Socket
About
Scan dependencies for vulnerabilities and security issues using the Socket API.
Details
- Author
- socketdev
- Categories
- Developer Tools
Jump to
Authentication For Organization Scoped Tools
depscoreworks without credentials on the public server. Theorganizations,alerts,threat_feed, andpackage_filestools call Socket's authenticated REST API, so they need a Socket API token.
How the server resolves a token depends on the transport:
- stdio modereads one token at startup from the environment and uses it for every request. SetSOCKET_API_TOKEN. The server also accepts these aliases, in priority order:SOCKET_API_TOKEN→SOCKET_API_KEY→SOCKET_CLI_API_TOKEN→SOCKET_CLI_API_KEY→SOCKET_SECURITY_API_TOKEN→SOCKET_SECURITY_API_KEY.SOCKET_API_TOKENis canonical;SOCKET_API_KEYis the alias most local setups already export. Because the process belongs to one user, this token is yours and scopes every tool to your account.
- HTTP modescopes the organization tools to the caller, never to the server's own token. Send your credential as anAuthorization: Bearer <token>header on each request. Which credential to send depends on whether the deployment runs OAuth. On an OAuth-enabled server, send an OAuth access token: every bearer token is validated through introspection, and a raw Socket API token is rejected with a401challenge no matter what it starts with. On a server without OAuth, send your raw Socket API token and it is used directly. Either way the server uses that per-request token for the Socket API calls it makes on your behalf. A shared deployment never answersorganizations,alerts,threat_feed, orpackage_fileswith the operator's data: when a request carries no token, those tools return the auth-required error.depscorealone may fall back to the server's startup token, since package scores are the same for every caller.
When a token is missing, every affected tool returns the same message:
Authentication is required. Set SOCKET_API_TOKEN for stdio mode, or send your Socket API token as an Authorization: Bearer <token> header (or connect through OAuth) in HTTP mode.
Generate a token from the](#authentication-for-organization-scoped-tools)[Socket dashboardunder API tokens, then export it before launching the server:
export SOCKET_API_TOKEN="your-socket-api-token"
Option 1: Use the public Socket MCP server (recommended)
Custom integrations are not available on every paid Claude plan. CheckAnthropic's remote-MCP articlebefore you start.
-
In Claude Desktop, go to Settings > Developer > Edit Config.
Add the Socket MCP server configuration:
{ "mcpServers": { "socket-mcp": { "type": "http", "url": "https://mcp.socket.dev/" } } }
Save the configuration and restart Claude Desktop.
Ask Claude "Check the security score for express version 4.18.2".
For Claude Code, one command does all of it:
claude mcp add --transport http socket-mcp https://mcp.socket.dev/
# For VS Code with GitHub Copilot code --add-mcp '{"name":"socket-mcp","type":"http","url":"https://mcp.socket.dev/"}'
{ "servers": { "socket-mcp": { "type": "http", "url": "https://mcp.socket.dev/" } } }
Cursor Settings→MCP→Add new MCP Server. Namesocket-mcp,httptype, URLhttps://mcp.socket.dev/.
{ "mcpServers": { "socket-mcp": { "type": "http", "url": "https://mcp.socket.dev/" } } }
Windsurf does not supporthttptype MCP servers. Use the stdio configuration in Option 2 below, or theserverUrlform:
{ "mcpServers": { "socket-mcp": { "serverUrl": "https://mcp.socket.dev/mcp" } } }
droid mcp add socket https://mcp.socket.dev/ --type http
To self-host with an API key instead, see Option 2 below and register the stdio command withdroid mcp add.
Alternatively, type/mcpwithin the Factory droid to manage MCP servers from an interactive UI. Learn more in the[Factory MCP documentation.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
