socket-setup

Setup

When to Use

• User wants to get started with Socket
• User needs to install/configure the Socket CLI
• User wants to authenticate with Socket
• User wants to set up Socket Firewall
• User wants to set up socket-patch for automated patching
• User wants to add Socket to CI/CD pipelines
• User wants to configure Socket policies (socket.yml)
• User wants to set up API tokens for CI or local development
• User is having trouble authenticating
• User wants to install Socket tools globally for local development
• User wants to integrate Socket into Dockerfiles

Step 1: Check Prerequisites

Ask each tool for its version. A command not found error means the tool is not installed:

node --version
socket --version
sfw --version
socket-patch --version

Detect the package manager from the lock file in the project root - the command prints only the files that exist:

ls -d package-lock.json pnpm-lock.yaml yarn.lock bun.lock bun.lockb 2>/dev/null || true

package-lock.json means npm, pnpm-lock.yaml means pnpm, yarn.lock means yarn, and bun.lock or bun.lockb means bun. With no lock file, ask the user which package manager the project uses.

Handle results:

• If node --version fails: prompt the user to install Node.js. Suggest:
  • nvm (recommended): curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash then nvm install 20
  • Homebrew (macOS): brew install node
  • Official installer: https://nodejs.org/
• If node --version reports below v18: warn that Node.js 18+ is required and suggest upgrading
• If socket --version reports below 1.0.0: warn that the Socket CLI is below 1.x and prompt to update with npm install -g socket@latest
• If socket --version fails: proceed to Step 3 (Install the CLI)

Step 2: Ask About Socket Account

Ask the user whether they have or want to create a Socket account. There are three tiers:

• No account (public token): No sign-up required. The Socket CLI supports a built-in public token that provides limited access to CLI features including socket fix, socket scan, sfw, and socket-patch apply. Rate limits and feature restrictions apply compared to a full account, but basic vulnerability scanning and fixing work out of the box. Dashboard access, organization management, and policy configuration are NOT available without an account.
• Free account: Create one at https://socket.dev. Removes public-token rate limits, enables full dashboard access and organization features. All CLI features are available.
  • Sign up / sign in: https://socket.dev/auth/login
  • Token page: https://socket.dev/dashboard/org/{ORG}/settings/integrations/api-tokens
• Enterprise account: All free account features plus reachability analysis (socket scan reach), policy configuration (socket.yml), and organization-level management.