Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace.
- Matt Stypa
Socket for Origin is now available in the Origin App Marketplace, with automatic dependency scans and security findings directly on your pull requests.
SpaceXSI built Origin to give developers and AI agents a place to host and collaborate on code at a scale traditional Git infrastructure wasn’t designed for. Socket adds dependency security to that workflow, helping teams catch risky packages and compromised updates in pull requests before they merge.
We’re joining more than 20 developer tools in the Origin app marketplace, so teams building on Origin can use Socket alongside their existing CI, deployment, and code review tools.
Dependency security checks for Origin pull requests# #
Origin brings repository hosting, pull requests, and coding agents into Cursor’s development workflow. Whether a developer adds a package or an agent selects it while implementing a feature, that dependency becomes part of the application’s software supply chain.
A small change to a manifest or lockfile can introduce a malicious package or a compromised update. Reviewing the application code alone won’t tell you whether the dependencies it pulls in are safe. Socket analyzes open source packages for malicious behavior and other supply chain risks, giving reviewers more context before they merge.
Socket for Origin puts those findings on the PR, where developers can review them as part of their existing workflow.
Scan automatically and review findings without leaving Origin# #
Once connected, Socket scans supported manifests and lockfiles when a pull request is opened or new commits are pushed, including dependency changes in monorepo workspaces. It compares the target branch with Origin’s proposed merge result to evaluate the dependency changes the PR would introduce.
Results appear in Origin in two places:
- A policy-based security check. TheSocket Security / Dependency scan check shows scan progress, reports a verdict based on your Socket organization’s policies, and links to the full report. Developers can rerun the check directly in Origin.
- Dependency summaries and security findings. Socket posts PR comments with dependency overviews, scores, severity labels, and report links. Subsequent scan results update the app’s comments as the PR changes.
Reviewers can see the dependency findings without leaving the pull request and open the full Socket report when they need more detail.
Connect Socket to Origin# #
To get started, install Socket from the Origin App Marketplace, authorize your Socket organization, and confirm the connection. From there, scans run automatically as you open pull requests and push new commits.
Connect Socket to bring dependency security checks into your team’s Origin pull requests.