You can connect ChatGPT to Safeguard through the MCP server at mcp.safeguard.sh, then ask it to list your SBOMs, inspect components and licenses, and compare builds. ChatGPT reads and explains SBOMs that Safeguard already holds. To create a new SBOM from source, use the Safeguard CLI or your CI pipeline.
What does this connection do?
Safeguard publishes an MCP server endpoint for ChatGPT at https://mcp.safeguard.sh/mcp/openai. Once connected, ChatGPT can call Safeguard tools on your behalf, scoped to your tenant. Tool calls over MCP are unlimited on every plan.
According to the ChatGPT setup guide on safeguard.sh, the connection lets you inspect components, package versions, transitive dependencies and license obligations from your SBOMs. It can also diff SBOMs in CycloneDX and SPDX formats to show what changed between builds and releases.
How do you connect it?
You need a Safeguard account at app.safeguard.sh. The setup guide describes two routes.
Route one: native MCP support in ChatGPT
- In ChatGPT, open Plugins, select the plus button, then choose Add custom MCP server.
- Enter
https://mcp.safeguard.sh/mcp/openai. - Sign in with OAuth and select Authorize access. No key is needed.
Route two: a Custom GPT with Actions
- Create a Custom GPT, then open Configure and then Actions.
- Import the OpenAPI schema from
https://mcp.safeguard.sh/openapi.json. - Under Authentication, choose API Key with the Bearer auth type, and paste a Safeguard MCP key. You create that key in the Safeguard app under Settings and then Developer, with key type MCP key.
API key access to MCP is enabled per workspace. If you do not see the key option, ask your Safeguard administrator. Tenant admins can also switch off any client type, so if ChatGPT cannot connect, check that policy first.
What should you ask?
The setup guide lists example prompts. These work as a start:
- List my security projects.
- Show me all SBOMs.
- Find critical vulnerabilities across my projects.
- Which packages violate my license policy?
- Generate a remediation plan for my npm project.
Then get specific. Ask which transitive dependency introduced a flagged package, which components changed between two releases, or which licenses in a release need legal review. Specific questions give answers you can check.
What should you double check?
An assistant summarizing an SBOM is a convenience, not a source of record. Treat the SBOM and findings inside Safeguard as the record, and open the project when something matters. If the answer names a package and version, confirm it in the app before you act. Ask the assistant to cite the project and component it used.
Keep the connection narrow. Grant it to people who already have access to the data, and review who has MCP keys the way you review any other credential. Rotate a key if it is pasted anywhere it should not be.
Where does the SBOM come from?
Safeguard builds SBOMs from scans of your code and artifacts. The CLI, @safeguard-sh/cli, can generate SBOMs and runs on macOS, Windows and Linux. CI pipelines can generate them on each build. After that, ChatGPT can read what the platform holds.
Try the walkthrough at /demos/mcp-server-setup.
What to do
- Sign in at app.safeguard.sh and confirm your SBOMs are there.
- Add the MCP server in ChatGPT with OAuth, or create an MCP key for the Custom GPT route.
- Ask for a list of SBOMs, then pick one release and ask for its license obligations.
- Diff two builds and review the changed components in the app.
- Review who holds MCP keys and rotate any that are old.
Quick check
Does ChatGPT generate the SBOM?
No. It reads and explains SBOMs held in Safeguard. Generate them with the CLI or in CI.
Do I need an API key?
Not for native MCP support, which uses OAuth. The Custom GPT route uses an MCP key.
Sources
Last reviewed: 18 October 2026.
