No. Safeguard hosts its MCP server at https://mcp.safeguard.sh/mcp and publishes no npm package or local bridge for it. Nothing needs installing. A package that claims to be the Safeguard MCP server, or an instruction to run it through npx, did not come from Safeguard and should be treated as untrusted.
Why this matters
MCP setup guides often start with a line like npx some-package in a config file. That runs code from a public registry on your machine, with your environment variables in reach. Attackers know people copy these snippets. Any name that looks official is a candidate for a look-alike.
Safeguard's own documentation says plainly that its server is hosted, that it never reads SAFEGUARD_API_KEY or similar variables from your machine, and that no package for it exists.
Myth versus fact
| Myth | Fact |
|---|---|
| You must install a package to use Safeguard MCP | The server is hosted. You add a URL. |
| Set SAFEGUARD_API_KEY in your environment | The server never reads that variable. |
| Add Safeguard to claude_desktop_config.json | That file is for local servers. Add it as a connector in your Claude account. |
| Use mcp-remote or npx as a bridge | No local bridge is published. Remove such entries. |
| A key is always required | OAuth 2.0 is recommended and needs no key. |
Older guides did tell people to use npx and an environment variable. Those instructions are out of date.
What to do instead
Use the hosted address with OAuth. Claude's connector URL is https://mcp.safeguard.sh/mcp/anthropic. Most other clients use https://mcp.safeguard.sh/mcp. Gemini CLI and Grok have their own paths, listed in the docs. Walk through the guide for your assistant, such as Cursor or VS Code.
If you already installed something
- Remove the entry from your MCP configuration.
- Uninstall the package and clear it from any global tool cache.
- Rotate any key you gave it. Revoke MCP keys under Settings, then Developer in Safeguard.
- Review the machine the way you would after running any untrusted code.
Check any MCP package the same way
Before you install any MCP server package, ask: who publishes it, does the publisher's own documentation list it, how old is the package, and what does it execute at install time? Our guide to checking a VS Code extension before installing uses the same habits.
Safeguard can scan a package or dependency list for you. The free scan at gold.safeguard.sh/scan is a quick place to start, and the Safeguard CLI 1.4.0 installs with curl or PowerShell installers (npm is coming soon, per safeguard.sh/download).
Quick check
How do I confirm the server address is real?
Compare it with Safeguard's documentation and the sign-in page. The OAuth page shows the app name and the host the authorization code will be sent to. Check them before you click Authorize access.
Does the Safeguard CLI have anything to do with MCP?
No. The CLI is a separate client. The MCP server needs no local install.
Sources
Last reviewed: 19 October 2026.
