What it does

Queries Socket's dependency analysis for known malware, typosquats, and risky install scripts. Useful at the exact moment an agent proposes a new package, which is the moment humans usually skip. It answers about packages, not about your application code.

Install

Terminal

npx -y @socketsecurity/mcp

Client configuration

Paste this into your MCP client config (Claude Desktop, Cursor, or any client that reads mcpServers), then restart the client.

mcp.json

{
  "mcpServers": {
    "socket": {
      "command": "npx",
      "args": [
        "-y",
        "@socketsecurity/mcp"
      ]
    }
  }
}

Use it for

Checking a dependency for supply-chain risk before adding it

Skip it if

Replacing a lockfile review or an SBOM process

When to use it

Reach for this when the task needs security inside the agent loop. Skip it if a plain shell command or a one-off script is enough — every server you add costs context and adds a failure mode.

Other TypeScript servers

Filesystem — Gives an agent scoped read, write, and search access to directories you explicitly allow
Memory — A persistent knowledge graph stored in a local JSON file, exposed through entities, relations, and observations
Sequential Thinking — Gives the model a scratchpad for structured, revisable reasoning: numbered thoughts that can branch, revise, and conclude

Socket MCP