In Gemini CLI, add Safeguard with the command gemini mcp add --transport http safeguard https://mcp.safeguard.sh/mcp/gemini, or put the same address in a settings file under the field httpUrl. Do not use the field url, which Gemini CLI reserves for SSE. Safeguard has no SSE endpoint, so a url entry will not work.
Why the field name matters
MCP servers speak different transports. Gemini CLI uses url for Server Sent Events and httpUrl for Streamable HTTP. Safeguard's hosted server uses Streamable HTTP only. Pasting a snippet from another client with a url field is the usual cause of a server that never connects.
Option one: the command
gemini mcp add --transport http safeguard https://mcp.safeguard.sh/mcp/gemini
Option two: the settings file
Edit ~/.gemini/settings.json to apply to all projects, or .gemini/settings.json inside a project for that project only.
{
"mcpServers": {
"safeguard": {
"httpUrl": "https://mcp.safeguard.sh/mcp/gemini"
}
}
}
Other Gemini tooling that supports remote MCP servers uses the same URL.
Sign in
Gemini CLI discovers Safeguard's OAuth sign in when it first connects. You can start it by hand with the slash command /mcp auth safeguard. A browser page opens. Sign in to Safeguard, check the app name and the host the page says the authorization code will be sent to, then click Authorize access.
You need a Safeguard account first, created at app.safeguard.sh.
Keys, if OAuth is not an option
For a client that can only send a fixed header, Safeguard accepts an MCP key from Settings, then Developer. In Gemini CLI the header goes in the server's headers object. Keys act as the member who created them across the workspace, so keep the settings file private and out of source control.
After connecting
Try a plain prompt such as "List my security projects." A new workspace exposes six read-only tools by default, and administrators enable more per tool. If the list looks short, read why only six tools show up.
Do not install any package that claims to be the Safeguard MCP server. Safeguard publishes no npm package or local bridge for it.
The Safeguard CLI is a separate thing. Version 1.4.0 installs with curl or PowerShell installers, and npm is coming soon. See safeguard.sh/download for the current installers.
Quick check
Why does my server show as disconnected?
Check that the entry uses httpUrl and not url, and that you finished the OAuth sign in. You can restart it with the mcp auth command.
Is the gemini path special?
The /mcp/gemini address reaches Safeguard's server. The plain /mcp address is the general one that other clients use.
Sources
Last reviewed: 19 October 2026.
