Kiwi
Kiwi

Kiwi for Socket

Have the agent on a Kiwi step check the Socket scores of a dependency before adding it, through Socket's MCP server.

  • Your agent works in Socket through its own connection. Kiwi does not call Socket and never holds its credentials.
  • A workflow skill can list Socket among the tools it requires. When you supply your agent's available tools to a skill check and Socket is not among them, the check reports SK15-UNSUPPORTED-TOOL.
  • A project Admin can add links to Socket, with notes, under Connections and bind them to the steps that use them. The agent reads them with list_connections.
  • The agent can report the tools and plugins it ran with, including its Socket connection, with report_configuration.
  • The agent submits links to its work in Socket as the step's outputs. People review them, and sign-off stays with the people your workflow names.

What your agent can do in Socket

  • Score a package by ecosystem, name and version with the depscore tool.
  • Read the supply chain, quality, maintenance, vulnerability and license scores of each package.
  • Check several packages in one request before a dependency change.

Set up

  1. Connect your agent to Kiwi

    Add Kiwi's hosted MCP server, https://kiwiflow.io/mcp, to your coding agent.

    Coding agentsQuickstart

  2. Connect your agent to Socket

    Add the Socket MCP server to your agent with this URL. The credentials stay with your agent.

    https://mcp.socket.dev/

    Socket documentation

  3. Example skill

    Publish instructions like these as a workflow skill that lists Socket among its required tools.

    Start from the dependency change listed in the assignment.
Check each new or upgraded package with Socket's depscore tool.
Record the scores of each package as the step's outputs.
If a package scores low on supply chain or vulnerability, leave it out
and report a blocker to the step owner; the assigned reviewer decides.
Get startedRead the setup guide