Skip to main content
All Socket integration capabilities

​
About

This is an MCP connector that gives the Sazabi agent tools from Socket’s hosted MCP server (mcp.socket.dev). Socket authenticates over OAuth with dynamic client registration, and the server acts as the Socket user who connects it, within that user’s organizations. Sazabi requests only Socket’s list scopes: packages, alerts, and threat feed. Sazabi uses this connector read-only. Socket tools that change state, such as triaging or ignoring alerts, are blocked and cannot be called, so the agent can read your supply-chain data during an investigation but cannot change it. What the agent can do:
  • Score a package version for supply-chain, vulnerability, quality, maintenance, and license risk
  • List your organization’s open Socket alerts and see when a package was first flagged
  • Check the Socket threat feed for newly found malicious or typosquatted packages
  • Inspect the files a suspicious package version ships

​
Prerequisites

  • A Socket account that belongs to the organization you want to investigate
  • Access to that organization’s alerts and threat feed on your Socket plan

​
Set up in the dashboard

Configure connectors in the dashboard under Settings > MCP connectors.
1

​
Open the connector

Find Socket in Settings > MCP connectors.
2

​
Authorize

Start the connection. Sazabi redirects you to Socket, where you sign in and approve read access to packages, alerts, and the threat feed, then back.

​
Set up with the CLI

You can also connect Socket with the Sazabi CLI (installed and authenticated — see sazabi mcp-connectors reference). Socket authenticates over OAuth, so the CLI opens a browser to complete authorization:
Add --project-id <project> to target a specific project, or --no-wait to print the authorization link and exit without waiting. With --json the command prints the authorization URL and returns without waiting. Confirm the result with sazabi mcp-connectors list.

​
Verify

Open the connector’s connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to score a package you depend on and confirm it returns Socket’s scores.

​
Troubleshooting

No alerts returned — Socket lists alerts only for repositories connected to Socket in that organization. Check that the repository is connected in Socket, and that you signed in with an account in that organization. A call returns an authorization error — The Socket user who connected the server cannot see that organization’s data. Reconnect with a user who can. Connection shows needs attention — The authorization may have expired or been revoked; reconnect from Settings > MCP connectors.

​
Further reading

Agent tools

How the agent uses connector tools.

MCP connectors

Browse the connector catalog.