Connect Claude to the Safeguard MCP server, then ask it about your critical vulnerabilities and which are reachable. Safeguard's docs describe reachability as a classification per finding and describe the MCP server's capability areas, but they do not document a per finding call path view over MCP. Check results against the web app.
How do you connect Claude?
From Safeguard's Claude docs, the easiest route is the connector directory: open Safeguard's entry, select Safeguard, connect, sign in, check the app name and destination host, and click Authorize access.
The manual route: in Claude go to Customize, then Connectors, click Add, then Add custom connector. Use the name Safeguard Security and the URL https://mcp.safeguard.sh/mcp/anthropic. Click Continue, choose Register automatically under OAuth client, click Add, and then sign in and authorize when redirected.
On Team or Enterprise plans, an Owner or Primary Owner adds the connector under Organization settings, then Connectors, and members click Connect. Claude Desktop uses the connector from your Claude account. OAuth 2.0 is the default; for clients that need a fixed header, an MCP key is created under Settings, then Developer. Safeguard's MCP tool calls are unlimited on every plan, though Claude's own usage limits still apply.
A new workspace starts with a small read only set of tools, and an administrator enables the rest per tool, so if something is missing, ask your admin.
What can you ask?
The docs list example prompts such as: list my security projects, find critical vulnerabilities, show me all SBOMs, generate a remediation plan for my npm project, and which packages violate my license policy. The docs describe capability areas including vulnerabilities, SBOMs, packages, licenses, findings, compliance, remediation plans, SBOM comparison and policy gates. They do not list individual tool names or say which tool covers reachability, so we cannot promise exact wording or output.
A sensible sequence:
- "Find critical vulnerabilities in my projects."
- "Which of those are reachable?"
- "Generate a remediation plan for the reachable ones."
What does reachable mean in Safeguard?
Per the reachability docs, Safeguard uses static analysis, which builds a call graph from source, lockfile and bytecode; dynamic analysis, where a runtime collector records which modules and functions load and run in production; and configuration analysis, which reads framework configuration to see whether code is wired in at all.
Each CVE is classified as reachable, conditionally reachable, unreachable or unknown. Conditionally reachable means the path needs a disabled feature flag, route or configuration. Unknown comes from dynamic dispatch, reflection or native code and is treated as potentially reachable. So never read "not reported as reachable" as "safe".
In the web app, the Vulnerabilities tab has Priority and Reachability columns, and filters on reachability, known exploited status and EPSS score are described. The docs say the Griffin assistant can explain why a finding was de-prioritized, which helps with exception reviews.
What does the documentation not say?
The reachability page does not describe a per finding "why reachable" explanation or a call path viewer, and says to check the Vulnerabilities tab or contact support for call path details. So treat Claude's answer as a summary of what the platform returns. For anything that drives a decision to defer a fix, open the finding in app.safeguard.sh and read it yourself.
What to do
- Connect Claude with the connector directory or the manual steps.
- Ask for critical vulnerabilities, then ask which are reachable.
- Check the same findings in the Vulnerabilities tab and compare the Reachability column.
- Treat unknown as potentially reachable.
- Ask for a remediation plan only for items you have confirmed.
- Ask your admin to enable the tools you need, and review which are on.
Quick check
Does Claude show me the call path?
The docs do not describe a call path view over MCP. Use the web app for details and check what your tools return.
Is an unreachable finding safe to ignore?
Not forever. Reachability can change with code or configuration, so recheck after changes.
Sources
Last reviewed: 18 October 2026.
