---
title: "Kiwi for Socket"
description: "Have the agent on a Kiwi step check the Socket scores of a dependency before adding it, through Socket's MCP server."
canonical: "https://kiwiflow.io/integrations/socket"
---

# Kiwi for Socket

Have the agent on a Kiwi step check the Socket scores of a dependency before adding it, through Socket's MCP server.

- Your agent works in Socket through its own connection. Kiwi does not call Socket and never holds its credentials.
- A workflow skill can list Socket among the tools it requires. When you supply your agent's available tools to a skill check and Socket is not among them, the check reports `SK15-UNSUPPORTED-TOOL`.
- A project Admin can add links to Socket, with notes, under Connections and bind them to the steps that use them. The agent reads them with `list_connections`.
- The agent can report the tools and plugins it ran with, including its Socket connection, with `report_configuration`.
- The agent submits links to its work in Socket as the step's outputs. People review them, and sign-off stays with the people your workflow names.

## What your agent can do in Socket

- Score a package by ecosystem, name and version with the depscore tool.
- Read the supply chain, quality, maintenance, vulnerability and license scores of each package.
- Check several packages in one request before a dependency change.

## Set up

### 1. Connect your agent to Kiwi

Add Kiwi's hosted MCP server, `https://kiwiflow.io/mcp`, to your coding agent.

- [Coding agents](https://kiwiflow.io/integrations#agent)
- [Quickstart](https://docs.kiwiflow.io/quickstart#connect-your-agent)

### 2. Connect your agent to Socket

Add the Socket MCP server to your agent with this URL. The credentials stay with your agent.

```
https://mcp.socket.dev/
```

- [Socket documentation](https://docs.socket.dev/docs/guide-to-socket-mcp)

### 3. Example skill

Publish instructions like these as a workflow skill that lists Socket among its required tools.

```
Start from the dependency change listed in the assignment.
Check each new or upgraded package with Socket's depscore tool.
Record the scores of each package as the step's outputs.
If a package scores low on supply chain or vulnerability, leave it out
and report a blocker to the step owner; the assigned reviewer decides.
```

## More code quality and security integrations

- [Kiwi for SonarQube](https://kiwiflow.io/integrations/sonarqube.md): Have the agent on a Kiwi step read the SonarQube quality gate and issues for its change through the SonarQube MCP server.
- [Kiwi for Snyk](https://kiwiflow.io/integrations/snyk.md): Have the agent on a Kiwi step scan its code and dependencies for vulnerabilities through the MCP server in the Snyk CLI.
- [Kiwi for Codecov](https://kiwiflow.io/integrations/codecov.md): Have the agent on a Kiwi step read a pull request's coverage change from the Codecov API and return it with the step's outputs.
- [Kiwi for Semgrep](https://kiwiflow.io/integrations/semgrep.md): Have the agent on a Kiwi step scan the code it changed for security issues with Semgrep through the Semgrep CLI's MCP server.
- [Kiwi for CodeRabbit](https://kiwiflow.io/integrations/coderabbit.md): Have the agent on a Kiwi step review its own changes with the CodeRabbit CLI and fix the findings before it submits them.

- [Get started](https://kiwiflow.io/get-started)
- [Read the setup guide](https://docs.kiwiflow.io/other-tools)