threat_feed
Look up items in a Socket organization's threat feed: packages recently flagged as malware, typosquats, obfuscated code, and similar. Backed by GET /v0/orgs/{orgslug}/threat-feed. The response carries a nextPageCursor; pass it as cursor to page forward.
How to use it
Project documentation lists threat_feed for the Socket MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.
Install Socket MCP
claude mcp add --transport http socket-mcp https://mcp.socket.dev/Other tools in Socket MCP (6)
List the latest security alerts for one Socket organization: supply-chain, vulnerability, quality, license, and maintenance issues across the org's monitored packages. Backed by GET /v0/orgs/{orgslug}/alerts. Results are paginated; pass the previous response's endCursor as cursor to fetch the next p
Query the Socket API for dependency scoring information. Returns supply chain, quality, maintenance, vulnerability, and license scores per package.
List the Socket organizations the authenticated user belongs to. Takes no parameters. Use it to discover the orgslug value that the org-scoped tools (alerts, threatfeed) require.
Read a single file from a package. Pass the hash printed next to an entry in packagefiles output. Returns up to 1 MB of UTF-8 text; binary files return metadata only.
Search a single file from a package for lines matching a JavaScript regular expression, returning matches with line numbers (grep -n style). Each blob is fetched once and held in a process-wide cache, so repeated reads and greps of the same hash skip the network.
List the files published in a package: a tree of file paths, each with its size and blob hash, for any package on a supported ecosystem. Use it to inspect what a dependency ships before installing it. Pass a file's hash to packagefilecontents or packagefilegrep.