Socket

Scores npm, PyPI and Go packages for the things that make a dependency dangerous — install scripts, obfuscated code, network access that was not there last version — and lets you read the files a package actually published.

What it can do

Examples of the tools the agent gets from this connector. Each call shows up in the activity feed with its input and result.

1. socketdepscore npm/left-pad
2. socketpackage_files npm/event-stream@3.3.6
3. socketpackage_file_grep <pkg> index.js "child_process"

How it connects

Sign-in

No sign-in needed. No account and no key. Install it and it is ready.

Runs as

Remote MCP server, reached over HTTPS. An MCP server hosted by the service, reached over HTTPS. Nothing runs on your machine beyond Gantry.

Permissions

Reads run in every mode. Writes outside your folders, messages and anything destructive follow the chat's permission mode: they ask in Manual and Auto-edit, and are judged by the guard model in Auto. How permissions work

Install in Gantry

1. 1

   Open Connectors in the sidebar. The catalog ships with the app; nothing is downloaded until you ask.

2. 2

   Find Socket and choose Install. That is all.

3. 3

   Attach it to a chat, or leave it available to every chat in a project. The agent sees its tools from then on.