> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Socket

Serval's Socket integration lets you automate **software supply-chain security**: vet open-source dependencies, monitor supply-chain alerts, run and gate on dependency scans, triage findings, and export SBOMs.
The integration connects via a Socket organization API token.

***

## What is Socket?

[Socket](https://socket.dev) analyzes open-source packages (npm, PyPI, Maven, Go, and more) for supply-chain risk — malware, typosquats, risky install scripts, hijacked maintainers, known CVEs, and license issues — and scores every package's health. Organizations connect Socket to their repositories and enforce security policies on the dependencies entering their code.

***

## What Serval can do once connected

| Capability           | Description                                                                                                             |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Vet packages         | Look up Socket health scores, alerts, and license data for any package before adopting it                               |
| Monitor alerts       | List and filter the organization's supply-chain alerts (severity, category, repository, known-exploited CVEs)           |
| Scans                | Create full scans from manifest files, check scan state and results, create diff scans for change gating                |
| Triage               | Create triage rules and resolutions that ignore, monitor, warn on, or block matching alerts                             |
| SBOM export          | Export scans as CycloneDX, SPDX, or OpenVEX documents (Socket Business plan and above)                                  |
| Automation workflows | Call any endpoint in the curated [Socket REST API](https://docs.socket.dev/reference) subset exposed by the integration |

<Info>
  Socket meters API usage in hourly **quota units** that vary by plan (Free 500/hr, Team 2,500/hr, Business 10,000/hr). Alert listing costs 10 units per request and batch package lookups cost 100, so schedule polling workflows accordingly.
</Info>

***

## Configure Socket

### Prerequisites

* A Socket organization you can administer
* Permission to create an organization API token

### Create an API token

1. In Socket, open **Settings → API Tokens**
2. Click **Create API Token**
3. Configure the token:
   * **Name**: e.g. `Serval Integration`
   * **Scopes**: enable the scopes below
4. Create the token and copy the value — it is only shown once

### Suggested scopes

| Scope                                                        | Used for                                  |
| ------------------------------------------------------------ | ----------------------------------------- |
| `packages:list` (+ `pkg:npm`, `pkg:pypi`, ... per ecosystem) | Package vetting lookups                   |
| `full-scans:list`, `full-scans:create`                       | Listing, creating, and checking scans     |
| `diff-scans:list`, `diff-scans:create`                       | Diff scans for change gating              |
| `alerts:list`                                                | Listing supply-chain alerts, healthchecks |
| `triage:alerts-list`, `triage:alerts-update`                 | Reading and creating triage rules         |
| `alert-resolution:list`, `alert-resolution:create`           | Resolving alerts with a recorded reason   |
| `repo:list`                                                  | Listing repositories, healthchecks        |
| `report:read`                                                | SBOM export (Business plan and above)     |
| `fixes:list`                                                 | Vulnerability fix lookups                 |

***

## Serval Configuration

1. In Serval, go to **Integrations → All integrations → Socket → Connect**

2. Enter:

   | Field             | Description                                                                                               |
   | ----------------- | --------------------------------------------------------------------------------------------------------- |
   | Organization Slug | Your Socket org slug (from the dashboard URL, e.g. `my-company` in `socket.dev/dashboard/org/my-company`) |
   | API Token         | The token you created above                                                                               |

3. Click **Save**

Serval validates the connection and runs healthchecks for authentication, organization access, repository listing, and alert listing. Once verified, the integration shows **Healthy** on the Integrations page.

### Managing access later

* **Rotate token** — Rotate the token in Socket (Settings → API Tokens), then update the token in Serval's integration settings
* **Disconnect** — Remove the integration from Serval; revoke the token in Socket

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your Socket integration.