
|
|
|
366
|
-
With `
|
|
488
|
+
With `SOCKET_API_TOKEN` set, ask your assistant something like "show me the open critical alerts for my Socket org". Under the hood the assistant chains two tools:
|
|
367
489
|
|
|
368
|
-
1. **Discover the org slug.** Call `organizations` (no arguments). The server reads your token, calls `GET /v0/organizations`, and returns the organizations your token can see. Pick the `slug` you want, e.g. `
|
|
490
|
+
1. **Discover the org slug.** Call `organizations` (no arguments). The server reads your token, calls `GET /v0/organizations`, and returns the organizations your token can see. Pick the `slug` you want, e.g. `acme-robotics`.
|
|
369
491
|
|
|
370
492
|
2. **Fetch alerts for that org.** Call `alerts` with the slug and any filters:
|
|
371
493
|
|
|
372
494
|
```json
|
|
373
495
|
{
|
|
374
|
-
"org_slug": "
|
|
496
|
+
"org_slug": "acme-robotics",
|
|
375
497
|
"severity": "high,critical",
|
|
376
498
|
"status": "open"
|
|
377
499
|
}
|
|
378
500
|
```
|
|
379
501
|
|
|
380
|
-
The server calls `GET /v0/orgs/
|
|
502
|
+
The server calls `GET /v0/orgs/acme-robotics/alerts` with the same token and returns the matching alerts plus pagination metadata. To page forward, pass the response's `endCursor` back as `cursor`.
|
|
381
503
|
|
|
382
504
|
The same token scopes every org-scoped tool, so `threat_feed` and `package_files` work the moment `organizations` confirms which slug the token belongs to.
|
|
383
505
|
|
|
@@ -399,7 +521,7 @@ Always check dependency scores with the depscore tool when you add a new depende
|
|
|
399
521
|
|
|
400
522
|
## Claude Code Hook (Optional)
|
|
401
523
|
|
|
402
|
-
The repo ships an optional [Claude Code hook](https://code.claude.com/docs/en/hooks) that blocks high-risk packages before installation. When Claude Code runs an install command, the hook queries the public Socket MCP server at `https://mcp.socket.dev/` and denies the install when the package's supply chain score is below `20` (known malware, typosquats, high-risk supply chain signals). No CLI to install
|
|
524
|
+
The repo ships an optional [Claude Code hook](https://code.claude.com/docs/en/hooks) that blocks high-risk packages before installation. When Claude Code runs an install command, the hook queries the public Socket MCP server at `https://mcp.socket.dev/` and denies the install when the package's supply chain score is below `20` (known malware, typosquats, high-risk supply chain signals). No CLI to install - copy the file and wire it up; the public server signs in via OAuth on first use.
|
|
403
525
|
|
|
404
526
|
Supported ecosystems and package managers:
|
|
405
527
|
|
|
@@ -414,17 +536,28 @@ Supported ecosystems and package managers:
|
|
|
414
536
|
|
|
415
537
|
### Setup
|
|
416
538
|
|
|
417
|
-
|
|
539
|
+
<details><summary>Per-client setup steps - Claude Desktop, Claude Code, Cursor, and VS Code</summary>
|
|
418
540
|
|
|
419
|
-
|
|
420
|
-
`socket-gate.cjs` is self-contained, so it runs without any dependencies
|
|
421
|
-
beside it. From a checkout, run `pnpm run build` first to produce it; from a
|
|
422
|
-
published install, copy from `node_modules/@socketsecurity/mcp/`:
|
|
541
|
+
**Prerequisites:** Node.js 24+.
|
|
423
542
|
|
|
424
|
-
|
|
425
|
-
|
|
426
|
-
|
|
427
|
-
|
|
543
|
+
1. Copy the whole `dist/socket-gate` directory into your hooks folder. The
|
|
544
|
+
bundled `socket-gate.cjs` is self-contained, so it runs without any
|
|
545
|
+
dependencies beside it.
|
|
546
|
+
|
|
547
|
+
From a published install:
|
|
548
|
+
|
|
549
|
+
```bash
|
|
550
|
+
mkdir -p ~/.claude/hooks
|
|
551
|
+
cp -R node_modules/@socketsecurity/mcp/dist/socket-gate ~/.claude/hooks/
|
|
552
|
+
```
|
|
553
|
+
|
|
554
|
+
From a checkout, build it first:
|
|
555
|
+
|
|
556
|
+
```bash
|
|
557
|
+
pnpm run build
|
|
558
|
+
mkdir -p ~/.claude/hooks
|
|
559
|
+
cp -R dist/socket-gate ~/.claude/hooks/
|
|
560
|
+
```
|
|
428
561
|
|
|
429
562
|
2. Add to `~/.claude/settings.json`:
|
|
430
563
|
|
|
@@ -449,9 +582,11 @@ cp -R hooks/socket-gate ~/.claude/hooks/
|
|
|
449
582
|
See [`hooks/socket-gate/README.md`](hooks/socket-gate/README.md) for the full
|
|
450
583
|
reference.
|
|
451
584
|
|
|
585
|
+
</details>
|
|
586
|
+
|
|
452
587
|
### How it works
|
|
453
588
|
|
|
454
|
-
The hook denies installation when `supplyChain < 20`, allows it otherwise
|
|
589
|
+
The hook denies installation when `supplyChain < 20`, allows it otherwise - e.g. `express`/`lodash`/`react` (75–97) allow, `browserlist` (typosquat of `browserslist`, 15) and confirmed malware (0) block. Network, timeout, or parse errors all fail open, so a Socket outage will not block legitimate work.
|
|
455
590
|
|
|
456
591
|
### Limitations
|
|
457
592
|
|
|
@@ -468,36 +603,53 @@ Inspired by [Jimmy Vo's dependency hook](https://blog.jimmyvo.com/posts/claudes-
|
|
|
468
603
|
<details>
|
|
469
604
|
<summary>Contributor commands</summary>
|
|
470
605
|
|
|
606
|
+
This repo uses pnpm, and every command runs from the repo root. Node.js 24+ is required.
|
|
607
|
+
|
|
471
608
|
```sh
|
|
472
609
|
git clone https://github.com/SocketDev/socket-mcp.git
|
|
473
610
|
cd socket-mcp
|
|
474
|
-
|
|
475
|
-
npm run build
|
|
611
|
+
pnpm install
|
|
476
612
|
```
|
|
477
613
|
|
|
478
|
-
Run from source
|
|
614
|
+
Run from source. No build step is needed, because Node 24 strips the TypeScript itself:
|
|
479
615
|
|
|
480
616
|
```sh
|
|
481
617
|
export SOCKET_API_TOKEN=your_api_token_here
|
|
482
|
-
|
|
618
|
+
pnpm run server-stdio
|
|
483
619
|
```
|
|
484
620
|
|
|
485
621
|
Or in HTTP mode:
|
|
486
622
|
|
|
487
623
|
```sh
|
|
488
|
-
|
|
624
|
+
pnpm run server-http
|
|
489
625
|
```
|
|
490
626
|
|
|
627
|
+
Both scripts read `SOCKET_API_TOKEN` (falling back to `SOCKET_API_KEY`) from your environment. Append `:debug` to either one (`pnpm run server-http:debug`) to set `SOCKET_DEBUG=1` and get per-request tracing on stderr.
|
|
628
|
+
|
|
629
|
+
| Task | Command |
|
|
630
|
+
| ------------------------- | ----------------------------------- |
|
|
631
|
+
| Test | `pnpm test` |
|
|
632
|
+
| Test one file | `pnpm test test/unit/purl.test.mts` |
|
|
633
|
+
| Live-API end-to-end tests | `pnpm run test:e2e` |
|
|
634
|
+
| Type check | `pnpm run type` |
|
|
635
|
+
| Lint and format | `pnpm run fix --all` |
|
|
636
|
+
| Full check suite | `pnpm run check --all` |
|
|
637
|
+
| Bundle to `dist/` | `pnpm run build` |
|
|
638
|
+
|
|
639
|
+
Never put `--` before a test path; that widens the run to the whole suite. Write `pnpm test test/unit/purl.test.mts`.
|
|
640
|
+
|
|
641
|
+
To drive a running server by hand, see [mock-client debugging](docs/mock-client-debugging.md).
|
|
642
|
+
|
|
491
643
|
### Health check endpoint
|
|
492
644
|
|
|
493
|
-
When running in HTTP mode, `GET /health` returns:
|
|
645
|
+
When running in HTTP mode, `GET /health` returns the running server's version and skips origin validation, which makes it safe to call from a probe that sends no `Origin` header:
|
|
494
646
|
|
|
495
647
|
```json
|
|
496
648
|
{
|
|
497
649
|
"status": "healthy",
|
|
498
650
|
"service": "socket-mcp",
|
|
499
|
-
"version": "0.0.
|
|
500
|
-
"timestamp": "
|
|
651
|
+
"version": "0.0.20",
|
|
652
|
+
"timestamp": "2026-07-29T01:50:30.394Z"
|
|
501
653
|
}
|
|
502
654
|
```
|
|
503
655
|
|
|
@@ -505,13 +657,17 @@ Suitable for Kubernetes liveness/readiness probes, Docker health checks, load ba
|
|
|
505
657
|
|
|
506
658
|
### Troubleshooting
|
|
507
659
|
|
|
508
|
-
**Q: The public server isn't responding**
|
|
660
|
+
**Q: The public server isn't responding** - Check the URL `https://mcp.socket.dev/`, verify your MCP client configuration, restart your MCP client.
|
|
661
|
+
|
|
662
|
+
**Q: Getting a `403 Forbidden: Invalid origin` error, or the connector never opens an OAuth screen** - The server accepts client `Origin` headers when the request's `Host` matches the hosted deployment. Confirm that your client uses `https://mcp.socket.dev/` and follows its setup steps above. A persistent `Invalid origin` response requires checking that the hosted deployment includes the fix.
|
|
509
663
|
|
|
510
|
-
**Q: Local server fails to start**
|
|
664
|
+
**Q: Local server fails to start** - Ensure Node.js 24+ is installed, check `SOCKET_API_TOKEN` is set, verify the API token has `packages:list` permission. In stdio mode a missing token is fatal: the server prints `SOCKET_API_TOKEN environment variable is required in stdio mode` and exits `1`.
|
|
511
665
|
|
|
512
|
-
**Q:
|
|
666
|
+
**Q: The server exits with `Incomplete OAuth configuration for HTTP mode`** - `SOCKET_OAUTH_ISSUER`, `SOCKET_OAUTH_INTROSPECTION_CLIENT_ID`, and `SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET` must all be set or all be unset.
|
|
513
667
|
|
|
514
|
-
**Q:
|
|
668
|
+
**Q: Getting authentication errors with local server** - Double-check your API key is valid, ensure `packages:list` scope, regenerate if needed. If the tool that failed was `organizations`, `alerts`, `threat_feed`, or `package_files` on an HTTP deployment, the server is refusing to answer with the operator's token by design; send your own in an `Authorization: Bearer` header.
|
|
669
|
+
|
|
670
|
+
**Q: AI assistant can't find the depscore tool** - Restart your MCP client after configuration changes, verify config is saved, check the server is running. `tools/list` advertises a one-hour public cache, so a client that caches the tool list may need a restart to pick up a newly added tool.
|
|
515
671
|
|
|
516
672
|
### Getting help
|
|
517
673
|
|
|
@@ -528,8 +684,16 @@ MIT
|
|
|
528
684
|
<br/>
|
|
529
685
|
<div align="center">
|
|
530
686
|
<picture>
|
|
531
|
-
<source media="(prefers-color-scheme: dark)" srcset="logo-white.png">
|
|
532
|
-
<source media="(prefers-color-scheme: light)" srcset="logo-black.png">
|
|
533
|
-
<img width="324" height="108" alt="Socket Logo" src="logo-black.png">
|
|
687
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/logo-white.png">
|
|
688
|
+
<source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/logo-black.png">
|
|
689
|
+
<img width="324" height="108" alt="Socket Logo" src="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/logo-black.png">
|
|
690
|
+
</picture>
|
|
691
|
+
</div>
|
|
692
|
+
|
|
693
|
+
<div align="center">
|
|
694
|
+
<picture>
|
|
695
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/assets/fleet/socket-combomark-dark.svg">
|
|
696
|
+
<source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/assets/fleet/socket-combomark-light.svg">
|
|
697
|
+
<img width="320" height="91" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-mcp/v0.2.0/assets/fleet/socket-combomark-light.svg">
|
|
534
698
|
</picture>
|
|
535
699
|
</div>
|