Repository navigation
Add a tool to return not only the scores themselves but also the reason for any deductions #186
Description
The socket.dev website displays scores along with reasons for deductions (e.g., known malware, eval function usage), but this MCP server only provides scores for the given packages.
When an AI agent attempts to access the socket.dev site to verify deduction reasons, it receives a 403 error. This leaves the AI agent with no means whatsoever to check deduction reasons.
Activity
samarth70 commentedon Jul 12, 2026
I've opened a PR for this.
depscorewas calling/v0/purlwithalerts=false, so only scores came back with no way to see why one was low. The PR requestsalerts=trueand appends a compact, deduplicatedAlerts:line to each package — naming the alert types with severity (e.g.malware (critical), usesEval (middle)), capped with a+N moreoverflow so it doesn't flood the agent's context. Happy to adjust the format or gate it behind a flag if you'd prefer.