Right after connecting, the prompts that work are the ones backed by the six default read-only tools: list products, list projects, show a project, find vulnerabilities, look up a CVE, and list findings. Prompts about scanning, SBOM comparison or remediation plans need an administrator to enable more tools first.
What works on day one
Safeguard's guides suggest a starter list. Here is how each one maps to the default set.
| Prompt | Needs |
|---|---|
| List my security projects | The default set |
| Find critical vulnerabilities | The default set |
| Show me all SBOMs | An SBOM listing tool, which is not in the default six |
| Generate a remediation plan for my npm project | A remediation tool, enabled by an administrator |
| Which packages violate my license policy? | License tools, enabled by an administrator |
The first two work on a fresh workspace. The last three are reasonable goals, but expect a "not enabled" message until the matching tools are on. That message is normal. See the fix for the not enabled error.
Prompts that suit the default tools
- "List my products, then list the projects under the first one."
- "Show vulnerabilities with high or critical severity in my npm ecosystem projects."
- "Get the details for this CVE and tell me what the fix version is." Paste the CVE id.
- "List the findings for the project called checkout and group them by severity."
- "Which of my projects has the most vulnerabilities?"
These stay within what the read-only tools return. The assistant combines their output into an answer.
How to phrase a good question
Name the scope. The tools work inside your tenant, organization and product context. If you have several, say which one you mean.
Ask for fields. Safeguard's own guidance for presenting a vulnerability is the CVE id, severity, affected package and version, and fix version when known. Ask for those.
Page through results. Lists return summary rows and a total. If the total is larger than what came back, ask the assistant to fetch the next page, so it does not treat a partial list as everything.
Treat empty as empty. An empty result means nothing matched in the active scope. It does not prove nothing exists elsewhere.
Checking the assistant's work
An assistant summarizes tool output. It can still make mistakes in the summary. For anything you will act on, such as a severity or a fix version, open the finding in Safeguard and confirm. Our post on reviewing a reachability finding on your phone shows one way to check a result quickly.
What the assistant acts as
It acts as you. It sees what your Safeguard role allows, within the tools your workspace has enabled. It cannot see another tenant.
Click through it at your own pace, or open it full screen.
Quick check
My prompt returned no vulnerabilities. Is the project clean?
Not necessarily. The result only says nothing matched in the active scope. Check the scope, the filters and whether the project was scanned.
Can the assistant start a scan?
Only if an administrator has enabled a scanning tool. Scanning tools are off by default.
Sources
- Safeguard docs: MCP integrations overview, example prompts
- Safeguard docs: Tool availability and gating
Last reviewed: 19 October 2026.
