The Safeguard CLI installs with one command: a curl line on macOS and Linux, a PowerShell line on Windows. It is a single binary, the installer picks the right build for your machine and checks the download against a published checksum. Afterward, run the version command to confirm what you got.
The two install commands
On macOS or Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
On Windows, in PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
The download page describes the CLI as a single static binary with no runtime to install. That means no Node, no Python and no JVM needed just to run it.
An npm package is listed as coming soon, so do not plan around npm install yet. Use the installers.
Which builds exist
The documentation lists these archives:
- macOS on Apple Silicon and on Intel
- Linux on x86_64 and on arm64
- Windows on x86_64
There is no native Windows on ARM build. The PowerShell installer installs the x86_64 binary, which runs under emulation on those machines.
Where the binary lands
On macOS and Linux the installer tries /usr/local/bin first and falls back to ~/.local/bin when that folder is not writable. On Windows the default is %LOCALAPPDATA%\Safeguard\bin, and the installer adds it to your user PATH.
If you want a different place, set the install directory variable before running the installer:
SAFEGUARD_INSTALL_DIR="$HOME/bin" curl -fsSL https://cli.safeguard.sh/install | bash
Root is only needed if you point it at a system folder such as /usr/local/bin.
Confirm it worked
safeguard --version
If the printed version is not what you expected, an older copy is probably earlier on your PATH, for example one under ~/go/bin. List every copy and remove the one you do not want:
which -a safeguard
On Windows the equivalent is Get-Command safeguard -All. A new PowerShell window is often needed before the PATH change shows up.
First run downloads the scanners
A fresh install does not ship the scanner tools. Run safeguard once with no arguments and let the first-run setup finish. The documentation notes that the database refresh command does not install missing scanners, so if a later scan says a scanner binary is not found, the first-run step is the fix.
Upgrading and removing
To upgrade, run the installer again. It replaces the binary in place. To pin a specific release, which is common in CI, set the version variable on the same line. We cover that in a separate post on pinning.
To remove it, sign out, delete the binary, then delete the three state folders the docs name: ~/.sg, ~/.scanner and ~/.cli. Removing them touches nothing on the platform side.
Quick check
Do I need admin rights to install the CLI?
Not by default. If the system folder is not writable, the shell installer falls back to a folder in your home directory. You only need elevated rights if you choose a system location yourself.
Is there an npm install?
Not yet. The documentation lists an npm package as coming soon. Use the curl or PowerShell installer for now.
If you want a quick look at what a scan reports before installing anything, the free scan at gold.safeguard.sh/scan needs no setup.
Sources
Last reviewed: 19 October 2026.
