threat_feed
Look up items in a Socket organization's threat feed: packages recently flagged as malware, typosquats, obfuscated code, and similar. Backed by GET /v0/orgs/{orgslug}/threat-feed. The response carries a nextPageCursor; pass it as cursor to page forward.
How to use it
threat_feed is exposed by the Socket MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the threat_feed tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Socket MCP
claude mcp add --transport http socket-mcp https://mcp.socket.dev/Other tools in Socket MCP (35)
String
List the latest security alerts for one Socket organization: supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. Backed by GET /v0/orgs/{orgslug}/alerts. Results are paginated; pass the previous response's endCursor as cursor to fetch the next p
String
String
String
Boolean
String
Integer
String
String
String
Query the Socket API for dependency scoring information. Returns supply chain, quality, maintenance, vulnerability, and license scores per package.
String
String
String
String
Boolean
Integer
String
String
List the Socket organizations the authenticated user belongs to. Takes no parameters. Use it to discover the orgslug value that the org-scoped tools (alerts, threatfeed) require.
Read a single file from a package. Pass the hash printed next to an entry in packagefiles output. Returns up to 1 MB of UTF-8 text; binary files return metadata only.
Search a single file from a package for lines matching a JavaScript regular expression, returning matches with line numbers (grep -n style). Each blob is fetched once and held in a process-wide cache, so repeated reads and greps of the same hash skip the network.
List the files published in a package: a tree of file paths, each with its size and blob hash, for any package on a supported ecosystem. Use it to inspect what a dependency ships before installing it. Pass a file's hash to packagefilecontents or packagefilegrep.
Array
String
String
Integer
String
String
String
String
String
String
String