---
updatedAt: 2026-10-15T12:18:01.000Z
agentTools:
  projectIndex: https://docs.socket.dev/llms.txt
---

# Socket for Origin

Scan dependency changes in Cursor Origin pull requests against your Socket security policy.

Socket for Origin connects repositories on [Cursor Origin](https://cursor.com/codebase) to your Socket organization. When a pull request changes dependencies, Socket scans the change, reports a check based on your organization's security policy, and comments with dependency scores and alerts. Pushes to the default branch keep your Socket dashboard up to date.

## How it works

### Pull requests

Socket scans a pull request when it's opened and when new commits are pushed to it. Socket compares the supported manifest and lockfiles on the target branch with Origin's proposed merge result, so the check reflects what merging would change. Socket reads only these files and doesn't need to build your project.

The check appears in Origin as **Socket Security / Dependency scan**. Its result follows the [alert actions](https://docs.socket.dev/docs/alert-actions-and-triage-functionality) in your security policy, and the check only counts alerts that the pull request introduces:

* Alerts set to **Block** fail the check.
* Alerts set to **Warn** appear in the check summary and the pull request comment, and the check still passes.
* Alerts set to **Monitor** or **Ignore** aren't shown.

| Result          | Title                            | What it means                                                                                         |
| :-------------- | :------------------------------- | :---------------------------------------------------------------------------------------------------- |
| Success         | Dependency scan passed           | The pull request introduces no alerts set to Block.                                                   |
| Failure         | Blocking dependency alerts found | The pull request introduces at least one alert set to Block.                                          |
| Neutral         | No supported dependency files    | The proposed merge has no supported manifest or lockfiles to scan.                                    |
| Action required | Complete Socket setup            | Socket is installed in Origin. Select the check to connect the workspace to your Socket organization. |

When a check needs attention, its summary explains what to do. You can rerun any check from Origin.

### Pull request comments

When a scan passes or fails, Socket comments on the pull request:

* **Dependency overview:** added and updated direct dependencies, with Supply Chain, Vulnerability, Quality, Maintenance, and License scores.
* **Alerts:** each alert set to Block or Warn, including alerts on transitive dependencies, with its severity, fix details when available, and links to the Socket report.

For other results, Socket posts the check title and summary as a comment. Socket updates its comments in place as the pull request changes.

### Default branch

When you push to the default branch, Socket scans it and posts a **Project Report** check with a link to the report. These scans keep the [Alerts](https://docs.socket.dev/docs/organization-alerts) and Dependencies pages in your Socket dashboard up to date. After you connect, Socket starts tracking a repository's default branch with the next push to that branch.

### In the Socket dashboard

Origin repositories appear in Socket as `origin-<owner>/<repository>`, where `<owner>` is the Origin workspace that owns the repository. Pull request scans are listed with their pull request number, and default-branch scans drive the Alerts and Dependencies pages.

## Install and connect

You need:

* Access to a Cursor Origin workspace, with permission to install apps.
* The **Owner** or **Admin** role in the Socket organization you connect. See [User Roles and Permissions](https://docs.socket.dev/docs/users). Socket roles are separate from Origin roles.

To install and connect:

1. In Origin, open the **App Marketplace**, select **Socket**, and install it on the repositories you want to scan.
2. When Origin sends you to Socket, sign in and choose the Socket organization to connect. If your organization uses SSO, sign in with SSO.
3. Approve the requested access.
4. On the **Confirm your connection** page, select **Connect workspace**.

After you connect:

* Socket scans new pull request activity.
* Socket scans the default branch on the next push to it.
* You choose which repositories Socket can access in your Origin app settings.

Each Origin workspace connects to one Socket organization, and several Origin workspaces can connect to the same Socket organization.

## Require the check before merging

To require a passing Socket check before merging, add **Socket Security / Dependency scan** as a required check in your Origin repository's merge rules.

## Reconnect or disconnect

To reconnect, for example when a different Owner or Admin takes over the connection, uninstall Socket from your Origin workspace's app settings and install it again from the **App Marketplace**. Repeat the connect steps above.

To stop scanning, uninstall Socket from your Origin workspace's app settings. Socket stops processing events for that workspace and deletes its stored credentials. Scans already in your Socket dashboard stay there.