Download Safeguard
Secure your software supply chain from your desktop, phone, IDE, or terminal. Available for Windows, macOS, Linux, Android, iOS, and all major IDEs.
Ways to run Safeguard
Run it on your own machine, or let us host it. Every surface talks to the same platform and the same findings.
Local
Runs on your own machine.Browser
AvailableThe Safeguard extension puts Griffin search in a side panel next to whatever tab you are on, and Gold Open Source looks up any package or CVE.
Computer
AvailableThe native desktop app for Windows, macOS and Linux — the whole platform in its own window.
Sandbox
AvailableAn isolated local sandbox to try scans and fixes against throwaway state.
CLI
AvailableOne static binary. Scan from your terminal or wire it into a CI/CD pipeline.
curl -fsSL https://cli.safeguard.sh/install | bashCloud
Hosted by Safeguard — nothing to install.Cloud sandbox
AvailableA hosted, isolated sandbox tenant against a seeded demo repo. Free for seven days, no card.
Cloud browser
AvailableA remote browser session running Safeguard, streamed to your tab — nothing to install locally.
Cloud CLI
AvailableThe CLI running on Safeguard's infrastructure, so a scan needs no local runner.
Cloud computer
AvailableThe full platform in your browser, hosted by Safeguard — search, scans, SBOMs, compliance and reporting, with nothing to install.
Cloud credential vault
AvailableSign in and manage the API keys, tokens and secrets the cloud runners authenticate with.
Desktop
Ask your supply chain anything: every CVE, component, project and control you have scanned, answerable in plain English, in a native window that opens instantly.
Windows
Installer 3.2.2Windows 10/11 · x64 & ARM, one installer for both
Safeguard-3.2.2.exe · 205 MB
macOS
Apple Silicon 3.2.2macOS 12+ · signed & notarized
Safeguard-3.2.2-arm64.dmg · 115 MB
Linux
AppImage 3.2.2x86_64 · runs without installing
Safeguard-3.2.2-x86_64.AppImage · 120 MB
Windows — run the installer; it is per-user and needs no administrator rights. These builds are not yet code-signed, so SmartScreen will show “Windows protected your PC” — choose More info → Run anyway. That warning is expected until code signing lands, not a sign the file is corrupt; verify the checksum below if you want certainty. Prefer a smaller download? Architecture-specific installers: x64 · arm64.
> certutil -hashfile Safeguard-3.2.2.exe SHA256069f5fab80cd100ead36bbb8f881d62aa1db9a323b94ff875308d83f0e5578bemacOS — open the .dmg and drag Safeguard to Applications. Both builds are signed with Safeguard.sh Inc’s Developer ID and notarized by Apple, so there are no warnings to click through. Apple menu → About This Mac tells you which build you need: “Apple M…” is Apple Silicon, “Intel” is x64.
Apple Silicon cb5ac4f57a5ff6e6… · Intel 402cdfa6473dc2f2… — full checksums in the release’s SHA256SUMS.
Linux — an AppImage needs no installer: mark it executable and run it. Requires a 64-bit x86 Linux with FUSE available.
This build needs the Safeguard CLI installed and on your PATH.
$ chmod +x Safeguard-3.2.2-x86_64.AppImage && ./Safeguard-3.2.2-x86_64.AppImageVerify what you downloaded with sha256sum Safeguard-3.2.2-x86_64.AppImage
46685975126a0d017e5c6ee0a4ca19c07c04155e0695fd15a70b176544f97000Also listed in the release’s SHA256SUMS.
Newer AppImages are also signed with the Safeguard Desktop release key (--appimage-signature prints the signature). verify-appimage.sh checks it with gpg and tells you if a build is older and unsigned:
$ curl -fsSL --remote-name-all https://safeguard.sh/keys/{safeguard-desktop-release.asc,verify-appimage.sh} && bash verify-appimage.sh Safeguard-3.2.2-x86_64.AppImageKey fingerprint DC0F C295 C8A0 ACA2 45D7 111E BCB5 16DE 84C8 F86C
Mobile
The same answers on a phone. Google Play and the App Store are the way to install; the APK is here too, for phones without Play or a company that hands it out itself.
Android
Google PlayPhones and tablets
Google Play Store
iOS
App Store 2.0iPhone and iPad
Apple App Store
Android and iOS: install from Google Play or the App Store like any other app. The stores handle signing, updates and rollback. A file downloaded directly comes with its SHA-256 above, so you can check it before installing, as with the desktop builds.
IDE Extensions
Inline security scanning, guardrail enforcement, and one-click remediation inside your editor.
Browser extensions
Two browser extensions. Safeguard can read and change content on the websites you visit, so Griffin can carry out the browser tasks you give it. Gold Open Source looks up any package, CVE, model or MCP server on gold.safeguard.sh. It never reads page content, and it reads the current tab's address on npm, PyPI, GitHub and seven other package sites only if you turn that on.
Safeguard
1.0.4Published by Safeguard.sh Inc. Griffin search in a side panel, from your browser's own store.
Chrome Web Store · Chrome, Brave, Arc, Vivaldi, Opera and EdgeChromium browsers install from the same Chrome Web Store listing. Edge gets its own Add-ons listing later.
Add to Firefox (opens the Firefox Add-ons)Firefox Add-ons · FirefoxListed on addons.mozilla.org.
App Store · Safari on iPhone and iPadIncluded in the Safeguard.sh app. After installing, turn it on in Settings › Apps › Safari › Extensions (Settings › Safari › Extensions before iOS 18).- Get for Safari on Mac (opens the Mac App Store)Safari on Mac: in Apple reviewMac App Store · Safari on MacIncluded in the Safeguard.sh app for Mac. After installing, turn it on in Safari › Settings › Extensions.
Gold Open Source
freeA launcher for gold.safeguard.sh: check a package, container image, CVE, AI model, MCP server or agent skill without leaving your tab. No account needed.
Chrome and the Chrome Web Store are trademarks of Google LLC. Firefox is a trademark of the Mozilla Foundation in the U.S. and other countries. Apple, the Apple logo and Safari are trademarks of Apple Inc. App Store is a service mark of Apple Inc.
Connect an AI assistant
Safeguard runs as a Model Context Protocol server, so an assistant can scan a repository, read an SBOM and check an advisory without leaving the conversation.
Claude
Add Safeguard from Claude's connector directory on web, desktop or mobile. Sign in once with OAuth; there is no API key to create or paste.
https://mcp.safeguard.sh/mcp
ChatGPT
Install Safeguard from the ChatGPT plugin directory, and every scan, SBOM and advisory tool is available in the conversation.
https://mcp.safeguard.sh/openapi.jsonAny MCP client
Cursor, Windsurf, Gemini, Copilot, Cline and the rest. One Model Context Protocol server, with a ready-made config for each client.
https://mcp.safeguard.sh/mcpWeb interface
No install at all. The full platform in a browser (search, scans, SBOMs, compliance and reporting), and what the desktop app puts in its own window.
CLI Tool
Scan from your terminal or CI/CD pipeline. Version 1.4.0, a single static binary with no runtime to install.
$ curl -fsSL https://cli.safeguard.sh/install | bash> irm https://cli.safeguard.sh/install.ps1 | iex$ safeguard scan --dir ./my-project$ safeguard code-scan --file app.py$ safeguard detect --path .Every release publishes a SHA256SUMS beside its archives; the installer verifies it before putting anything on your PATH.
What's Included
Everything in the box, on every surface.
Every way to control Safeguard
One platform, several ways in. Two hands on a laptop, a thumb on your phone, the AI assistant you already use, and agents that work on your machine or ours. Pick a branch to see how it works and where to get it.
Safeguard
Safeguard
One platform, several ways in
Every branch controls the same Safeguard: the same data, the same agents and the same guardrails. Pick the way that fits the moment. Underneath, the platform behaves the same.
- Same platform. One system behind each way in
- Same guardrails. Sensitive steps wait for a person
- Same audit trail. Every action logged, whoever or whatever took it
control · your call
One core for everything digital
Computers, browsers, terminals, clouds, repos and APIs: Safeguard's agents work across them for you, inside the permissions your account grants, with each step logged.
Desktop & IDE
The desktop app and the editor extensions put scans and fixes where you already work.
Browser
Griffin in a side panel that can read and change content on the websites you visit, and Gold Open Source lookups for any package or CVE.
CLI & CI
Scans on your machine or in your pipeline, and sends only the results.
Cloud sandbox
An isolated tenant hosted by Safeguard, so nothing runs on your machine.
Repos & APIs
Connects to your source control and opens tested fix pull requests once you turn remediation on.
Chat & tickets
Sends alerts to your team chat and files issues in your ticketing tool.
SBOMs & reports
Generates SBOMs in SPDX and CycloneDX and exports reports as PDF, CSV or JSON.
One platform underneath
Each surface calls the same Safeguard, with the same permissions and audit trail.
Every team, around the clock
The same agents work continuously for each team that owns software risk. They scan, triage and draft fixes day and night, and hand a person the decisions that need one.
Application security
Scans code, dependencies and containers, proves reachability and ranks what to fix first.
Engineering & DevSecOps
Opens tested fix pull requests and enforces policy gates in CI, at the level of autonomy you set.
Compliance & audit
Maps findings to controls, collects evidence and prepares audit-ready summaries.
Vendor & third-party risk
Requests SBOMs from suppliers, scores their risk and keeps monitoring it.
AI & platform teams
Scans models, agents and MCP servers, and tracks which agent holds which access.
Open source
Keeps an open-source inventory and points to hardened, zero-CVE components.
Agents act inside your permissions. Autonomous remediation is off until you turn it on, and you choose how far it goes. Sensitive steps wait for a person, and every action is logged and reversible.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.