Socket for Origin

Socket for Origin connects repositories on Cursor Origin to your Socket organization. When a pull request changes dependencies, Socket scans the change, reports a check based on your organization's security policy, and comments with dependency scores and alerts. Pushes to the default branch keep your Socket dashboard up to date.

How it works

Pull requests

Socket scans a pull request when it's opened and when new commits are pushed to it. Socket compares the supported manifest and lockfiles on the target branch with Origin's proposed merge result, so the check reflects what merging would change. Socket reads only these files and doesn't need to build your project.

The check appears in Origin as Socket Security / Dependency scan. Its result follows the alert actions in your security policy, and the check only counts alerts that the pull request introduces:

• Alerts set to Block fail the check.
• Alerts set to Warn appear in the check summary and the pull request comment, and the check still passes.
• Alerts set to Monitor or Ignore aren't shown.

When a check needs attention, its summary explains what to do. You can rerun any check from Origin.

Pull request comments

When a scan passes or fails, Socket comments on the pull request:

• Dependency overview: added and updated direct dependencies, with Supply Chain, Vulnerability, Quality, Maintenance, and License scores.
• Alerts: each alert set to Block or Warn, including alerts on transitive dependencies, with its severity, fix details when available, and links to the Socket report.

For other results, Socket posts the check title and summary as a comment. Socket updates its comments in place as the pull request changes.

Default branch

When you push to the default branch, Socket scans it and posts a Project Report check with a link to the report. These scans keep the Alerts and Dependencies pages in your Socket dashboard up to date. After you connect, Socket starts tracking a repository's default branch with the next push to that branch.

In the Socket dashboard

Origin repositories appear in Socket as origin-<owner>/<repository>, where <owner> is the Origin workspace that owns the repository. Pull request scans are listed with their pull request number, and default-branch scans drive the Alerts and Dependencies pages.

Install and connect

You need:

• Access to a Cursor Origin workspace, with permission to install apps.
• The Owner or Admin role in the Socket organization you connect. See User Roles and Permissions. Socket roles are separate from Origin roles.

To install and connect:

1. In Origin, open the App Marketplace, select Socket, and install it on the repositories you want to scan.
2. When Origin sends you to Socket, sign in and choose the Socket organization to connect. If your organization uses SSO, sign in with SSO.
3. Approve the requested access.
4. On the Confirm your connection page, select Connect workspace.

After you connect:

• Socket scans new pull request activity.
• Socket scans the default branch on the next push to it.
• You choose which repositories Socket can access in your Origin app settings.

Each Origin workspace connects to one Socket organization, and several Origin workspaces can connect to the same Socket organization.

Require the check before merging

To require a passing Socket check before merging, add Socket Security / Dependency scan as a required check in your Origin repository's merge rules.

Reconnect or disconnect

To reconnect, for example when a different Owner or Admin takes over the connection, uninstall Socket from your Origin workspace's app settings and install it again from the App Marketplace. Repeat the connect steps above.

To stop scanning, uninstall Socket from your Origin workspace's app settings. Socket stops processing events for that workspace and deletes its stored credentials. Scans already in your Socket dashboard stay there.