Gate a pull request from Cursor with the Safeguard extension

The Safeguard extension in Cursor catches problems before you open a pull request, and the platform gates the merge. Install it from Open VSX, sign in, scan the project, and run its pull request review command. The block itself comes from Safeguard policy gates evaluated on scans, and from a CI step that fails when a gate fails.

It helps to be clear about who does what. The editor is your early warning. The gate is the enforcement. This guide covers both, using Safeguard's docs.

How do you install it in Cursor?

Cursor installs through the Open VSX registry rather than the VS Code Marketplace. The docs give this command:

cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

You can also open Extensions in Cursor, search for Safeguard and click Install. The extension activates when your workspace contains a manifest such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or Gemfile.

To sign in, run Safeguard: Login from the Command Palette. A browser tab opens at app.safeguard.sh/activate with a verification code, you approve the device, and your tenant ID fills in automatically. The code expires after about ten minutes, so rerun the command if it times out. Public package scanning works without logging in, but some backend features need it.

What does it check before you push?

With auto scan and scan on save on by default, the extension flags vulnerable dependencies inline as you edit. You can also run Safeguard: Scan Project for Vulnerabilities, or scan just the current manifest.

Three checks are worth using before a pull request:

1. Package Firewall inline checks. As you add a dependency, the extension flags typosquats, namespace confusion and known-malicious names. By default an offline heuristic runs. A setting lets it ask Safeguard's backend instead, which needs login.
2. Staged commit secrets check. The command Safeguard: Check Staged Commit for Secrets looks at what you are about to commit.
3. Fixes. Hover a flagged dependency and use the lightbulb to bump the version, or run the Fix All Vulnerabilities command. Choose a remediation strategy: Safe (minor updates only), Balanced (minor and patch, the default) or Aggressive (latest).

The extension also lists a Safeguard: Review Pull Request command. The docs name it but do not describe its behavior, so try it on a branch and read what it returns before relying on it.

Open the pull request gate demo in its own page.

Where does the actual gate live?

In the platform. Safeguard separates policies, which are rules that evaluate your SBOMs and generate findings, from gates, which are checkpoints that enforce policies. A policy has an action: Block fails the gate, Warn passes it with a warning, and Notify passes it and sends a message.

To make a CI job fail on a gate, the docs describe a command that waits for the scan and for the gate to be evaluated:

safeguard ci scan --wait --fail-on-gate GATE_NAME

It exits non-zero when the gate fails, and also when the gate errored or was not evaluated, so a missing result is never read as a pass. The docs say policy outcomes must be turned on for your workspace. The plain scan command, by contrast, exits 0 whatever it finds, so do not use it as a gate.

For code review, Safeguard also has PR Guard, which reviews a pull request's diff and can post comments back to the pull request. The docs say it is wired to GitHub pull requests today.

What are the limits?

The extension works on manifests and a few commands, not as a merge blocker. A developer can skip it, which is why the CI gate matters. JetBrains has a separate plugin, and the docs say some features, such as inline Package Firewall checks, are documented only for VS Code and Cursor. PR Guard supports GitHub only for now.

What to do

1. Install the extension in Cursor and run Safeguard: Login.
2. Run a full project scan and fix what the lightbulb offers, starting with the Safe strategy.
3. Turn on backend Package Firewall verdicts if your team logs in.
4. Create a policy and a gate in Safeguard and start with the Warn action.
5. Add the CI command with the gate name, and move clear violations to Block after a trial period.
6. Try PR Guard on one GitHub pull request.

Quick check

Sources

• Safeguard docs, IDE support
• Safeguard docs, Policies and gates
• Safeguard docs, Policy outcomes and actions
• Safeguard docs, PR Guard
• Safeguard docs, CI/CD integration

Last reviewed: 18 October 2026.