To install the Safeguard CLI on a Mac, open Terminal and run curl -fsSL https://cli.safeguard.sh/install | bash. The installer picks the Apple Silicon or Intel build, checks it and puts safeguard on your PATH. Then run safeguard, type /login, and scan your project with /scan ..
That is the short version. This guide walks through the whole first session on macOS: choosing the right build, installing and verifying, signing in, running a first scan, asking the assistant for a first fix and approving it, and adding the Mac desktop app.
One point before you start, because it changes what you need to buy. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. Switching to Safeguard does not mean giving up the AI you already have.
Which Mac, which build
The Safeguard CLI is one static binary. It has no runtime to install, so you do not need Node, Python or a JVM on your Mac. The support matrix lists two macOS targets: Apple Silicon (arm64) and Intel (amd64). The binary is about 40MB, and it downloads its scanners on first use, so leave some extra room.
You rarely need to pick a build yourself, because the install script detects your operating system and architecture. If you are downloading an archive by hand, or you just want to know, there are two quick ways to check your Mac.
From the menu: open the Apple menu, choose About This Mac, and look at the first line. Apple's support page explains that a Mac with Apple silicon shows an item labelled Chip followed by the chip name, while an Intel Mac shows an item labelled Processor followed by an Intel processor name.
From Terminal:
uname -m
# arm64 -> Apple Silicon build
# x86_64 -> Intel build
Here is how the Mac options line up, using only what the Safeguard download page and docs list.
| What you want | Apple Silicon Mac | Intel Mac | Notes |
|---|---|---|---|
| Safeguard CLI | darwin_arm64 archive | darwin_amd64 archive | Same install command for both; the script chooses |
| Desktop app 3.2.2 | Safeguard-3.2.2-arm64.dmg | Intel x64 build, linked from the download page | macOS 12 or later; signed and notarized |
| Checksum | Published SHA256SUMS beside each release | Same | The installer checks it for you |
| Homebrew | Not offered | Not offered | The runner docs say there is no Homebrew formula |
That last row matters on a Mac, where many people reach for brew install by habit. There is no Safeguard formula. Use the install script.
Do the work properly with the Safeguard CLI
The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan. The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. Anything that changes something, such as writing a file, editing code or running a command, asks before it acts.
The sections below take you from an empty Terminal window to a reviewed fix.
Step 1: Install from Terminal
Open Terminal (Applications, Utilities, Terminal, or press Command and Space and type Terminal). Then run:
curl -fsSL https://cli.safeguard.sh/install | bash
The script detects macOS and your chip, fetches the current release, verifies it against the published checksum file and places safeguard on your PATH. The docs note that the shell installer fails closed if the checksum file is missing, so a broken download stops rather than installs.
The installation docs recommend reading a script before you run it. If that is your habit, download it first:
curl -fsSL https://cli.safeguard.sh/install -o safeguard-install.sh
less safeguard-install.sh
bash safeguard-install.sh
Two environment variables control the install. SAFEGUARD_VERSION pins a specific release, and SAFEGUARD_INSTALL_DIR sets where the binary goes. By default the script tries /usr/local/bin and falls back to ~/.local/bin. To install into a folder in your home directory:
curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_INSTALL_DIR="$HOME/.local/bin" bash
Step 2: Confirm the install
safeguard --version
which -a safeguard
which -a lists every copy on your PATH, and the first one wins. If the version is not what you expected, an older build may sit earlier on your PATH. The troubleshooting page gives ~/go/bin as one example of where an old copy can hide.
If the shell says command not found, open a new Terminal window first. If it is still missing and the script used ~/.local/bin, add that folder to your PATH in zsh, the default macOS shell:
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc
For help on any command, safeguard --help lists them all and safeguard scan --help shows one. The docs say --help is authoritative if it ever disagrees with the written docs.
Step 3: First run and sign in
Run safeguard with no arguments. Instead of a help screen you get the interactive terminal. Let the first run finish: it downloads the scanner tools (syft, grype and trivy) and the vulnerability database. The docs are clear that safeguard update only refreshes databases for scanners you already have, so this first interactive run is the step that installs them.
Now sign in:
/login
Your browser opens, you approve the session, and the terminal picks it up. /whoami shows who you are signed in as, and /logout ends the session. Once you are signed in, the built-in local runner starts polling the platform for scan jobs assigned to this Mac, and the bar above the input shows its state, your model and the connection status.
If the browser does not open, for example because you are connected to the Mac over SSH, run safeguard login --no-browser. The CLI prints a URL and a code; open the URL on any device, enter the code and approve.
A Mac-specific option worth knowing: by default the sign-in token is stored in ~/.scanner/token.json, readable only by you. Set SAFEGUARD_CREDENTIAL_STORE=native to keep it in the macOS Keychain instead, or auto to use the Keychain when it is available.
Step 4: Your first scan
Move into a project folder and scan it from the interactive terminal:
/scan .
Called with no argument, /scan asks what to scan; it also accepts a folder, an image or a repo. While signed in, a scan from the interactive terminal shows up in the platform, and only the SBOM and findings are uploaded. Your source code stays on the Mac. /status shows the user, tenant, runner, job counts and approval mode, and /jobs shows recent scan history.
You can also scan without the interactive terminal. safeguard scan builds an SBOM, matches it against vulnerability databases and writes JSON results. Each run takes exactly one target:
safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image nginx:latest
safeguard scan --sbom ./bom.cdx.json
Results land under ./output by default (change it with --output), with files such as vuln.json, license.json and collection.json in a folder per scan. The exit code tells you whether the scan ran, not whether it found something: 0 means it ran, 1 means the command failed, and 2 means results were written but the vulnerability scan did not run. Gating a build on findings is done through policies and gates in the platform, not by a CLI threshold.
If you have SBOMs from elsewhere, safeguard validate checks CycloneDX, SPDX and VEX documents against their specifications:
safeguard validate ./sboms --recursive --strict
Step 5: Your first fix, with your approval
This is where the CLI stops being only a scanner. In the interactive terminal, ask in plain language:
how many critical vulns do we have
fix the lodash CVE in this repo
The assistant reads your Safeguard data to answer the first question and your local files to work on the second. When it wants to edit package.json, write a lockfile change or run your package manager, it stops and asks. You approve or decline each change, and you can press esc to interrupt a running task without leaving the terminal.
Three habits make a first fix go well:
- Attach context with
@. Typing@opens a file picker for the folder you started in, so you can attachpackage.jsonor a failing test to your message. - Review before you commit. After the assistant finishes, run
git diffyourself, run your tests, then ask it to scan again or type/scan .. - Use it for ordinary work too. The docs give "what's the latest file in ~/Downloads" as an example. The same assistant can find and read files, edit code and run commands on your Mac, always with your approval under the current mode.
For dependency work outside the chat, the usage docs list safeguard fix for fixing vulnerable dependencies and safeguard review for reviewing working-tree changes; run safeguard fix --help and safeguard review --help for the details. If you use another coding agent, the guide on checking what a coding agent changed shows how to scan its work before merge.
Here is the same flow in the platform: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs.
Click through it at your own pace, or open it full screen.
The demo notes that computer work from Search is available and expanding, so treat it as a preview of where that flow is going.
Step 6: Use your Claude, ChatGPT or Codex plan
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply.
To see or change the model the assistant uses, type /model. With no argument it opens a picker; with a name it switches directly. For connecting a model from your own plan, see the CLI docs and /model rather than guessing at settings.
If you prefer to stay in the chat app you already use, connect Claude or ChatGPT to the Safeguard MCP server. Claude's help centre says custom connectors over remote MCP work on Claude, Cowork and Claude Desktop, on Free, Pro, Max, Team and Enterprise plans, with Free limited to one custom connector. On Pro and Max you add one from Customize, Connectors. On Team and Enterprise an Owner adds it first and members then connect. This demo shows the Claude side: connecting to the Safeguard MCP server with OAuth and choosing which tools Claude can use.
Click through it at your own pace, or open it full screen.
For a broader look at the two chat assistants, see Claude vs ChatGPT for coding.
Step 7: Choose an approval mode
/permissions sets how much the assistant may do before asking. The current mode is shown in the bar below the input.
| Mode | What it does | When it fits |
|---|---|---|
| Ask | Prompts before every action | Your first sessions, unfamiliar repos, anything near production |
| Auto (default) | Approves known actions, asks for anything new | Day to day work once you know the patterns |
| Yolo | Approves everything | Throwaway folders and sandboxes you can delete |
Start in Ask for your first fix so you see each step. Repository settings in .safeguard/settings.json only take effect after you run safeguard trust in that repository, and they cannot set sign-in, provider or server URLs. Personal overrides go in .safeguard/settings.local.json, which is not committed.
Step 8: Run the assistant in CI with safeguard exec
On a macOS build machine, or any CI runner, safeguard exec runs one non-interactive assistant turn and exits:
safeguard exec "summarise the critical findings in this repository" --output-format json
In exec mode the default permission mode is strict, which denies anything a policy file has not pre-approved. It needs a git repository unless you pass --skip-git-repo-check. For pipelines, pin the CLI with SAFEGUARD_VERSION so a new release does not change your build without notice. The CI/CD integration docs cover authenticating a pipeline.
Keeping it current, or removing it
safeguard self-update updates the binary, and safeguard self-update --check only checks. Re-running the install script also replaces the binary with the current release. safeguard update refreshes the vulnerability databases.
To uninstall, run safeguard logout --yes, delete the binary, and remove ~/.sg (logs and history), ~/.scanner (sign-in token) and ~/.cli (deployment config). That does not touch your data on the platform.
Add the Mac desktop app
The CLI is home base, but Safeguard is one platform on every surface. The desktop app, version 3.2.2 on the download page, lets you ask your supply chain anything in plain English in a native window.
On a Mac:
- Check your chip in About This Mac. "Apple M" means Apple Silicon; "Intel" means the x64 build.
- Download
Safeguard-3.2.2-arm64.dmgfor Apple Silicon, or follow the linked Intel build. - Open the
.dmgand drag Safeguard to Applications.
The app needs macOS 12 or later. The download page says both builds are signed with Safeguard.sh Inc's Developer ID and notarized by Apple, so there are no warnings to click through. If you want to verify the file, the full checksums are in the release's SHA256SUMS, and macOS has the tool built in:
shasum -a 256 ~/Downloads/Safeguard-3.2.2-arm64.dmg
From there the experience carries across devices. Start in the terminal with a scan and a fix, continue on the desktop with plain-English questions, and check findings on your phone with the iOS app for iPhone and iPad. The browser extension is on the Chrome Web Store (Chrome, Brave, Arc, Vivaldi, Opera and Edge) and Firefox Add-ons, and Safari on iPhone and iPad runs it inside the iOS app. Safari on the Mac is in Apple review, so it is not available yet. There is also an IDE extension for VS Code, JetBrains and Open VSX, and cloud options with nothing to install: the Cloud CLI on Safeguard's infrastructure, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.
For a deeper tour of what the assistant does once it is running, read the Safeguard CLI as an AI assistant on your machine.
Common mistakes on macOS
Looking for a Homebrew formula. There is none. Use the install script, which also verifies the checksum.
Two copies on the PATH. An old build in ~/go/bin or a manual copy can shadow the new one. Run which -a safeguard, keep one, and confirm with safeguard --version.
Running safeguard update before the first interactive run. It refreshes databases for scanners you already have; it does not install missing ones. If a scan reports "syft binary not found", run safeguard once and let setup finish.
Scanning before installing dependencies. An incomplete SBOM usually means missing lockfiles. Run npm install, pip install -r requirements.txt or go mod download first, and check that files such as package-lock.json exist. If you see "No dependencies found", check pwd and try safeguard scan --dir "$(pwd)".
Writing results into a folder you do not own. Point output somewhere safe with --output ~/safeguard-results.
Corporate proxy or TLS inspection. Export HTTP_PROXY and HTTPS_PROXY, and make sure outbound HTTPS on port 443 is allowed. For a corporate CA, either set SSL_CERT_FILE or add the CA to the System keychain with security add-trusted-cert. Do not turn off certificate checks.
Leaving Yolo on. Yolo approves everything. Switch back with /permissions when you leave a sandbox folder.
Expecting mouse-wheel scrolling. The transcript does not scroll with the wheel. Use Page Up and Page Down or the arrow keys, and /copy to grab the last answer. For a new line in your message, ctrl+j works everywhere.
When something still looks wrong, safeguard doctor (or /doctor) checks environment, sign-in, tools and policy without changing anything. Logs are in ~/.sg/logs/safeguard.log.
FAQ
Does the Safeguard CLI run natively on Apple Silicon?
Yes. The support matrix lists a native macOS Apple Silicon (arm64) build alongside the Intel (amd64) build, and the install script picks the right one for your Mac.
Can I keep using my Claude, ChatGPT or Codex subscription?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat. See the CLI docs or /model for connecting a model.
Does my source code leave my Mac?
When the local runner runs platform scan jobs, only SBOMs and findings are uploaded; your source code stays on the machine. A /scan . from the interactive terminal also uploads only the SBOM and findings.
Will the assistant change files without asking?
Not in Ask or Auto mode. Tools that write files, edit code or run commands ask before they act, according to the /permissions mode. Auto, the default, approves known actions and asks for anything new. Only Yolo approves everything.
Do I need Node, Python or Xcode tools installed?
The CLI itself needs no runtime: it is a single static binary. Your project's own package manager is a different matter, because an accurate scan depends on installed dependencies and lockfiles.
Is the Mac desktop app signed?
The download page says both macOS builds are signed with Safeguard.sh Inc's Developer ID and notarized by Apple. The app needs macOS 12 or later.
How do I sign in on a Mac I reach over SSH?
Run safeguard login --no-browser. The CLI prints a URL and a code. Open the URL on any device, enter the code and approve.
Can I store the sign-in token in Keychain?
Yes. Set SAFEGUARD_CREDENTIAL_STORE=native to use the macOS Keychain, or auto to use it when available. The default is a file at ~/.scanner/token.json readable only by you.
Try it yourself
This walkthrough covers the install and start: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
When you are ready to do it for real, get the CLI and the Mac app from safeguard.sh/download, and keep the CLI docs open in another tab for your first session.
Quick check
Which command installs the Safeguard CLI on both Apple Silicon and Intel Macs?
The same one: curl -fsSL https://cli.safeguard.sh/install | bash. The script detects your chip, verifies the checksum and puts safeguard on your PATH.
What is the default approval mode, and what does it do?
Auto. It approves actions the assistant already knows and asks before anything new. Change it with /permissions to Ask (prompt every time) or Yolo (approve everything).
Why might a fresh scan report that syft is missing?
The scanners download during the first interactive run. Run safeguard once and let setup finish; safeguard update only refreshes databases for scanners that are already installed.
Sources
- Safeguard CLI documentation
- Safeguard CLI installation
- Safeguard CLI interactive terminal
- Safeguard CLI slash commands
- Safeguard CLI usage
- Safeguard CLI system configuration
- Safeguard CLI troubleshooting
- Safeguard CLI support matrix
- Safeguard local runner
- Safeguard CI/CD integration
- Safeguard downloads
- Apple Support: Mac computers with Apple silicon
- Claude Help Center: custom connectors using remote MCP
Last reviewed: 21 October 2026.
