Add file analysis, threat feed, alerts, and organizations tools

[annextuckner]

Summary

• Adds five new MCP tools on top of depscore: package_files, package_file_contents, package_file_grep, organizations, alerts, and threat_feed — covering package contents inspection and org-scoped Socket data.
• package_file_contents / package_file_grep share a process-wide LRU blob cache (default 64 MB, env-tunable) so repeated reads of the same hash skip the network.
• Threat feed tool wraps GET /v0/orgs/{org_slug}/threat-feed with the documented filters (filter, ecosystem, name, version, is_human_reviewed, sort, direction, updated_after/created_after, per_page, cursor).

Test plan

• npm test (lint + tsc + node --test): existing + new blob.test.ts, files.test.ts, expanded purl.test.ts pass
• stdio mode: SOCKET_API_KEY=… node --experimental-strip-types index.ts — exercise organizations → alerts → threat_feed against a real org slug
• HTTP mode: --http + bearer passthrough, then run package_files on a known package, follow up with package_file_contents / package_file_grep using a returned hash
• Confirm threat_feed defaults (filter=mal) return malware items, and ecosystem/name/version filters narrow correctly

🤖 Generated with Claude Code

[annextuckner]

Not ready to