JavaScript SDK for the Socket.dev API - package scoring, quota management, batch lookups, dependency analysis.
@socketsecurity/sdk is the canonical JavaScript/TypeScript client for the Socket.dev API. It exists so any Node app - your build pipeline, your registry tooling, your custom security gate - can call Socket's package-scoring and analysis endpoints without hand-rolling auth, retries, and response shapes. The SDK is consumed by Socket's own CLI, MCP server, and third-party integrations.
pnpm add @socketsecurity/sdkQuickstart: construct SocketSdk with retries, retryDelay and timeout, then call getQuota, getScoreByNpmPackage, and batchPackageFetch
import { SocketSdk } from '@socketsecurity/sdk'
const client = new SocketSdk('your-api-key', {
retries: 3, // Retry failed requests up to 3 times
retryDelay: 1000, // Start with 1s delay, exponential backoff
timeout: 30000, // 30 second timeout
})
// Check your quota
const quota = await client.getQuota()
if (quota.success) {
console.log(`Available quota: ${quota.data.quota} units`)
}
// Analyze a package
const result = await client.getScoreByNpmPackage('express', '4.18.0')
if (result.success) {
console.log(`Dependency Score: ${result.data.depscore}`)
}
// Batch analyze multiple packages
const batchResult = await client.batchPackageFetch({
components: [
{ purl: 'pkg:npm/express@4.18.0' },
{ purl: 'pkg:npm/react@18.0.0' },
],
})Contributor commands
pnpm install
pnpm run build
pnpm test
pnpm run check| Guide | Description |
|---|---|
| API Reference | Class methods, exported helpers, and types |
| SDK Concepts | Results, pagination, uploads, and runtime behavior |
| Quota Management | Metadata-backed costs and quota helpers |
| Unsupported endpoints | Endpoints the SDK does not wrap |
MIT
