Developers do not want a second job triaging a dashboard. The best place for a security signal is the editor, the terminal and the assistant you already have open. Safeguard has a surface in each.
This is what a day looks like, using only documented behavior.
What it is
The Developer role in Safeguard is scoped to what you need: view findings on assigned assets, run auto-fix against them, and request exceptions. You do not edit policy.
Your surfaces are the IDE extension, the CLI, the Chrome extensions, and MCP, plus the web app when you need the full finding.
How to use it
In the editor
Safeguard ships an extension for VS Code, and the same package works in Cursor through Open VSX. JetBrains IDEs, including IntelliJ, PyCharm, WebStorm, GoLand and Rider, have a separate plugin. Install from the command line if you like:
code --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension
Sign in with Safeguard: Login from the command palette. It uses an OAuth device flow, so you approve a code in the browser. Public package scanning works without logging in, and some backend features need a login.
The extension scans dependency manifests such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml and Gemfile. Auto scan and scan on save are on by default. Vulnerable dependencies are flagged inline, with a hover summary and a suggested fix.
In VS Code and Cursor there is also an inline Package Firewall check. As you add a dependency to a manifest, it flags typosquats such as expres for express, scoped names that shadow a popular package, and known malicious packages, before you run install.
In the terminal
Install the CLI, run safeguard, and type /login. Then /scan . scans the folder. You can also ask in plain language, for example "fix the lodash CVE in this repo". Actions that change files ask first, and /permissions picks the mode: ask, auto or yolo. Auto is the default, so read before you switch to yolo.
When you scan from the signed in terminal, only the SBOM and findings are uploaded. Your source stays on your machine.
In your assistant
Connect Cursor, Claude or ChatGPT to mcp.safeguard.sh with OAuth. For Cursor, the docs show this entry in mcp.json:
{
"mcpServers": {
"safeguard": {
"url": "https://mcp.safeguard.sh/mcp"
}
}
}
Then ask "Which packages violate my license policy?" or "Generate a remediation plan for my npm project". Do not install any npm package claiming to be the Safeguard MCP server. The docs say there is none.
Before you add a package
Search the package on gold.safeguard.sh, or use the Gold Open Source Chrome extension. A package page shows known vulnerabilities and a recommended safe version with a copy ready upgrade command. Each CVE page has an Am I affected check for the version you run. For a quick check of a whole manifest, the free scan at gold.safeguard.sh/scan runs in the browser, needs no login and handles up to 100 dependencies.
Try it yourself
Open a project you work on. Install the extension, open the manifest, and look at the first flagged dependency. Then add a misspelled package name to a scratch manifest and see what the inline check says. Remove it afterwards.
Click through it at your own pace, or open it full screen.
Quick check
Does the inline Package Firewall check need you to run npm install first?
No. It evaluates the package name as you edit the manifest, before install.
What leaves your machine when you scan from the signed in CLI terminal?
The SBOM and findings. Source code stays local.
Is there an npm package for the Safeguard MCP server?
No. The server is hosted at mcp.safeguard.sh.
