JavaScript SDK for the Socket.dev API - package scoring, quota management, batch lookups, dependency analysis.
@socketsecurity/sdk is the canonical JavaScript/TypeScript client for the Socket.dev API. It exists so any Node app - your build pipeline, your registry tooling, your custom security gate - can call Socket's package-scoring and analysis endpoints without hand-rolling auth, retries, and response shapes. The SDK is consumed by Socket's own CLI, MCP server, and third-party integrations.
pnpm add @socketsecurity/sdk
Quickstart: construct SocketSdk with retries, retryDelay and timeout, then call getQuota, getScoreByNpmPackage, and batchPackageFetch
import { SocketSdk } from '@socketsecurity/sdk' const client = new SocketSdk('your-api-key', { retries: 3, // Retry failed requests up to 3 times retryDelay: 1000, // Start with 1s delay, exponential backoff timeout: 30000, // 30 second timeout }) // Check your quota const quota = await client.getQuota() if (quota.success) { console.log(`Available quota: ${quota.data.quota} units`) } // Analyze a package const result = await client.getScoreByNpmPackage('express', '4.18.0') if (result.success) { console.log(`Dependency Score: ${result.data.depscore}`) } // Batch analyze multiple packages const batchResult = await client.batchPackageFetch({ components: [ { purl: 'pkg:npm/[email protected]' }, { purl: 'pkg:npm/[email protected]' }, ], })
Contributor commands
pnpm install
pnpm run build
pnpm test
pnpm run check| Guide | Description |
|---|---|
| API Reference | Class methods, exported helpers, and types |
| SDK Concepts | Results, pagination, uploads, and runtime behavior |
| Quota Management | Metadata-backed costs and quota helpers |
| Unsupported endpoints | Endpoints the SDK does not wrap |
MIT
