To connect ChatGPT to Safeguard, install Safeguard from the ChatGPT plugin directory, or add https://mcp.safeguard.sh/mcp as a custom MCP server with OAuth. ChatGPT opens Safeguard's sign-in page, you check the consent page and click Authorize access. Your ChatGPT workspace policy may need to allow it. You choose the tools, and can revoke access any time.
This guide covers each route, including Codex, then the consent page, tool access, revoking, and what to ask ChatGPT once it is connected.
Safeguard is also something you can switch to without losing what you already pay for. Keep using ChatGPT through the Safeguard MCP server, and bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply.
Ways to connect ChatGPT, and what each one needs
Safeguard hosts its MCP server at https://mcp.safeguard.sh/mcp, so there is nothing to install. Safeguard's docs say it publishes no npm package or local bridge for the server, and that any package claiming to be the Safeguard MCP server should be treated as untrusted.
One vocabulary note. OpenAI's help center describes a plugin as a bundle that can include skills and connected apps, where an app is what connects ChatGPT to a service. Safeguard's download page uses the same word: install Safeguard from the ChatGPT plugin directory.
| Route | Where you do it | What you enter | Sign-in | Who can set it up |
|---|---|---|---|---|
| Plugin directory | Plugins in ChatGPT | Nothing, select Safeguard | OAuth | You, if your workspace allows the plugin |
| Custom MCP server | Plugins, then Add custom MCP server | https://mcp.safeguard.sh/mcp | OAuth, ChatGPT registers itself | Depends on plan and workspace role |
| Custom GPT Action | Custom GPT, Configure, Actions | https://mcp.safeguard.sh/openapi.json | Safeguard MCP key, Bearer | You, if your admin allows MCP keys |
| Codex | ~/.codex/config.toml or the app's MCP settings | https://mcp.safeguard.sh/mcp | OAuth through codex mcp login | You |
Connect ChatGPT to Safeguard, step by step
Before you start, create your Safeguard account at app.safeguard.sh or sign in to it. ChatGPT acts as you inside Safeguard, so use the account that has the access you intend it to have.
Route 1: the ChatGPT plugin directory
Safeguard's download page says to install Safeguard from the ChatGPT plugin directory. OpenAI's plugins article describes how that directory works:
- Open Plugins in the ChatGPT sidebar. OpenAI says this works on ChatGPT web, desktop and mobile, and the directory shows plugins available to your plan and workspace.
- Find Safeguard, select it, and review its description, apps and setup requirements.
- Select Install plugin if it is shown. Installing may start the app's setup or authorization flow.
- If prompted, select Connect.
- ChatGPT sends you to Safeguard's sign-in page. Sign in, check the consent page, and click Authorize access.
Safeguard has not published a directory search term, so search for Safeguard by name. If you cannot find it, OpenAI's article suggests checking the plugin's plan, region and workspace requirements. In a managed workspace, a restricted plugin can still be visible with Disabled by admin, and your administrator controls whether it is available.
Route 2: a custom MCP server
This is the route from Safeguard's ChatGPT guide, and it matches OpenAI's own article on connecting custom MCP servers.
- In ChatGPT on the web, open Plugins, select the plus button, then Add custom MCP server.
- Enter a name, for example
Safeguard Security, and optionally a description. - Under Connection, enter
https://mcp.safeguard.sh/mcp. - Set authentication to OAuth. ChatGPT registers itself with Safeguard, so there is no client ID or key to copy.
- Review the risk warning and select I understand and want to continue.
- Select Create as a plugin, then review the discovered tools.
- When ChatGPT sends you to Safeguard, sign in, check the app name and host, and click Authorize access.
OpenAI's article says that in the current Plugins experience you do not need to turn on Developer Mode first; you acknowledge the risk warning for each server instead.
Who is allowed to add a custom MCP server
This is where workspace policy comes in. OpenAI's help center, fetched today, says:
- Custom MCP server connections and full MCP support are available for ChatGPT Business and Enterprise/Edu customers on ChatGPT web.
- Pro users can connect custom MCP servers with read and fetch permissions.
- On Business, only admins and owners can create and publish plugins for custom MCP servers.
- On Enterprise and Edu, admins and owners can create and test them, and admins can use role-based access control to let selected members do the same. Only admins and owners publish to the workspace.
- The permission to look for is Create plugins with MCPs, under Workspace settings › Permissions & roles. OpenAI lists it as off by default for Enterprise.
- Custom MCP servers cannot be connected on mobile; it is web only.
Safeguard's guide says the same: if you do not see the option, ask your ChatGPT workspace administrator.
Publishing Safeguard for your workspace
If you are a ChatGPT admin, you can test the connection privately and then publish it so members can use it. OpenAI's article gives the retained flow: in the Admin console, select the workspace, open Plugins, select Manage Legacy Apps, then Drafts and Publish, and review the safety warnings, especially for write actions. On Enterprise and Edu, Configure Actions in the publish dialog lets you deselect actions, and Configure Access limits which groups get it.
After approval, ChatGPT uses a frozen snapshot of the server's tools; new actions stay disabled until an admin refreshes and reviews them.
Route 3: a Custom GPT Action with an MCP key
Safeguard's ChatGPT guide offers this as an alternative with a smaller set of tools:
- Create a Custom GPT and open Configure, then Actions, then Create new action.
- Choose Import from URL and enter
https://mcp.safeguard.sh/openapi.json. - Under Authentication, select API Key with Auth Type Bearer, and paste a Safeguard MCP key.
- Save the GPT.
Create the key in Safeguard under Settings › Developer, with the key type MCP key. Safeguard's guide warns that the action uses that one key for everyone who can use the GPT, and the key acts as you, so keep the GPT private.
Codex
Safeguard's setup guides do not list Codex yet, so this follows Codex's own MCP docs. Codex supports Streamable HTTP servers with OAuth, and its CLI, IDE extension and the ChatGPT desktop app share one MCP configuration. ChatGPT on the web does not read local Codex config; it uses plugins instead.
Add a table to ~/.codex/config.toml:
[mcp_servers.safeguard]
url = "https://mcp.safeguard.sh/mcp"
default_tools_approval_mode = "writes"
Then sign in:
codex mcp login safeguard
codex mcp list
Codex's docs describe writes as prompting only for tools that are not marked read-only, and enabled_tools and disabled_tools as allow and deny lists. In the desktop app or IDE extension, add the server under MCP servers in settings and select Authenticate when asked.
This demo connects ChatGPT to the Safeguard MCP server with OAuth and lets you choose which tools ChatGPT can use.
Click through it at your own pace, or open it full screen.
The consent page, choosing tools, and revoking access
What the consent page shows
Safeguard's consent page names the assistant, ChatGPT, and the host that receives the authorization code, chatgpt.com. Safeguard's demo explains that both come from the MCP server's check of the signed request, not from the link, and that the code shown matches the one ChatGPT shows. If both are right and you started the connection from ChatGPT, click Authorize access. If not, stop.
How tool access is narrowed
ChatGPT gets your own Safeguard access and never more. Each layer below can only narrow the one before.
| Layer | Who controls it | What it does |
|---|---|---|
| Your Safeguard role | Safeguard admin | ChatGPT sees and does only what your role allows |
| MCP access | Safeguard admin | Read and write tools; with write tools off, ChatGPT can read but not change anything |
| Tool feature flags | Safeguard admin, under Feature Flags | Turns each MCP tool on or off for the whole tenant |
| Plugin tool settings | You, on the plugin's details page | Turn individual tools on or off |
| Workspace action controls | ChatGPT Enterprise or Edu admin | Allow or deselect actions before and after publishing |
A new Safeguard workspace starts with six read-only tools: list products, list projects, get a project, list vulnerabilities, get one vulnerability, and list findings. Everything else is off until an administrator turns it on under Feature Flags. Gating is per tenant, and if tool resolution fails the server falls back to that small default set rather than anything wider. Safeguard's demo shows the effect: with write tools off, ChatGPT can list projects, find vulnerabilities and read SBOMs, but cannot start scans or open fix pull requests until an admin allows write tools.
On the ChatGPT side, OpenAI's developer docs say each app has a details page where you can turn individual tools on or off. Write actions require confirmation by default, and a tool counts as a write unless it carries the read-only hint. You can remember an approval for the rest of a conversation, but only do that for tools you trust; a new conversation asks again.
Revoking access
- In Safeguard: open Settings › MCP connections. It lists ChatGPT as an AI connection, with when it was last used and when the grant expires. Revoke it there at any time.
- In ChatGPT: open Settings › Plugins, select Safeguard, then use the account's more options menu or the Connection section and select Disconnect. OpenAI notes that disconnecting does not delete existing conversations.
- For a workspace: admins can disable the plugin under Workspace settings › Plugins.
- For MCP keys: revoke the key under Settings › Developer in Safeguard. Safeguard's docs say it stops working within a minute.
What to ask ChatGPT once it is connected
OpenAI's article says ChatGPT uses installed plugins automatically when they fit your request, and you can also pick one with an @ mention. For a custom MCP server, app selection applies to the message where you use it, so @ mention Safeguard again when a follow-up needs fresh data.
Type @, pick the Safeguard plugin, and start with questions the default tools can answer. Check the first few against the Safeguard app:
List my products and the projects in each, with scan status.
Show critical vulnerabilities with a known exploit across my projects.
List findings for the payments-api project, grouped by package.
Get the full record for the first CVE in that list, including remediation.
Which of my projects have critical vulnerabilities with a fix available?
Once your admin enables more tools, Safeguard's docs suggest prompts such as "Show me all SBOMs", "Generate a remediation plan for my npm project" and "Which packages violate my license policy?" Safeguard's demo also suggests asking ChatGPT to export an SBOM.
Two worked patterns:
Triage a release. Ask for critical and high vulnerabilities in one project, then for the package, installed version and fix version of each. Follow with "which of these are direct dependencies" so you know what your own manifest controls.
Turn findings into work. With the details in the chat, ask ChatGPT to draft one short ticket per fix. If your workspace also connects a tracker, OpenAI's article says you can invoke more than one app in a prompt, so you could create the ticket there too, with ChatGPT asking you to confirm the write.
Two habits keep answers honest. When a list's total is larger than what came back, ask ChatGPT to page through the rest. And an empty result means nothing matched in your current scope, not that no vulnerability exists anywhere. If ChatGPT reports a tool is not enabled, Safeguard's message names the tool; ask your Safeguard admin to enable it.
For a wider view of how ChatGPT and Claude compare as coding tools, see our post on Claude vs ChatGPT for coding.
Do the work properly with the Safeguard CLI
The MCP server brings Safeguard into ChatGPT. The Safeguard CLI brings the work onto your own machine: ask questions in ChatGPT, and write, fix and scan code in the terminal.
The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can write code and fix what it finds.
Install
On macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
On Windows, in PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
It is a single static binary with no Node, Python or JVM needed, for macOS, Linux and Windows on x86_64 or arm64 (Windows is x86_64 only). The download page lists version 1.4.0.
First session
Run safeguard with no arguments to open the interactive terminal. Type /login to sign in through the browser, then /scan . to scan the current folder. Then ask in plain language:
how many critical vulns do we have
fix the lodash CVE in this repo
@ attaches a file from the folder you started in, and /resume picks up the last session in that folder.
Writing and fixing code
The assistant has tools for your local files and for your Safeguard data, and picks whichever the question needs. It can write files, edit code and run commands, with your approval, so it also works as a general terminal assistant. The docs list "what's the latest file in ~/Downloads" next to the security questions. Our post on the Safeguard CLI as a security-aware coding assistant goes deeper.
This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding.
Click through it at your own pace, or open it full screen.
Using your ChatGPT or Codex plan
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the AI model; see the CLI docs for connecting a model.
Approvals
Tools that change things ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. Start with Ask on a repository you care about.
Scan what changed, and run it in CI
safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:latest
safeguard scan --sbom ./sbom.cdx.json
safeguard validate ./sbom.cdx.json
Each scan builds an SBOM and matches it against vulnerability databases, writing JSON files such as vuln.json and license.json under ./output. Scan before and after a Codex or ChatGPT session, and the difference is what that session did to your risk; our guide to checking coding agent changes shows how. safeguard validate checks CycloneDX, SPDX and VEX documents.
For CI, safeguard exec "summarise the critical findings in this repository" runs one non-interactive assistant turn. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. Policies and gates are evaluated in the platform, which also offers reachability analysis and autonomous remediation with fix PRs, off by default.
One platform on every surface
Start in the terminal, keep asking in ChatGPT, continue in the desktop app for Windows, macOS and Linux, and check findings on the iOS and Android apps. There are IDE extensions, a Chrome extension, and options with nothing to install: the web interface, the Cloud CLI, and a cloud sandbox tenant on a seeded demo repo, free for seven days with no card.
Download Safeguard, connect ChatGPT, and run /scan . on the repository you work in today.
Common mistakes when connecting ChatGPT
Looking for the option on your phone. OpenAI says custom MCP servers connect on the web only. Set it up on chatgpt.com, then use it where your plugin is supported.
Assuming your plan allows it. On Business, only admins and owners create custom MCP plugins, and on Enterprise the Create plugins with MCPs permission is off by default. Ask your admin before you troubleshoot anything else.
Installing a package that claims to be the Safeguard MCP server. Safeguard publishes none. The server is hosted.
Clicking Authorize access without reading the page. Check that it names ChatGPT and chatgpt.com.
Expecting write actions on a new workspace. The default Safeguard tools are read only. Starting scans or opening fix pull requests needs an admin to allow write tools.
Sharing a Custom GPT that holds your MCP key. Everyone who can use the GPT uses your key and your access. Keep it private, or use the OAuth route.
Expecting new Safeguard tools to appear by themselves. In a published workspace app, new actions stay off until a ChatGPT admin refreshes and reviews them.
FAQ
Is Safeguard in the ChatGPT plugin directory?
Yes. Safeguard's download page says to install Safeguard from the ChatGPT plugin directory. Whether you can install it depends on your plan, workspace and role, as with any plugin.
Which URL do I use for a custom MCP server?
https://mcp.safeguard.sh/mcp, with OAuth. The OpenAPI schema at https://mcp.safeguard.sh/openapi.json is only for the Custom GPT Action route.
Does my ChatGPT plan support custom MCP servers?
OpenAI's help center says full MCP support for custom servers is on Business and Enterprise/Edu on the web, and Pro users can connect custom MCP servers with read and fetch permissions. In a workspace, an admin may need to grant Create plugins with MCPs.
Do I need an API key?
Not for the directory or the custom MCP server; both use OAuth. You need a Safeguard MCP key only for the Custom GPT Action route, and only if your admin has turned on API key access to MCP.
Can ChatGPT change anything in my Safeguard account?
Only if your Safeguard admin allows it. A new workspace starts with six read-only tools, and ChatGPT asks you to confirm write actions by default.
How do I revoke ChatGPT's access?
In Safeguard, open Settings › MCP connections and revoke the ChatGPT connection. In ChatGPT, open Settings › Plugins, select Safeguard and choose Disconnect.
Can I switch to Safeguard and keep my ChatGPT plan?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also keep using ChatGPT with the Safeguard MCP server, as this guide shows. Our post on OpenAI Codex alternatives covers the wider choice.
Try it yourself
This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Quick check
What should Safeguard's consent page show when you connect from ChatGPT?
It should name the assistant, ChatGPT, and the host that receives the authorization code, chatgpt.com. If either is wrong, do not click Authorize access.
Which ChatGPT workspace permission lets a member create a plugin from a custom MCP server?
Create plugins with MCPs, under Workspace settings › Permissions & roles. OpenAI lists it as off by default for Enterprise.
Where do you revoke ChatGPT's access from the Safeguard side?
Settings › MCP connections, which lists ChatGPT with when it was last used and when the grant expires.
Sources
- Connecting custom MCP servers in ChatGPT, OpenAI Help Center
- Plugins in ChatGPT, OpenAI Help Center
- Connecting and managing app accounts in ChatGPT, OpenAI Help Center
- Custom MCP server guide, OpenAI developer docs
- Connect and test your plugin in ChatGPT, OpenAI developer docs
- MCP in Codex, OpenAI docs
- Safeguard MCP: ChatGPT guide
- Safeguard MCP: connector setup
- Safeguard MCP overview
- Safeguard MCP: tool availability and gating
- Use Safeguard from ChatGPT, interactive demo
- Safeguard download page
- Safeguard CLI docs
- Safeguard CLI interactive terminal docs
Last reviewed: 21 October 2026.
