feat(auth): connect to Socket through browser sign-in

.claude-plugin/marketplace.json

@@ -12,19 +12,34 @@
       "name": "socket-scan",
       "source": "./skills/socket-scan",
       "skills": "./",
-      "description": "Run a full dependency scan using the Socket CLI. Creates a scan in the Socket dashboard, checks all dependencies for vulnerabilities and supply-chain risks, performs Tier 1 reachability analysis for enterprise customers, and provides license compliance auditing."
+      "description": "Run a full dependency scan using the Socket CLI. Creates a scan in the Socket dashboard, checks all dependencies for vulnerabilities and supply-chain risks, performs Tier 1 reachability analysis for enterprise customers, and provides license compliance auditing.",
+      "dependencies": ["socket-connect"]
     },
     {
       "name": "socket-inspect",
       "source": "./skills/socket-inspect",
       "skills": "./",
-      "description": "Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches."
+      "description": "Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.",
+      "dependencies": ["socket-connect"]
+    },
+    {
+      "name": "socket-connect",
+      "source": "./skills/socket-connect",
+      "skills": "./",
+      "description": "Connect to Socket by signing in through the browser - no API key to paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans.",
+      "mcpServers": {
+        "socket": {
+          "type": "http",
+          "url": "https://mcp.socket.dev/"
+        }
+      }
     },
     {
       "name": "socket-setup",
       "source": "./skills/socket-setup",
       "skills": "./",
-      "description": "Set up Socket - prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems."
+      "description": "Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.",
+      "dependencies": ["socket-connect"]
     },
     {
       "name": "socket-dep-patch",
@@ -36,7 +51,8 @@
       "name": "socket-dep-upgrade",
       "source": "./skills/socket-fix/socket-dep-upgrade",
       "skills": "./",
-      "description": "Use socket fix to find and update vulnerable dependencies one at a time, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration."
+      "description": "Use socket fix to find and update vulnerable dependencies one at a time, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration.",
+      "dependencies": ["socket-connect"]
     },
     {
       "name": "socket-dep-cleanup",
@@ -54,13 +70,15 @@
       "name": "socket-fix",
       "source": "./skills/socket-fix",
       "skills": "./",
-      "description": "Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills."
+      "description": "Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.",
+      "dependencies": ["socket-connect"]
     },
     {
       "name": "socket-scan-setup",
       "source": "./skills/socket-scan/socket-scan-setup",
       "skills": "./",
-      "description": "Set up prerequisites for Socket scanning - install the CLI, configure auth with the public demo token, and verify scan access."
+      "description": "Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access.",
+      "dependencies": ["socket-connect"]
     },
     {
       "name": "socket-release",

.cursor-plugin/mcp.json

@@ -1,3 +1,7 @@
 {
-  "mcpServers": {}
+  "mcpServers": {
+    "socket": {
+      "url": "https://mcp.socket.dev/"
+    }
+  }
 }

README.md

@@ -64,7 +64,7 @@ For example:
 /plugin install socket-scan@SocketDev/skills
 ```
 
-The installable plugin names are `socket-setup`, `socket-scan`, `socket-scan-setup`, `socket-inspect`, `socket-fix`, `socket-dep-cleanup`, `socket-dep-patch`, `socket-dep-replace`, and `socket-dep-upgrade`.
+The installable plugin names are `socket-connect`, `socket-setup`, `socket-scan`, `socket-scan-setup`, `socket-inspect`, `socket-fix`, `socket-dep-cleanup`, `socket-dep-patch`, `socket-dep-replace`, and `socket-dep-upgrade`.
 
 ### Codex
 
@@ -127,7 +127,7 @@ pnpm dlx skills add SocketDev/skills
 
 1. Or manually copy the [`agents/README.md`](agents/README.md) file into your agent's instructions/context directory as `AGENTS.md`. This file contains a summary of all available skills and their locations.
 
-2. Skills call the Socket CLI and Batch PURL API directly, so no MCP server is required.
+2. Skills call the Socket CLI and Batch PURL API directly, so no MCP server is required. The Claude Code, Cursor, and Gemini plugins also bundle the hosted Socket MCP server (`https://mcp.socket.dev/`), which signs you in through the browser instead of asking for an API key. See the `socket-connect` skill.
 
 ## Usage
 
@@ -159,9 +159,10 @@ Install, authenticate, and configure Socket for your project.
 | `cargo-publish`     | Operate the socket-release crates.io flow - the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback.                                                                                               | [SKILL.md](skills/socket-release/cargo-publish/SKILL.md)  |
 | `github-release`    | Cut, verify, and reconcile immutable GitHub releases - the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing.                                                                             | [SKILL.md](skills/socket-release/github-release/SKILL.md) |
 | `npm-publish`       | Operate the socket-release npm flow end to end - bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate.                                             | [SKILL.md](skills/socket-release/npm-publish/SKILL.md)    |
+| `socket-connect`    | Connect to Socket by signing in through the browser - no API key to paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans.                                        | [SKILL.md](skills/socket-connect/SKILL.md)                |
 | `socket-release`    | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap - name reservation, GitHub environments, npm trusted publisher, staged publish config, verification. | [SKILL.md](skills/socket-release/SKILL.md)                |
-| `socket-scan-setup` | Set up prerequisites for Socket scanning - install the CLI, configure auth with the public demo token, and verify scan access.                                                                                                              | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
-| `socket-setup`      | Set up Socket - prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                             | [SKILL.md](skills/socket-setup/SKILL.md)                  |
+| `socket-scan-setup` | Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access.                                                                                                                   | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
+| `socket-setup`      | Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                          | [SKILL.md](skills/socket-setup/SKILL.md)                  |
 
 #### Analysis
 

agents/README.md

@@ -10,6 +10,7 @@ You have additional SKILLs documented in directories containing a "SKILL.md" fil
 | cargo-publish      | Operate the socket-release crates.io flow - the cargo staged model (dry-run default), trusted publishing via OIDC under the cargo-publish environment, index-propagation waits, and yank-as-rollback. Use when publishing a Rust crate in a repo carrying scripts/socket-release/.                                                                                                                                     |
 | github-release     | Cut, verify, and reconcile immutable GitHub releases with the socket-release kit - the registry-resolvability ORDER RULE, the three-step draft-upload-undraft cut, checksums.txt production, and tag-gap healing. Use when tagging a release, healing a missing tag/release, or when the github-release workflow gate refuses a tag.                                                                                   |
 | npm-publish        | Operate the socket-release npm flow end to end - bootstrap a package (name reservation, permissive-then-staged-only publishing access, trusted publishing), dispatch a staged publish, promote with --approve, backfill an old version, and roll back with deprecate. Use when publishing an npm package in a repo carrying scripts/socket-release/.                                                                   |
+| socket-connect     | Connect your agent to Socket by signing in through the browser - no API key to copy or paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans.                                                                                                                                                                                                |
 | socket-dep-cleanup | Evaluate and remove a single unused dependency from your project. Searches the entire codebase for all usages (imports, requires, config refs, scripts, type packages, indirect usage), reports findings, and performs full removal with verification.                                                                                                                                                                 |
 | socket-dep-patch   | Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.                                                                                                                                                                                         |
 | socket-dep-replace | Replace a dependency with an alternative package, eliminate it via code rewrite, or use socket-optimize for optimized replacements.                                                                                                                                                                                                                                                                                    |
@@ -18,8 +19,8 @@ You have additional SKILLs documented in directories containing a "SKILL.md" fil
 | socket-inspect     | Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.                                                                                                                                                                                |
 | socket-release     | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo - copy in the socket-release kit from a sauce checkout and run its bootstrap through name reservation, GitHub environments, npm trusted publisher, publishing-access tightening, staged publish config, and verification.                                                                                                      |
 | socket-scan        | Run a dependency scan using the Socket CLI. Prompt unauthenticated users to log in or create an account. If they decline, offer a local SBOM that does not include Socket analysis. Authenticated users get temporary read-only scans by default (--tmp). Creates a persistent dashboard scan only when explicitly requested. Includes reachability analysis for enterprise customers and license compliance auditing. |
-| socket-scan-setup  | Set up prerequisites for Socket scanning - install the CLI, configure user-owned authentication, and verify scan access. Use this before the first scan or when encountering auth errors.                                                                                                                                                                                                                              |
-| socket-setup       | Set up Socket - prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                                                                                                                                                                                                        |
+| socket-scan-setup  | Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access. Use this before the first scan or when encountering auth errors.                                                                                                                                                                                                                             |
+| socket-setup       | Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                                                                                                                                                                                     |
 
 ## Usage
 
@@ -43,6 +44,8 @@ The skills are located in:
 
 - `skills/socket-release/npm-publish/SKILL.md`
 
+- `skills/socket-connect/SKILL.md`
+
 - `skills/socket-fix/socket-dep-cleanup/SKILL.md`
 
 - `skills/socket-fix/socket-dep-patch/SKILL.md`

gemini-extension.json

@@ -2,5 +2,10 @@
   "name": "socket-skills",
   "description": "Provides access to Socket Security Skills.",
   "version": "1.0.0",
-  "contextFileName": "agents/README.md"
+  "contextFileName": "agents/README.md",
+  "mcpServers": {
+    "socket": {
+      "httpUrl": "https://mcp.socket.dev/"
+    }
+  }
 }

scripts/repo/generate-cursor-plugin.mts

@@ -92,9 +92,19 @@ export function buildCursorPluginManifest(
   return manifest
 }
 
+/**
+ * The hosted Socket MCP server. It signs users in with OAuth (dynamic client
+ * registration + PKCE against api.socket.dev), so the plugin ships no API key
+ * and users never paste one. Keep in sync with the socket-connect entry in
+ * .claude-plugin/marketplace.json and with gemini-extension.json.
+ */
+export const SOCKET_MCP_URL = 'https://mcp.socket.dev/'
+
 export function buildMcpConfig(): Record<string, unknown> {
   return {
-    mcpServers: {},
+    mcpServers: {
+      socket: { url: SOCKET_MCP_URL },
+    },
   }
 }
 

skills/_shared/docs/cli-setup.md

@@ -18,8 +18,8 @@ Commands that require authentication need a Socket account and a credential that
 
 Authenticate with one of these methods:
 
-- **Interactive login**: `pnpm dlx socket login` (stores credentials in `~/.socket/`)
-- **Environment variable**: Set `SOCKET_CLI_API_TOKEN` in your shell profile or CI environment
+- **Interactive login**: the user runs `pnpm dlx socket login` in their own terminal (it needs an interactive TTY, so the agent cannot run it). CLI releases with browser login show a device code to approve in the browser; older releases, including the current npm release, prompt for an API token. The `/socket-connect` skill covers signing in and choosing organizations.
+- **Environment variable (CI)**: Set `SOCKET_CLI_API_TOKEN` to an organization API token in CI or other non-interactive environments
 
 Verify account authentication: