Newsroom. What Safeguard is shipping and saying.

Safeguard's remote MCP server is now published in the official MCP Registry as sh.safeguard/safeguard, verified against the safeguard.sh domain.

Safeguard.sh releases a paper arguing that open source vulnerabilities should be fixed at the source, and sets a January 2027 objective for remediation.

No monthly cap, no per-minute peak and no charge for MCP tool calls on any plan, plus pay-as-you-go API pricing and no markup on model usage.

SAST on customer-managed runners, a headless runner image, and local CI scanning that uploads only results, so source code never leaves the customer's infrastructure.

Safeguard Guard runs inside the application at the library and framework level and enforces the guardrails a team defines on the Safeguard Policy page. It is in early access, with SDK packages rolling out to registry.safeguard.sh.

Gold Live keeps every version of a fixed open-source component clean over time. Gold Zero-Day is coming soon. The first Gold builds are live on registry.safeguard.sh in early access.

Safeguard is building a private registry of fixed, rebuilt and signed open-source packages and container images, with published launch targets for fix times across three tiers.

After Anthropic launched OSS Scanner, an opt-in open-source vulnerability scanner built on its experience with Claude, Safeguard has published a guide for security and engineering leaders on sending code or data to LLM vendors, with ten questions to ask any AI vendor and its own commitments.

Safeguard now appears on CISA's list of Secure by Design Pledge signers, committing to measurable progress within one year on the pledge's seven security goals for its own products, and has published its starting position on each goal.

Safeguard's MCP connector is now available in ChatGPT, alongside its existing Claude directory listing, letting users query their own projects, vulnerabilities and findings from inside the assistant. OAuth sign-in required; read-only; scope set by the session.

Safeguard DAST maps a live application's attack surface — subdomains, endpoints, APIs, certificates, archived URLs — and analyses served JavaScript for exposed secrets, reporting every one with a redacted sample only. A Coverage Score states how much of the surface each scan actually reached, and a reconnaissance mode maps a target while provably sending no vulnerability probes.

Safeguard has surpassed $1 million in annual recurring revenue in 2026 — its first ARR milestone — across direct sales, channel and white-label partners, and self-serve. The company was founded in 2026.

Safeguard's partner program is now open in every market: resellers, distributors, co-sell and referral partners, white-label and OEM partners, MSSPs, and systems integrators can apply to sell Safeguard's AI-native software supply chain security platform to end customers. Applications open at safeguard.sh/company/partners.

Safeguard's AI-native Enterprise Software Supply Chain Security platform — powered by the Griffin, Eagle and Lion sovereign models — will be delivered to Nigerian enterprises through OffShield Security, the Lagos-based offensive security firm and cybersecurity academy founded by Gabriel Odusanya. Safeguard's first partnership in Nigeria and in West Africa.

Safeguard Academy offers free curated courses, timed certification exams — including AI-conducted interview exams — and publicly verifiable certificates at academy.safeguard.sh. The first credential, Safeguard Certified Practitioner, covers supply-chain fundamentals through the scan-triage-VEX workflow, SBOMs, and compliance.

Safeguard's free Gold Open Source directory now ships as a Chrome extension and covers far more than packages and CVEs — AI models, MCP servers, agent skills, chip manufacturers, and the full MITRE ATT&CK framework are now browsable at gold.safeguard.sh.

The Safeguard side panel — Griffin AI search alongside any browser tab — is now published on the Chrome Web Store as a one-click install, with a single browser permission, no host access, and no data collection by the extension itself.

Griffin agentic search gains a live, Claude-style activity view and reliable multi-provider web research; the Trust Center goes live with shareable SBOM/VEX/AI-BOM artifacts and AI questionnaire auto-answer; and Safeguard is now reachable from the browser side panel, CLI, IDEs, and MCP across all four products.

Safeguard today announced billing and procurement tools for its MCP server, enabling AI agents to browse regional pricing, compare plan tiers, initiate Stripe checkout, and verify subscription activation — with per-tenant governance and full audit trails.

Safeguard is expanding from a posture and findings platform into a first-party detection and prevention platform, spanning first-party AppSec, defensive red-teaming, AI and data security, runtime/CNAPP, and a supply-chain package firewall — all feeding one unified findings model.

Safeguard is rolling out an install-time Package Firewall that blocks typosquats, dependency and namespace confusion, and known-malicious npm and pip packages inline, alongside AI model-artifact scanning that detects malware and unsafe deserialization in model weights — now including ONNX.

Safeguard announced secret-key authentication and automatic policy sync for the Guard SDK. Updated October 15, 2026: Guard is in early access, and its SDK packages are rolling out to registry.safeguard.sh.

Safeguard's MCP Server now gates each of its 650+ tools behind an individual per-tenant feature flag, with a curated default set enabled out of the box and fail-safe behavior that never broadens access on error.

Safeguard is extending its software supply chain security platform into first-party static (SAST) and dynamic (DAST) application security testing, unifying source-code and runtime findings in a single, tenant-isolated model.

Safeguard is now available as a connector in Claude, listed in the Claude connectors directory. The connector brings Safeguard's 190+ software supply chain security tools — vulnerability and SBOM intelligence, AI-powered remediation, and policy enforcement — into Claude, paired with continuous, activity-log-based compliance monitoring for Claude Enterprise and Claude Platform.

Safeguard's Multi-Agent TAOR Deep Think AI Engine now supports every major frontier model family — from Anthropic Claude Fable 5 and Opus to OpenAI GPT, Google Gemini, Microsoft Phi, and Meta Llama — plus private model hosting for organizations running their own models, all natively wired for continuous zero-day discovery and automated remediation.

Safeguard's AI-native Enterprise Software Supply Chain Security platform — powered by the Griffin, Eagle and Lion sovereign models — will be delivered exclusively to Indian and Middle Eastern enterprises through TechD Cybersecurity Limited's Provenance AI module on the TECHD ONE platform.

Griffin Zero, the flagship 671B-parameter mixture-of-experts reasoning model trained exclusively on cybersecurity data, is now generally available in Safeguard's Sovereign and Air-Gapped deployment tiers.

Safeguard introduces a three-model AI lineup — Griffin for reasoning, Eagle for ranking, and Lion for on-device inline inference — all trained exclusively on cybersecurity data.

Safeguard releases pre-mapped compliance packs for DORA and NIS2, producing continuous, signed evidence for EU software supply chain auditors.

Safeguard adds Source Code Complexity as the eleventh integrated scanner, bringing complexity and churn signals into its cross-scanner dedup and triage pipeline.

Safeguard's SOC 2 Type II audit is underway, backed by continuous controls evidence, a public coordinated disclosure programme, and sigstore-signed releases.

Safeguard MCP Server reaches general availability with per-tool capability scoping, sensitive-data egress guardrails powered by Lion, and a cryptographic chain-of-custody for every agent action.