Repository navigation
feat(auth): connect to Socket through browser sign-in - #25
Merged
Merged
Conversation
Add a socket-connect plugin that bundles the hosted Socket MCP server (https://mcp.socket.dev/). Agents sign in with OAuth (dynamic client registration + PKCE against api.socket.dev), so users no longer paste an organization API token to use Socket from Claude Code, Cursor, or Gemini. - socket-connect: sign-in steps per agent, choosing among the organizations a sign-in covers, and linking the CLI for scans - marketplace: socket-connect entry with an inline mcpServers block; auth-dependent plugins depend on it so one sign-in serves them all - cursor/gemini: ship the same server; a structural test keeps the URL identical across all three manifests - skills: prefer browser sign-in; keep API tokens for CI; the user runs `socket login` in their own terminal, never pasting tokens into chat
Jordan Harband (ljharb)
force-pushed
the
feat/oauth-connect
branch
from
November 5, 2026 21:20
e1fec9c to
c7cc77e
Compare
John-David Dalton (jdalton)
approved these changes
Nov 5, 2026
John-David Dalton (jdalton)
left a comment
John-David Dalton (jdalton)
left a comment
Collaborator
There was a problem hiding this comment.
Very cool 🤩
This was referenced Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a socket-connect plugin that bundles the hosted Socket MCP server (https://mcp.socket.dev/). Agents sign in with OAuth (dynamic client registration + PKCE against api.socket.dev), so users no longer paste an organization API token to use Socket from Claude Code, Cursor, or Gemini.
socket loginin their own terminal, never pasting tokens into chatNote
Medium Risk
Changes how users authenticate across agent plugins and skill instructions (OAuth MCP + CLI login guidance), though impact is limited to documentation and manifest config rather than application runtime code.
Overview
Introduces
socket-connect, a new skill and Claude marketplace plugin that bundles the hosted Socket MCP server (https://mcp.socket.dev/) so agents authenticate with OAuth in the browser instead of pasting organization API keys.Plugin wiring: Claude marketplace adds
socket-connectwith inlinemcpServers; scan, inspect, setup, fix, and related plugins declaredependencies: ["socket-connect"]. Cursor’s generated.cursor-plugin/mcp.jsonandgemini-extension.jsonnow ship the same MCP URL, with a structural test keeping all three manifests aligned viaSOCKET_MCP_URLingenerate-cursor-plugin.mts.Skill and doc updates: Shared CLI setup text and
socket-setup,socket-scan-setup,socket-inspect, and fix skills steer users to/socket-connectand user-runpnpm dlx socket login(interactive TTY), reserveSOCKET_CLI_API_TOKENfor CI, and forbid pasting tokens in chat.socket-inspectprefers MCPdepscorewhen connected. README andagents/README.mddocument the new plugin and de-emphasize demo-token / dashboard API-key flows for local agent use.Reviewed by Cursor Bugbot for commit e1fec9c. Configure here.