Install the Safeguard CLI, run safeguard scan on a directory, and it builds the SBOM and matches it against the advisory database. It writes machine readable files to an output folder, including vulnerability, license, secret and scorecard results. The docs we reviewed show no separate SBOM command, because scan does that step.
How do you install it?
The CLI page at cli.safeguard.sh gives one line installers.
macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
Windows PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
To read the installer before running it, download it to a file and open it in a pager. The page also describes environment variables to pin a release and to choose the install folder. Pin the version in CI so a new release cannot change your builds unexpectedly.
How do you generate the SBOM?
Run a scan on the current directory, optionally with an output folder.
safeguard scan --dir .
safeguard scan --dir . --output out/
The scan command can also take a Git repository URL, a container image reference, or an existing SPDX or CycloneDX document as its input. Per the docs, scan needs the syft and grype tools on the path, or in a tools folder that you point to.
Exit codes matter in scripts. Scan returns 0 if the scan ran, whatever it found, 2 if results were written but the vulnerability scan did not run, and 1 if the command failed. A zero does not mean "clean."
Try it at /demos/sca-dependency-inventory.
What files do you get?
Each run writes per component artifacts that the docs describe as machine readable:
- The SBOM, shown in the docs diagram as sbom.json
- vuln.json for vulnerability matches
- license.json for license data
- secret.json for secrets findings
- scorecard.json for project health signals
- findings.json as the combined view
The docs say the vulnerability file is compatible with grype output, with matches under the data section.
How do you read the SBOM?
Open the SBOM and check the NTIA baseline fields for a sample of components: supplier, component name, version, other unique identifiers, dependency relationship, author of SBOM data, and timestamp. Gaps usually appear in supplier and identifiers.
Then count vulnerability matches with jq, using the path the docs use in their CI example. Adjust the folder to your output name.
jq '.data.matches | length' out/*/vuln.json
To check the document itself against the specifications, run the validate command on the file.
safeguard validate out/sbom.json
The file path above is an example. Use the path your run wrote.
What else can you do with it?
- The report command builds a report from an existing scan result.
- The update command refreshes the local vulnerability databases. It does not update the CLI binary.
- The fix command has a dry run that previews changes and an option to open a pull request.
The docs do not document every flag, so run the help command for the full list.
What to do
- Install the CLI and pin the version.
- Scan a repository and write results to an output folder.
- Inspect the SBOM for the NTIA baseline fields.
- Count and review vulnerability matches.
- Validate the SBOM format before you share it.
- Store the files with the release as evidence.
Quick check
Is the CLI scan result clean if the exit code is zero?
No. Per the docs, scan returns 0 whenever the scan ran, regardless of findings. Read the result files.
Does the CLI send my source code to Safeguard?
Not in local runner mode. The runner scans on your machine and uploads only the SBOM and findings, per the docs.
Sources
- Safeguard CLI
- Safeguard docs: Local Runner
- Safeguard docs: CI/CD Integration
- NTIA: The Minimum Elements for a Software Bill of Materials (PDF)
Last reviewed: 18 October 2026.
