Pulling audit evidence into Claude with the Safeguard MCP server

You can connect Claude to the Safeguard MCP server and ask, in plain language, about your vulnerabilities, SBOMs, findings and compliance data, then save each answer as audit evidence. The server at mcp.safeguard.sh is described as a way to connect an AI assistant to your supply chain security data. You still review and file what it returns.

How do you connect Claude?

Safeguard's setup page gives these steps for Claude on the web and Claude Desktop. The server URL is https://mcp.safeguard.sh/mcp/anthropic, and authentication is OAuth 2.0 with PKCE, so you sign in with your Safeguard account and need no API key or local install.

1. In Claude, open Customize, then Connectors, select Add, then Add custom connector. On a Team or Enterprise plan an Owner adds it under organization settings, and members then select Connect.
2. Name the connector Safeguard, paste the URL and select Continue.
3. Under Authentication choose Sign in now. Under OAuth client choose Register automatically. Select Add.
4. Sign in to Safeguard, check the app name and host the authorization will go to, then select Authorize access.

Claude Desktop uses the connectors added in Claude. The setup page says not to edit the Claude Desktop configuration file for this, since it only starts local servers.

What can you ask for?

The MCP page says you can query vulnerabilities, SBOMs, findings and compliance in plain language. It does not list individual tools or promise a particular report format, so treat what follows as a way of working, not a feature list.

Good evidence questions are specific and bounded:

• Which open findings are rated critical or high for this application, and how old is each?
• Which findings were closed in the last quarter, and when?
• Show the SBOM components for this release.
• What is the current compliance status for the controls we have mapped?

Ask for the identifiers, dates and sources in the answer. Evidence without a date and a source is a claim.

How do you turn answers into evidence?

An auditor wants something they can trace. For each answer:

1. Record the question, the date and time, and who asked.
2. Save the response with the identifiers it cites.
3. Open the same record in the Safeguard web app and confirm it matches. Spot check, do not skip.
4. File it in your evidence folder under the control it supports.
5. Note any gap the answer reveals, and open a ticket.

Remember the assistant is a reader of your data, not an authority. If an answer looks odd, check the source record before you file it. MCP tool calls on Safeguard are unlimited on every plan, so spot checks cost nothing extra. Tenant admins can also switch off any client type, so confirm Claude is allowed in your tenant before you plan the process.

What it does not do

The server's page makes no claim that it produces audit-ready reports on its own, and Safeguard does not certify you for any framework. Auditors judge your controls and your evidence, so the process above is yours.

See it in motion

Our Claude demo shows an assistant working with Safeguard data.

Open the full demo at /demos/claude-with-safeguard.

What to do

1. Confirm with your tenant admin that Claude clients are enabled.
2. Add the connector with the steps above and sign in.
3. List the controls you need evidence for in this audit cycle.
4. Write one bounded question per control.
5. Save each answer with its date, source identifiers and the person who asked.
6. Verify a sample of answers in the web app.
7. File the evidence under each control and log gaps as tickets.
8. Repeat on a schedule so evidence covers the whole audit period.

Quick check

Sources

• Safeguard MCP server, fetched 18 October 2026.
• Safeguard MCP setup, fetched 18 October 2026.

Last reviewed: 18 October 2026.