Claude can read your Safeguard findings through the MCP server and help a reviewer decide, but it does not enforce the gate. According to Safeguard's docs, enforcement is done by the platform's policy gates on a connected repository. Use Claude for the questions, and policy gates for the block.
What does the MCP server give Claude?
The server at mcp.safeguard.sh lets an assistant query vulnerabilities, SBOMs, packages, licenses, findings and compliance data in plain language, generate remediation plans, and compare SBOMs. Its docs say it can enforce policy gates and manage source control integrations, but they do not describe pull request handling directly, so this post does not claim a pull request specific tool.
Tool visibility is set per tenant. A new workspace starts with six read-only tools for browsing products, projects, vulnerabilities and findings. An administrator turns on others under Feature Flags. If Claude cannot see a tool, check there first.
How do you connect Claude?
Per the setup page:
- In Claude, open Customize, then Connectors, click Add, then Add custom connector. On a Team or Enterprise plan, an Owner adds it under Organization settings first, and members then click Connect.
- Name it Safeguard, paste the connector URL below, and click Continue.
- Choose Sign in now for authentication and Register automatically for the OAuth client, then click Add.
- Sign in to Safeguard, check the app name and host, and click Authorize access.
https://mcp.safeguard.sh/mcp/anthropic
Authentication is OAuth 2.0 with PKCE, so no API key is pasted anywhere. Tenant admins can also switch off any client type, including Claude, if policy requires it.
What does a gated pull request flow look like?
Split the job into two layers.
Layer 1: the gate. Connect the repository to Safeguard as an integration so the platform scans and evaluates your policies and gates. Per the CI/CD docs, nothing has to run in your pipeline for this. The CLI itself reports findings and does not fail builds on a threshold, so do not rely on it as the blocker.
Layer 2: the reviewer's questions. Before approving, ask Claude things like:
- Show me critical vulnerabilities in this project.
- Which packages violate my license policy?
- Generate a remediation plan for my npm project.
The first two are close to the example prompts on the docs page. The third is also listed there.
Safeguard also has PR Guard, an AI code review for pull requests that returns a scored summary and comments on file and line. The docs say it works with GitHub pull requests only, and they do not describe it as a merge blocker.
Try it at /demos/gate-pull-request.
What are the limits?
- Claude's answer is advice. A human merges, and the platform gate blocks.
- Findings reflect the last completed scan, so confirm the scan covers the branch you review.
- Read access is not write access. Keep the connector's enabled tools to what the review needs.
What to do
- Connect the repository to Safeguard and set a policy gate.
- Add the MCP connector in Claude with the URL above.
- Ask an admin to enable the read tools you need.
- Make "ask Claude about findings" a step in your review checklist.
- Keep merge protection in the platform and source host, not in chat.
Quick check
Does Claude block the merge?
No. Claude reads data and answers questions. The platform's policy gates do the enforcing.
Do I need an API key for the connector?
No. The connector signs in with your Safeguard account over OAuth 2.0 with PKCE.
Sources
- Safeguard MCP server setup
- Safeguard docs: MCP server
- Safeguard docs: CI/CD Integration
- Safeguard docs: PR Guard
Last reviewed: 18 October 2026.
