> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Socket

> Give the Sazabi agent read-only tools to check dependency risk scores, supply-chain alerts, and the threat feed for your Socket organization.

[All Socket integration capabilities](https://docs.sazabi.com/catalogs/integrations/socket)

## About

This is an MCP connector that gives the Sazabi agent tools from Socket's hosted MCP server (`mcp.socket.dev`). Socket authenticates over OAuth with dynamic client registration, and the server acts as the Socket user who connects it, within that user's organizations. Sazabi requests only Socket's list scopes: packages, alerts, and threat feed.

Sazabi uses this connector read-only. Socket tools that change state, such as triaging or ignoring alerts, are blocked and cannot be called, so the agent can read your supply-chain data during an investigation but cannot change it.

**What the agent can do:**

* Score a package version for supply-chain, vulnerability, quality, maintenance, and license risk
* List your organization's open Socket alerts and see when a package was first flagged
* Check the Socket threat feed for newly found malicious or typosquatted packages
* Inspect the files a suspicious package version ships

## Prerequisites

* A Socket account that belongs to the organization you want to investigate
* Access to that organization's alerts and threat feed on your Socket plan

## Set up in the dashboard

Configure connectors in the dashboard under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 1**

### Open the connector

Find Socket in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 2**

### Authorize

Start the connection. Sazabi redirects you to Socket, where you sign in and approve read access to packages, alerts, and the threat feed, then back.

## Set up with the CLI

You can also connect Socket with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)).

Socket authenticates over OAuth, so the CLI opens a browser to complete authorization:

```bash theme={"system"}
sazabi mcp-connectors connect socket
```

Add `--project-id <project>` to target a specific project, or `--no-wait` to print the authorization link and exit without waiting. With `--json` the command prints the authorization URL and returns without waiting. Confirm the result with `sazabi mcp-connectors list`.

## Verify

Open the connector's connection page under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to score a package you depend on and confirm it returns Socket's scores.

## Troubleshooting

**No alerts returned** — Socket lists alerts only for repositories connected to Socket in that organization. Check that the repository is connected in Socket, and that you signed in with an account in that organization.

**A call returns an authorization error** — The Socket user who connected the server cannot see that organization's data. Reconnect with a user who can.

**Connection shows needs attention** — The authorization may have expired or been revoked; reconnect from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.