An AI Security Assistant on Your Phone: What It Is Good For

A security assistant on your phone is good for asking about your findings, following up on work started at your desk, and deciding what happens next. Changes to code still run on a computer, with your approval. Safeguard's iOS and Android apps give the same answers as the desktop app, and the CLI does the hands-on work.

If you already pay for Claude, ChatGPT or Codex, you do not have to give that up to use Safeguard. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

This guide covers what a phone is actually useful for in security work, how Safeguard's mobile apps fit with the desktop app and CLI, how other assistants handle the phone, and the mistakes people make when they try to run everything from a five inch screen. Every third party fact comes from that vendor's own docs, read on 21 October 2026.

What a phone is good for in security and compliance work

Most security questions arrive at the wrong time. A customer emails about a CVE while you are on a train. An auditor asks whether a control was in place last quarter while you are between meetings. A colleague pings you about a failed build at dinner. None of those need a laptop to answer. They need someone who can look at the data and give a straight reply.

That is the first job for a phone assistant: questions. Plain language questions about your own data, answered from your own data. Some examples that fit a phone well:

• "How many critical vulnerabilities do we have right now?"
• "Is the payments service affected by the issue the customer asked about?"
• "Which projects use this package, and at what version?"
• "What changed in our findings since Monday?"
• "Which compliance tasks are overdue?"

The second job is follow-ups. You started something at your desk: a scan, a fix, a review. On your phone you check the result, read the summary, and decide whether it needs more attention. A follow-up is short. You read, you think, you reply.

The third job is tasks, and this is where people get the split wrong. Deciding on a task belongs on the phone. Doing a task that changes code belongs on a computer, where you can see the diff, run the tests, and approve each command. A good phone workflow ends with a clear note of what should happen next and who does it, not with a half-reviewed change pushed from a lock screen.

Here is a rough guide to where each kind of work fits.

The phone is the reading and deciding surface. The CLI is the doing surface. The desktop app sits between them, with a bigger screen for the same questions.

What a phone is not good for

Long diffs, dependency trees, and anything you would want to undo are poor fits for a phone. So are approvals you have not read. If an assistant on your phone asks you to approve a shell command, read the whole command before you tap. If it is too long to read comfortably, that is a sign it should wait until you are at a keyboard.

The Safeguard iOS and Android apps

Safeguard's download page puts it simply: "The same answers on a phone." The mobile apps give you the same plain language answers as the desktop app, where you ask your supply chain anything in a native window.

Install on iPhone and iPad

The iOS app is on the App Store for iPhone and iPad. Install it from the store and sign in with your Safeguard account. The store handles signing, updates and rollback.

The iOS app also carries the Safeguard browser extension for Safari on iPhone and iPad. To turn it on, open Settings, then Apps, then Safari, then Extensions, and enable Safeguard. The browser extension puts Griffin search in a side panel and, as the download page says, can read and change content on the sites you visit, so enable it on purpose. Safari on Mac is listed as in Apple review, so it is not available yet.

Install on Android phones and tablets

The Android app is on Google Play for phones and tablets. That is the normal route, and the download page says "Google Play and the App Store are the way to install."

There is also a direct APK, version 1.0.2, for phones without Google Play or for company managed rollouts. If you use it:

1. Download the APK from the download page.
2. Check the SHA-256 shown on the page against the file before you install. On a computer, shasum -a 256 Safeguard-1.0.2.apk on macOS or sha256sum Safeguard-1.0.2.apk on Linux prints the hash.
3. Allow installs from your browser when Android asks.
4. Note that updates to a direct APK come from the download page, not from Google Play.

Samsung and Huawei devices

Samsung Galaxy phones and tablets install the app from Google Play. Galaxy Book laptops running Windows use the Windows desktop app and the CLI.

Safeguard is not in Huawei AppGallery. MateBooks running Windows use the Windows app and CLI. Phones that install Android apps can use the direct APK, which the page offers for phones without Google Play. Otherwise, use the web interface at app.safeguard.sh or one of the cloud options, which need nothing installed.

First week with the mobile app

A practical way to start:

1. Install the app and sign in with the same account you use on the desktop or the web.
2. Ask one question you already know the answer to, such as the number of critical findings in a project you know well. This tells you the app is looking at the right workspace.
3. Ask one question you do not know the answer to, and check it later on a bigger screen.
4. For a week, use the phone only for questions and follow-ups. Note every time you wanted to do something the phone could not. Those notes become your list of things to set up on the CLI.

How other assistants handle the phone

Safeguard is not the only tool that splits work between a phone and a computer. The pattern is common, and it helps to see how each vendor describes it. This table uses only each vendor's own docs. It is a description of how each one works, not a ranking.

Notes on each

Claude Code on mobile. Anthropic's docs say the Claude app "is a client for Claude Code sessions rather than a place where code runs." You reach cloud sessions, a session running on your own machine through Remote Control, or the desktop app through Dispatch. Cloud sessions and Remote Control need a claude.ai account, so they are not reachable with a Console API key or a third party provider. Dispatch needs a Pro or Max plan. Running /mobile in a Claude Code session shows a QR code that opens the right app store.

Codex on mobile. OpenAI's docs say you can "follow progress, approve actions, and send instructions from your phone," and that "Codex runs tasks in the cloud or on a connected computer." Setup starts in the ChatGPT desktop app under Settings, Connections, Control this Mac or PC. The docs ask you to keep the computer awake and online, and say availability depends on rollout and your workspace settings. The page we read names iOS only.

GitHub Copilot on mobile. GitHub's docs show how to start a new cloud agent session from GitHub Mobile, pick a repository, and optionally a base branch, custom agent or model. You can also assign an issue to Copilot. "Copilot will start a new session, work on the task, and push any code changes." GitHub's plans page lists the cloud agent as not included in Copilot Free.

The common thread: in every case the phone is a remote control. The code runs somewhere else, and the phone is where you watch and decide.

Do the work properly with the Safeguard CLI

The Safeguard CLI is where the hands-on work happens. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code, not only scans. That makes it the natural partner to a phone: the phone asks and decides, the CLI does the work with your approval.

Install

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, so you do not need Node, Python or a JVM. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only). The download page lists CLI 1.4.0 with binaries for macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64.

First session

1. Open a terminal in your project folder and run safeguard with no arguments. That opens the interactive terminal.
2. Type /login. Your browser opens so you can sign in.
3. Type /scan . to scan the current folder.
4. Ask a question in plain language, such as "how many critical vulns do we have".
5. Type @ to attach a file from the folder you started in, and /resume next time to pick up the last session in that folder.

You can ask the same kind of question from your phone later.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it can edit the code and run commands, with your approval. You can also use it as a general terminal assistant on your machine: find and read files, edit code, run commands, plus everything security. The docs give "what's the latest file in ~/Downloads" as an example.

This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, then reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding.

Click through it at your own pace, or open it full screen.

For a longer walkthrough, read our guide to the Safeguard CLI as an AI assistant on your machine.

Keep the Claude, ChatGPT or Codex you already pay for

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Type /model to see or switch the model, and see the CLI docs for connecting one.

You can also stay in the chat you already use. Connect Claude or ChatGPT to the Safeguard MCP server and ask about your findings from there. This demo connects ChatGPT to the Safeguard MCP server with OAuth and chooses which tools ChatGPT can use.

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things, such as writing a file, editing code or running a command, ask before they act. /permissions sets the approval mode:

• Ask prompts before every action.
• Auto approves known actions and asks for anything new. This is the default.
• Yolo approves everything.

If you decided on a fix from your phone and are now carrying it out, Ask lets you see every edit and command.

Scans and CI with safeguard exec

The same binary scans without the assistant:

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:latest
safeguard scan --sbom sbom.cdx.json
safeguard validate sbom.cdx.json

Each scan builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. When the local runner handles platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.

For pipelines, run one non-interactive assistant turn:

safeguard exec "summarise the critical findings in this repository"

That summary is the kind of thing you then read on your phone. Pass or fail decisions belong to policies and gates, which are evaluated in the Safeguard platform, not by the CLI.

Start in the terminal, continue on the desktop, check on your phone

The download page lists one platform on every surface:

• CLI for the terminal and CI/CD on macOS, Linux and Windows.
• Desktop app 3.2.2 for Windows 10 and 11 (one installer for x64 and ARM, per user, no admin rights), macOS 12 and later on Apple Silicon (signed and notarized, with an Intel build linked), and Linux as an x86_64 AppImage. The Windows build is not yet code signed, so SmartScreen may warn; check the SHA-256 first, then choose More info and Run anyway. The Linux AppImage needs the Safeguard CLI on your PATH.
• Mobile apps for iOS and Android.
• IDE extensions for VS Code, JetBrains and Open VSX editors, and a browser extension for Chrome and the other browsers the page lists.
• Cloud options with nothing to install: the Cloud CLI, a cloud browser, a cloud computer, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.

A typical day: you scan and fix on the CLI in the morning, review the bigger picture in the desktop app after lunch, and answer a customer's question from your phone in the evening. Same account, same data, same answers.

Common mistakes

Approving from the phone without reading. Any assistant that lets you approve actions from a phone makes it easy to tap yes on something you did not read. If the command or diff does not fit on the screen, wait until you are at a computer.

Treating the phone as the place where work happens. In every tool covered here, the phone is a client. Claude Code's docs say so directly. Plan for the work to run on a computer or in the cloud, and use the phone to steer.

Forgetting the computer has to stay on. Codex on a connected computer and Claude Code's Remote Control both need your machine awake and online. The same logic applies to any local work: if the machine running the CLI is asleep, nothing happens on it.

Sideloading without checking the hash. If you install Safeguard's direct APK, compare the SHA-256 from the download page before installing. If you can use Google Play, use it; the store handles signing, updates and rollback.

Assuming every store and device is covered. Safeguard is listed on the App Store and Google Play, with a direct APK. It is not listed in the Samsung Galaxy Store, Huawei AppGallery or the Microsoft Store, and there is no Apple Watch app. Use the routes the download page names.

Plugging a plan into a tool the provider has not approved. OpenCode's provider docs note that Anthropic prohibits using Claude Pro or Max plans through certain third party plugins. Read your provider's terms before you connect any plan to any tool.

Mixing up workspaces. If your phone and your laptop are signed in to different accounts or workspaces, you will get different answers. Ask a question you already know the answer to on both, and compare.

FAQ

What can I do in the Safeguard mobile app?

The download page describes it as "the same answers on a phone": the plain language answers you get in the desktop app, on iPhone, iPad and Android. Use it for questions about your findings, follow-ups on work you started elsewhere, and deciding what should happen next. Code changes run through the CLI on a computer.

Can I fix code from my phone?

Not directly from the Safeguard mobile app. Fixing code happens in the Safeguard CLI on your machine, where the assistant edits files and runs commands with your approval. The phone is where you read the result and decide on the next step.

Can I keep using my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Is the Safeguard app on Android tablets and iPads?

Yes. Google Play covers Android phones and tablets, and the App Store covers iPhone and iPad.

My Android phone has no Google Play. Can I still install Safeguard?

The download page offers a direct APK, version 1.0.2, for phones without Google Play. Check the SHA-256 on the page before installing, and remember that updates for the APK come from the download page. If your phone cannot install Android apps, use the web interface or a cloud option instead.

How does this compare to Claude Code or Codex on mobile?

All three treat the phone as a client. Claude Code's mobile app reaches cloud sessions or a session on your computer. Codex in the ChatGPT iOS app runs tasks in the cloud or on a connected computer. Safeguard's app answers questions from the platform, and its CLI does code work on your machine with your approval. Pick the setup that fits how your team works; you can also use them together.

Does my source code go to the cloud when I use the CLI?

When the local runner handles platform scan jobs, your source code stays on your machine and only SBOMs and findings are uploaded.

Is there a Safari extension on iPhone?

Yes. The browser extension for Safari on iPhone and iPad is included in the iOS app. Turn it on in Settings, Apps, Safari, Extensions. Safari on Mac is listed as in Apple review.

Try it yourself

This demo sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Get the mobile apps, the desktop app and the CLI from safeguard.sh/download, and read the CLI docs to set up your first session. If you also use another coding agent, see how to check what a coding agent changed before you merge.

Quick check

Sources

• Safeguard download page
• Safeguard CLI documentation
• Safeguard CLI interactive terminal
• Claude Code on mobile
• Claude Code overview
• Download Claude
• Codex on mobile
• Using Copilot cloud agent on GitHub Mobile
• GitHub Copilot plans
• OpenCode providers

Last reviewed: 21 October 2026.