Once Claude is connected to the Safeguard MCP server, you can ask it plain questions about your own projects: which ones carry critical findings, where a CVE shows up, what the fix version is, and what to tackle first. Claude answers from your Safeguard data. You then make the fix in the Safeguard CLI, approving each step.
You do not have to give up the assistant you already pay for to do any of this. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. And as this guide shows, you can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already have open.
What you will have at the end
By the end of this guide you will have:
- Claude connected to Safeguard, signed in with OAuth as yourself, and switched on for the conversations where you want it.
- A set of example prompts for the questions that come up every week: what is critical right now, what is wrong with one project, whether a CVE affects you, and what to fix first.
- A habit for checking Claude's answers: totals, scope, empty results and missing tools.
- A repeatable path from an answer in Claude to a tested fix in the Safeguard CLI, with every edit and command approved by you.
- A short list of mistakes to avoid and fixes for the problems people hit most often.
You need a Safeguard account at app.safeguard.sh with at least one project scanned, a Claude account (Free, Pro, Max, Team or Enterprise), and, for the fixing part, the Safeguard CLI on the machine that holds your code.
Step 1: Connect Claude to Safeguard once
If you have already connected Claude, skip to Step 2. If not, the full walkthrough is in connect Claude to the Safeguard MCP server. Here is the short version.
The directory route. The Safeguard download page says you can add Safeguard from Claude's connector directory on web, desktop or mobile, with OAuth sign in. Safeguard's own docs note that the directory link needs you to be signed in to claude.ai; opened without a session, it lands on the Claude home page.
The manual route, if the directory is not available on your plan or workspace. Safeguard's Claude guide gives these steps:
- Sign in to your Safeguard account at app.safeguard.sh.
- In Claude, open Customize, then Connectors, click + Add, then Add custom connector.
- Enter the name
Safeguard Securityand the URLhttps://mcp.safeguard.sh/mcp/anthropic, then click Continue. - When Claude detects OAuth, click Continue. Under Authentication choose "Sign in now" or "Sign in when needed", and under OAuth client choose "Register automatically". Click Add.
- Sign in to Safeguard, check the app name and the destination host, then click Authorize access.
On Team and Enterprise plans an Owner or Primary Owner adds the connector once under Organization settings, then Connectors. Members then open Customize, Connectors, select Safeguard Security and click Connect. Anthropic's help center says custom connectors work on Free, Pro, Max, Team and Enterprise, with Free limited to one custom connector.
Claude Desktop uses the connectors in your Claude account, so there is nothing extra to set up there. Safeguard's docs say not to add it to claude_desktop_config.json, because the server is hosted and there is no npm package or local bridge to install.
This short demo walks through the connection: OAuth sign in, then choosing which tools Claude can use.
Click through it at your own pace, or open it full screen.
If you work in Claude Code. Claude Code adds remote MCP servers from the shell, and Safeguard's docs list https://mcp.safeguard.sh/mcp as the endpoint for any MCP client. Safeguard's Claude guide does not cover Claude Code itself, so treat this as the general Claude Code pattern:
claude mcp add --transport http safeguard --scope user https://mcp.safeguard.sh/mcp
claude mcp list
Then run /mcp inside Claude Code and follow the browser sign in. The user scope makes the server available in all your projects; leave the flag off and it applies to the current project only. claude mcp list shows whether the server is connected or still needs authentication.
Step 2: Know what Claude can see before you ask
A good answer starts with knowing where it comes from. Four facts shape every reply Claude gives you about Safeguard.
It acts as you. Safeguard's MCP docs say the assistant acts as the signed in user and can only see and do what that user's Safeguard role allows. If you can only see two products in the web app, Claude sees the same two. Your tenant, organization and product scope come from your session automatically, so you never need to tell Claude which tenant you mean.
A new workspace starts read only. The docs say a new workspace starts with six read only tools for browsing products, projects, vulnerabilities and findings. In practice that set covers:
- listing your products, which is the right place to start when you have not said which part of the estate you mean;
- listing projects with their scan status and vulnerability counts, with an optional exact name filter;
- getting the full record for one project;
- listing vulnerabilities in scope, filtered by severity, ecosystem, CVSS score or exploit status;
- getting the full record for one CVE, including references;
- listing findings, meaning the actual occurrences of vulnerabilities, for one SBOM or project.
That default set does not modify anything, start scans or connect repositories. It is a safe way to let Claude look without touching.
More tools are an admin decision. Safeguard's server has a much larger catalogue, covering things like remediation plans, SBOM comparison, licence questions and policy. Safeguard's docs give prompts such as "Generate a remediation plan for my npm project" as examples. Each extra tool stays off until an administrator turns it on, per tool, under Feature Flags. If you ask for something and Claude has no tool for it, the right reading is "not enabled on this account", not "Safeguard cannot do this". Ask your Safeguard administrator.
You still approve tool calls in Claude. Anthropic's help center says that when Claude requests a tool you approve or deny it, and suggests using "Allow always" only for servers and tools you trust to run unsupervised. You can also switch individual tools off from the "Search and tools" menu, and switch the whole connector on or off per conversation from the + button, then Connectors.
Step 3: The everyday questions, with example prompts
These are the questions most teams end up asking every week. Each one has a prompt you can paste, what Claude typically does with it, and what to look at in the answer. Change the project and package names to match yours.
The morning check: what is critical right now?
Start broad, then narrow.
Using Safeguard, list my products, then show the critical and high
vulnerabilities across them. Group by project. For each one give the
CVE id, severity, affected package and version, and the fix version
if one is known. Tell me the total and whether you fetched all of it.
Safeguard's list tools return summary rows plus a total, so the last sentence of the prompt matters: when the total is larger than what came back, Claude should page through the rest rather than assume it has everything. If it says "showing 50 of 212", ask it to keep going or narrow the filter.
One project, in depth
When a project owner asks "how bad is my service?", go straight to the project.
Find the Safeguard project named payments-api. Show its scan status,
when it was last scanned, and its vulnerability counts by severity.
Then list the findings for it, critical and high first, with the fix
version for each.
The project filter matches exact names, so spelling counts. If Claude finds nothing, ask it to list the project names it sees.
Look at the scan status before you trust the counts. A project that has not been scanned since a big dependency change will show yesterday's picture, not today's.
Does this CVE affect us?
Look up CVE-YYYY-NNNNN in Safeguard. Summarise what it is, the
severity and CVSS score, and the references. Then tell me which of
my projects have a finding for it, with the package version each
one uses and the fixed version.
Replace the placeholder with the real id. Claude gets the CVE record, then looks at findings and vulnerabilities in your scope. Two outcomes need care:
- Results in some projects. Those are your work list. Ask Claude to sort them by how exposed each service is, using what you tell it about your estate.
- No results. Safeguard's connector treats an empty result as "nothing matched in the active scope". That is good news for the projects you can see, not proof that nothing anywhere is affected. Projects outside your role, or never scanned, are not in the answer. Say that in any status update you send.
Filter by ecosystem or exploit status
Show only npm vulnerabilities in my scope with a known exploit,
CVSS 7.0 or higher. Which packages appear most often, and which
single upgrade would clear the most findings?
The vulnerability list tool accepts severity, ecosystem, CVSS and exploit status filters, so this kind of question maps straight onto it. The last line asks Claude to reason over the rows it got back. That reasoning is Claude's, not Safeguard's, so treat it as a suggestion to check in the CLI rather than a verdict.
What should we fix first this sprint?
From the critical and high findings in payments-api and orders-api,
build a fix order for this sprint. Put direct dependencies with a
known fix version first, then transitive ones. For each item, say
which manifest file is likely involved and what the upgrade is.
Claude can sort and explain well, but it is working from finding records, not from your source tree. It does not see your lockfile from claude.ai. Use the plan as a draft, then let the Safeguard CLI confirm it against the actual files in Step 4.
Turn an answer into a ticket or a status note
Write a short ticket for the payments-api lodash finding: what it is,
the affected and fixed versions, the change needed, and how we will
verify it. Plain text, no more than 120 words.
Claude is good at turning precise records into something a teammate will read. Check the versions in the ticket against the finding before you paste it anywhere.
Step 4: Act on the answer in the Safeguard CLI
Claude in the browser tells you what is wrong. To change code, use the Safeguard CLI: an assistant next to your files that knows your Safeguard findings and asks before it touches anything. The longer case is in the Safeguard CLI as a security aware coding assistant.
Install and sign in
On macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard --version
On Windows, in PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
It is a single static binary with no Node, Python or JVM needed. Per-platform walkthroughs are in install the Safeguard CLI on macOS and the matching Windows and Linux guides.
Then open the interactive terminal in your project folder and sign in:
cd ~/code/payments-api
safeguard
Type /login and approve the session in your browser.
Carry the answer over
Paste the item Claude gave you, in plain words:
fix the lodash CVE in this repo
The assistant has tools for local files and for your Safeguard data, and it picks whichever the question needs. So it can read the same finding Claude showed you, then open package.json and the lockfile to see what is really installed. You can attach a specific file with @, for example the ticket text you saved or the manifest you care about.
This recorded session shows exactly that flow on a sample project called payments-api: install with the checksum verified, open the terminal, ask for the lodash fix, then approve each command.
Click through it at your own pace, or open it full screen.
In the recording, the assistant reads the finding, the files and the advisory, then asks before each command, and you press y or n. It edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, and prints a summary with a suggested commit message. It pushes nothing. The session ends with /permissions, /model and /scan ..
Pick the right approval mode
/permissions in the interactive CLI offers five modes:
| Mode | What runs without asking | Good for |
|---|---|---|
| Ask | Reads; edits and commands ask first | Your first few sessions, unfamiliar repos |
| Accept edits | Edits in this folder and read only commands; other commands ask | Dependency bumps you will review in the diff |
| Plan | Nothing changes; read and plan only | Checking Claude's fix order against real files |
| Auto (default) | Read only commands and what the policy allows; anything else asks | Day to day work |
| Strict | Pre-approved actions only | CI |
There is also a --yolo flag that approves everything. Keep it for throwaway sandboxes only.
Plan mode pairs well with this guide. Ask the CLI to check the sprint order Claude drafted against the real manifests, without changing a file, then switch modes when you are ready to fix.
Verify, then rescan
A fix is not done until a scan agrees. Inside the terminal:
/scan .
Or from the shell:
safeguard scan --dir .
safeguard scan builds an SBOM and matches it against vulnerability databases; results land as JSON files under ./output, including vuln.json and license.json. If you want a quick local check that sends nothing anywhere, safeguard findings sca --dir . runs one scanner on your machine and prints a normalized list; the help text says no project is registered and nothing is uploaded, even when you are signed in.
Once the platform has the new scan, go back to Claude and ask the same question you started with. The finding should be gone from the list.
Preview a batch fix
For several findings at once, the non-interactive safeguard fix command can preview first:
safeguard fix --dry-run --severity high
safeguard fix --dry-run --package lodash
--dry-run previews changes without applying them. Without the flag it backs up original files by default and writes a fix-report.json.
Review before you merge
Before you commit, ask for a second look at the working tree:
safeguard review
safeguard review --base main
The first reviews your uncommitted changes for correctness and security; the second diffs against main. For more on that habit, see review AI generated code before merge.
Keep the question running in CI
The same plain language question you asked Claude can run on every build:
safeguard exec "summarise the critical findings in this repository"
safeguard exec runs one assistant turn with no prompts. Its default mode is strict: anything not pre-approved by the policy file is denied. It refuses to run outside a git repository, because there would be no way to undo what it changes. The full setup is in Safeguard CLI in CI with safeguard exec.
Troubleshooting
Claude says it has no Safeguard tools. Check the connector is switched on for this conversation: +, then Connectors, then the Safeguard toggle. If it is on and still missing, open Customize, Connectors and reconnect.
The OAuth window loops or fails. Make sure you are signed in at app.safeguard.sh in the same browser, then try again. When the Safeguard page asks you to authorize, check the app name and host before you click.
Claude finds a project you know exists, but no findings. Ask it for the project's scan status. A project that has never finished a scan has nothing to report yet.
Counts in Claude differ from the web app. Usually one of three things: Claude only fetched the first page of results, you are looking at a different product in the web app, or a scan finished between the two looks. Ask Claude for the total and to page through the rest.
Claude Code shows the server as needing authentication. Run /mcp inside Claude Code and complete the browser sign in. claude mcp list should then show it connected.
The CLI cannot see the same projects. Run /whoami in the Safeguard terminal. If you are signed in to a different account or workspace than the one Claude uses, sign out with /logout and run /login again.
The CLI fix passes tests but the finding is still listed. The platform shows the last scan. Run /scan . or safeguard scan --dir . so the new state is uploaded, then ask again.
Common mistakes
Reading an empty answer as "we are safe". An empty result means nothing matched in your scope. Projects you cannot see, and projects never scanned, are outside it.
Trusting the first page. List tools return a page and a total. If the numbers do not add up, they were not all fetched.
Letting Claude guess at your files. From claude.ai, Claude sees finding records, not your lockfile. Confirm any "change this manifest" advice in the Safeguard CLI, where the assistant reads the real files.
Clicking "Allow always" on everything. Anthropic suggests reserving it for tools you trust to run unsupervised. That matters more once your admin has enabled tools that change things, and Anthropic notes that in Research, Claude can call connector tools without further approval, so switch off tools that write to external apps there.
Pasting tool output into other places without reading it. Anthropic's guidance warns about prompt injection in tool inputs and outputs. Read advisory text before you act on instructions inside it.
Running with --yolo on a real repo. It approves everything. Use Ask, Accept edits or Auto instead, and keep yolo for throwaway sandboxes.
FAQ
Can I use my existing Claude subscription with Safeguard?
Yes, in two ways. First, connect Claude to the Safeguard MCP server, as in this guide, and ask about your projects from Claude itself. Second, bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. See the CLI docs or /model for connecting a model.
Can Claude change anything in Safeguard?
Not with the default tools. A new workspace starts with six read only tools for browsing products, projects, vulnerabilities and findings. More tools, including ones that change things, stay off until an administrator turns them on one by one.
Does Claude see my source code through the MCP server?
The default tools return Safeguard records: products, projects, vulnerabilities and findings. When the Safeguard local runner runs platform scan jobs, your source stays on your machine and only SBOMs and findings are uploaded.
Why does Claude see fewer projects than my colleague?
Claude acts as you. It sees exactly what your Safeguard role allows, in the scope of your signed in session.
Does this work with ChatGPT too?
Yes. The download page says you can install Safeguard from the ChatGPT plugin directory or import the schema at https://mcp.safeguard.sh/openapi.json. The questions in this guide work the same way.
Which URL should I use for a custom connector?
Safeguard's Claude guide uses https://mcp.safeguard.sh/mcp/anthropic for Claude's custom connector. The general endpoint for other MCP clients, including the one listed on the download page, is https://mcp.safeguard.sh/mcp. Try the directory first.
What if my client cannot do OAuth?
Safeguard supports an MCP key for clients that only send a fixed header. Create a key of type MCP key under Settings, then Developer, and send it as a Bearer token. It is shown once, and API key access must be enabled for the workspace by an admin.
Can I approve the CLI's commands from somewhere other than my terminal?
Yes. A CLI session is live: it shows in the web app, the desktop app and the phone app, and from the desktop or phone app you can send work to a computer running the CLI, pick the folder, and approve each command and file edit there.
Try it yourself
Once you have an answer from Claude, you do not have to be at the terminal to act on it. This recorded desktop session shows the CLI session in the desktop app's conversation list, a request for work on your computer, the choice of computer and folder, and an Approve or Deny on each command and file edit, ending with the upgrade done and tests passing.
Click through it at your own pace, or open it full screen.
Get the CLI, desktop app and phone apps from safeguard.sh/download, and read the Safeguard CLI docs for every command.
Quick check
Claude returns no findings for a CVE. Can you tell the team nothing is affected?
No. An empty result means nothing matched in your active scope. Projects outside your role, or never scanned, are not covered by the answer.
Claude says it has no tool to generate a remediation plan. What does that mean?
That tool is not enabled on your account. Ask your Safeguard administrator, or run the question in the Safeguard CLI, which reads your files and your Safeguard data.
How do you confirm a fix suggested in Claude is really done?
Make the change in the Safeguard CLI with your approval, run your tests, then run a fresh scan with /scan . and ask Claude the same question again.
Sources
- Safeguard MCP server docs
- Connect Claude to Safeguard (Safeguard docs)
- Safeguard CLI overview
- Safeguard CLI interactive terminal
- Safeguard downloads
- Getting started with custom connectors using remote MCP (Claude Help Center)
- Connect Claude Code to tools via MCP (Claude Code docs)
Last reviewed: 21 October 2026.
