Cursor teams can now block risky dependencies by installing Socket for Origin in the App Marketplace

Socket has released Socket for Origin in the Origin App Marketplace, enabling automatic dependency scanning for teams using Cursor’s development environment. This integration allows security operations to evaluate package risks directly within the pull request workflow, addressing supply chain vulnerabilities before code is merged into the main repository.

What is Socket for Origin?

Socket for Origin is a security tool that scans dependency changes within pull requests. According to Socket, it flags security risks based on an organization’s specific policies. The tool is designed to integrate with Origin, a platform built by SpaceXSI for hosting and collaborating on code at scale, which traditional Git infrastructure was not designed to handle.

How does it integrate with the workflow?

The integration joins more than 20 developer tools in the Origin app marketplace. Teams building on Origin can use Socket alongside existing CI, deployment, and code review tools. Origin brings repository hosting, pull requests, and coding agents into Cursor’s development workflow, and Socket adds dependency security checks to that process without requiring developers to leave the platform.

What does the tool scan for?

Socket analyzes open source packages for malicious behavior and other supply chain risks. It scans supported manifests and lockfiles when a pull request is opened or new commits are pushed. This includes dependency changes in monorepo workspaces. The tool compares the target branch with Origin’s proposed merge result to evaluate the specific dependency changes the pull request would introduce.

What do reviewers see?

Reviewers see dependency summaries and security findings directly on the pull request. Socket posts comments with dependency overviews, scores, severity labels, and report links. A policy-based security check shows scan progress and reports a verdict based on the organization’s policies. Subsequent scan results update the app’s comments as the pull request changes, allowing reviewers to see findings without leaving the interface.

Questions to ask your suppliers

Organizations should ask suppliers whether their development workflows include automated dependency scanning for all code changes. Verify if security policies are enforced before merging pull requests, especially when AI agents select packages. Confirm that teams have visibility into supply chain risks introduced by third-party libraries. Ensure that security operations teams are notified of any policy violations or high-severity findings. Check if the supplier’s tooling integrates with your existing code review platforms to maintain consistent security standards across the organization.

Background: AI agents

AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. They move beyond generating text to performing tasks like coding, scheduling, or data analysis. You must treat them as active participants in your network, not passive tools.

Read the full guide: AI Agents Examples: How Autonomous Software Changes Security

What to do and how to stay safe: Socket

• Review current pull request policies to ensure dependency changes are scanned before merging.
• Verify that your development tools support automated security checks for open source packages.
• Monitor pull request comments for security findings and severity labels from integrated tools.
• Ensure that AI agents and developers follow the same security policies when adding dependencies.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Where can I install Socket for Origin?

Socket for Origin is available in the Origin App Marketplace, which is part of Cursor’s development workflow.

Does Socket scan monorepo workspaces?

Yes, Socket scans dependency changes in monorepo workspaces when pull requests are opened or new commits are pushed.

Who built the Origin platform?

SpaceXSI built Origin to give developers and AI agents a place to host and collaborate on code at scale.