To install the Safeguard CLI, run the one line installer for your system, open a terminal, type safeguard, sign in with the login command, then scan a folder. The CLI is a single program that scans on your own machine and sends only the results, never your source code, to the platform.
TL;DR
- The CLI (command line interface) is a program you run in a terminal window.
- Install it with a curl command on macOS and Linux, or a PowerShell command on Windows.
- Run it once with no arguments to finish setup and sign in.
- Scan a folder, a Git repository, a container image, or an SBOM you already have.
- It reports findings. It does not fail your build by itself. Gates in the platform do that.
Definition: The Safeguard CLI is a small program you run from a terminal. It scans code and packages on your own computer, and it includes an assistant that can explain findings and help fix them.
What is the Safeguard CLI, in plain words?
A terminal is a window where you type commands instead of clicking buttons. A CLI is a tool built for that window. If you have ever typed git commit or npm install, you have used one.
The Safeguard CLI is described on the download page as one static binary. A binary is a ready to run program. Static means it brings what it needs with it. The documentation says there is no Node, Python or Java to install first. It needs about 40 MB of disk for the program, plus the scanners it downloads the first time you use it.
Why would you use it instead of a website? Three common reasons:
- Your code is private and you do not want to give a cloud service access to it.
- You want to scan before you push, on the same laptop where you are writing code.
- You want to run the same scan in a build pipeline.
The CLI can also write code. It has an assistant built in, and you can ask it in plain language to fix a vulnerable dependency in the folder you are in. It asks before it changes things, which we cover below.
How do I install it?
Pick the line for your system. These are the commands listed on the Safeguard download page.
On macOS or Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
On Windows, in PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
The installer works out your operating system and chip type, finds the current release, checks the download against published checksums, and puts a single safeguard program on your path. A checksum is a short fingerprint of a file. If the fingerprint does not match, something went wrong with the download.
Check that it worked:
safeguard --version
If the version looks wrong, you may have an older copy earlier on your path. The documentation suggests running which -a safeguard on macOS and Linux to see every copy.
Should I pipe a script into my shell?
Fair question. Running a script straight from the internet means trusting it. The documentation encourages you to read it first. You can download it, read it, and then run it:
curl -fsSL https://cli.safeguard.sh/install -o install.sh
less install.sh
bash install.sh
The installer is about a hundred lines of plain shell, according to the docs. The page says to never pipe a URL you have not read into a shell, theirs included. That is good habit for any tool.
One detail for Windows users: the docs say the shell installer stops if the checksums file is missing, while the PowerShell one warns and continues. If that matters in your setting, check the archive yourself against the published checksums before you run it.
How do I sign in and finish setup?
Type this and press Enter:
safeguard
With no extra words, the CLI opens an interactive terminal rather than a help screen. The first run downloads the scanner tools and the vulnerability database. It can take a little while, so let it finish.
Then type this inside the terminal:
/login
Your browser opens. You approve the session there. The terminal picks it up and you are signed in. You can check who you are with /whoami and sign out with /logout.
If you work on a machine with no browser, the command safeguard login with the no browser option prints a web address and a code. You enter them on another device instead.
How do I run my first scan?
Inside the terminal, type:
/scan .
The dot means "the folder I am in". The terminal scans that folder and, because you are signed in, uploads the resulting SBOM and findings so you can see them in the platform next to your other projects. Your source files stay on your machine.
You can also run scans straight from your normal shell, outside the interactive terminal. The main forms are:
safeguard scan --dir .
safeguard scan --repo https://github.com/org/repo
safeguard scan --image nginx:latest
safeguard scan --sbom sbom.json
Each command takes exactly one target. A folder, a Git repository, a container image, or an SBOM you already have.
Here is a table of what each target is good for.
| Target | Use it when |
|---|---|
| A folder | You want to check code you are writing, including private code |
| A Git repository | You want to scan a repo by its address |
| A container image | You ship software inside a container |
| An SBOM | A supplier gave you one, or your build already makes one |
Results are written as JSON files in an output folder (the default is called output). They include a file of vulnerabilities and a file of licenses, among others. JSON is a plain text format that programs read easily.
One note for fresh machines. The scan uses two helper tools, named syft and grype. The interactive terminal downloads them on first use. If you run the scan on a clean machine that never opened the terminal, such as a new CI container, you must put both tools on the path yourself.
What can I ask the assistant to do?
Inside the interactive terminal, you can type in plain language. The documentation gives examples such as "how many critical vulns do we have" and "fix the lodash CVE in this repo".
Because the assistant can change files and run commands, it asks before it acts. A setting called permissions controls how often:
| Mode | What it does |
|---|---|
| Ask | Asks before every action |
| Auto | Approves known actions and asks about anything new (the default) |
| Yolo | Approves everything and never asks |
For your first week, we suggest Ask mode. Read each proposed change. Think of it as a new teammate: helpful, but you want to see their pull request before it merges.
What does a first scan look like, with invented numbers?
Here is a pretend run. The numbers are invented to show the flow.
You have a small web service in a folder called shop-api. You open a terminal there and run the scan. The CLI reports that it found 212 packages and 14 findings (these are made up for the example). Three of the findings are critical.
You ask the assistant, "show me the critical findings". It lists three packages. For two of them, a newer version fixes the flaw. You ask it to update those two. In Ask mode, it shows you the file change and the command it wants to run. You approve. It updates the files and you run your tests. All pass.
You now have one critical finding left with no fixed version. You write it down and decide whether to remove the package, work around it, or wait.
The whole loop took a short session, and nothing left your laptop except the scan results.
Does the CLI block bad builds?
Not by itself. This surprises people, so we will say it plainly. The scan command exits with a success code whenever the scan ran, whatever it found. The documentation says there is no severity threshold flag, and that blocking on findings is done by policy gates in the platform. We explain that in our post on pull request gates and in our guide to adding a scan and gate to your CI pipeline.
How does the CLI fit with the rest of Safeguard?
The CLI is one of several ways in. The same platform sits behind the desktop app, the editor extensions, the browser extensions and the AI assistant connectors. Safeguard capabilities you can use alongside it include SBOM and dependency scanning, reachability analysis, policies and gates, and autonomous remediation with fix pull requests. Remediation is off by default, and every category starts on Manual.
If you only want a quick look first, the free scan at gold.safeguard.sh/scan needs no install.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow the eight steps and look for the point where only results, not source code, go back to the platform.
Quick check
Does the CLI upload my source code?
No. The documentation says the CLI scans on your machine and uploads only the SBOM and findings, never your source code.
Do I need to install Node, Python or Java first?
No. The CLI is a single static binary with nothing to install beside it. It does download scanner tools the first time you open the interactive terminal.
Why did my scan finish with a success code even though it found problems?
By design. The scan command reports findings but does not fail on them. A policy gate in the platform decides whether a build should fail.
Can the CLI really write code?
Yes. Its built-in assistant can edit files, for example to update a vulnerable dependency. It asks before it acts unless you choose a mode that does not. Review each change like any other code change.
Sources
- Safeguard download page
- Safeguard CLI overview
- CLI installation
- CLI usage
- Interactive terminal
- Local runner
- Scan on your own machines demo
Last reviewed: 19 October 2026.
